Data Processing Agreement.

1. Parties and roles

This Data Processing Agreement (the “DPA”) is between the organization that uses the CapZero application (the “Customer”), as controller, and Overtake Capital LLC, doing business as CapZero (“CapZero”), as processor. It forms part of the CapZero product Terms of Service (the “Terms”) and applies when the data the Customer puts into the CapZero application at app.capzero.ai includes personal data. Creating an organization accepts this DPA on the organization’s behalf.

“Customer Personal Data” means personal data in the data that the Customer, its users and its agents put into the Service, including records, files and mail or messages from connected accounts. Other terms, such as “personal data”, “processing” and “personal data breach”, have the meanings given by applicable data protection law. How CapZero uses information as a controller, for accounts, security, billing and support, is described in the product privacy notice.

2. Subject matter, duration, nature and purpose

• Subject matter: providing the CapZero application, its APIs and MCP connectors (the “Service”) under the Terms.
• Duration: for as long as the Customer uses the Service, and afterwards until deletion under section 9.
• Nature: hosting, storage, search indexing, retrieval, transmission (including email and connected integrations), backup and deletion.
• Purpose: to provide, secure and support the Service for the Customer.

Annex 1 gives the details.

3. Processing on documented instructions

CapZero processes Customer Personal Data only on the Customer’s documented instructions. The Terms, this DPA, and the Customer’s use and configuration of the Service (for example, connecting an integration or turning on mail body sync) are those instructions. If the law requires other processing, CapZero will tell the Customer first unless the law forbids it. CapZero will tell the Customer if it believes an instruction breaks data protection law.

4. Confidentiality of personnel

CapZero gives access to Customer Personal Data only to people who need it to provide, secure or support the Service, and who are bound by confidentiality obligations.

5. Security

CapZero implements the technical and organizational measures in Annex 2. It may change them over time, but not in a way that reduces the overall protection of Customer Personal Data.

6. Subprocessors

The Customer authorizes CapZero to use the subprocessors in Annex 3. CapZero binds each subprocessor to data protection obligations that protect Customer Personal Data at least as well as this DPA, and remains responsible for their performance.

Before adding or replacing a subprocessor, CapZero will update Annex 3 on this page and notify the Customer’s administrators by email. CapZero gives this notice at least 30 days before the new subprocessor begins processing Customer Personal Data, except where an urgent replacement is needed to keep the Service running or secure, in which case it gives notice as soon as practicable. The Customer may object on reasonable data protection grounds within that period, and the parties will discuss the objection in good faith.

7. Assistance with requests and assessments

The Service lets the Customer export its data (Settings → Export) and delete its organization, which helps it answer requests from the people its data concerns. If CapZero receives such a request directly, it will refer the person to the Customer and will not answer it otherwise without the Customer’s authorization. CapZero will give reasonable help with requests the Customer cannot handle with the Service, and with data protection impact assessments and consultations with authorities, using the information available to it.

8. Personal data breaches

CapZero will notify the Customer’s administrators of a personal data breach affecting Customer Personal Data without undue delay, and in any event within 48 hours after becoming aware of it. The notice will describe, as far as known, the nature of the breach, the categories and approximate number of people and records concerned, its likely consequences, and the measures taken or proposed. CapZero will add information as it becomes available and take reasonable steps to contain the breach.

9. Return and deletion

The Customer can export its data at any time in Settings → Export; download links last 24 hours. When an administrator requests deletion of the organization, the organization is suspended for a 30-day grace period. Its files, records and keys are then purged, leaving only a minimal record with an opaque identifier and timestamps. Backup copies expire within 35 days. Audit log entries cannot be changed or deleted and are kept for a target of 7 years. CapZero keeps Customer Personal Data longer only where the law requires.

10. Audits and information

CapZero will make available the information needed to show that it meets this DPA, including this page and its annexes and answers to reasonable security questionnaires, and will allow and contribute to audits. CapZero first answers audit requests with its documentation and written answers. Where these are not enough to show compliance, or a data protection authority requires it, the Customer may have an independent auditor bound by confidentiality inspect the relevant controls, no more than once in any 12 months (or after a personal data breach), on at least 30 days’ written notice, during business hours, without access to other customers’ data, and at the Customer’s cost.

11. International transfers

The Service is hosted in the United States, with the locations given in Annex 3. Where Customer Personal Data is transferred from a country that restricts such transfers, the parties rely on the Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914, Module Two (controller to processor), which are incorporated into this DPA by reference, with the Customer as data exporter and CapZero as data importer. In those clauses, the optional docking clause (Clause 7) does not apply; Clause 9 option 2 (general written authorization) applies, with the notice period in Section 6; the optional wording in Clause 11 does not apply; Clause 17 option 1 applies, with the law of Ireland; the courts of Ireland are chosen under Clause 18; and Annexes I, II and III are completed by Annexes 1, 2 and 3 of this DPA. For transfers from the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner applies, with its tables completed by this DPA and either party able to end it as its Section 19 allows. For transfers from Switzerland, the same clauses apply with the Federal Act on Data Protection in place of the GDPR and the Swiss Federal Data Protection and Information Commissioner as the competent authority. If the parties’ transfers are covered by another lawful mechanism, such as an adequacy decision, that mechanism applies instead. CapZero binds its subprocessors to safeguards that protect transferred data at least as well.

12. Relationship to the Terms

If this DPA and the Terms conflict about the processing of Customer Personal Data, this DPA prevails. Liability under this DPA is subject to the liability section of the Terms. New versions of this DPA are published at this address with a new version label.

Annex 1: Processing details

• Data subjects: the Customer’s users; people whose information the Customer records in its apps, such as contacts at organizations it works with; and correspondents in mail and Slack messages synced from connected accounts.
• Personal data: whatever the Customer chooses to record, such as names, contact details and notes; files; mail metadata (addresses, time, thread and subject), and mail bodies (up to 50,000 characters) only if the Customer turns that on; Slack messages and channel information; users’ identifiers and their activity in the audit log. Mail attachments are never kept.
• Special categories: the Customer decides whether to record them. Fields can be marked sensitive or hidden, which keeps them out of search embeddings.
• Frequency: continuous, while the Customer uses the Service.
• Mail sync: the first sync reads the last 30 days of mail, then new mail every 5 minutes, and keeps only messages involving people or organizations in the Customer’s records.
• Retention: as in section 9.

Annex 2: Security measures

• Tenant isolation: row-level security isolates every organization’s data in the database.
• Encryption: stored credentials are encrypted with per-organization AES-256-GCM data keys, wrapped by an environment master key held in Cloudflare Secrets Store. All traffic uses TLS, with HTTP Strict Transport Security.
• Sign-in: no passwords. People sign in with an emailed 6-digit code, stored as a hash and expiring after 10 minutes, or with Google. Two-step verification by passkey or authenticator app, with recovery codes, is required for administrators and operators. Session cookies are HttpOnly, Secure and SameSite=Lax.
• Application protections: a Content Security Policy with nonces, cross-site request forgery protection, and bot checks on sign-up, sign-in code requests, access requests and public forms.
• Audit and logging: audit log entries cannot be changed or deleted. Logs must not contain record contents, tokens or secrets.
• Data minimization: mail attachments are never kept, and mail bodies only if the Customer turns that on. The builder assistant’s AI provider receives the person’s request and the app’s draft definition, never the organization’s records. Search embeddings never include fields marked sensitive or hidden.
• Backup and recovery: database point-in-time restore for 7 days, daily production snapshots kept for 35 days, and file backup copies in a second region kept for 35 days. Recovery targets: data loss of no more than 1 hour (RPO) and service restored within 4 hours (RTO).
• Vulnerability reports: handled under the vulnerability disclosure policy.

Annex 3: Subprocessors

Providers are listed by service name. The legal entity that provides each service, and its data protection terms, are available on request.

Stripe processes billing details, when billing is enabled, for which CapZero is the controller; it is not a subprocessor of Customer Personal Data. Google, Microsoft and Slack are the Customer’s own providers: the Customer connects them by choice, under their terms, and they are not CapZero’s subprocessors.