Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service or other agreement (the "Agreement") between the Customer ("controller") and Grupo Impulso Digital S.A. de C.V., Panfilo Perez 879, Blanco y Cuellar, Guadalajara, Jalisco, Mexico ("processor", "we"). It applies whenever we process Customer Personal Data in providing Gravity.

It is written to meet Article 28 of the EU GDPR and the UK GDPR, the Swiss FADP, the California Consumer Privacy Act as a service-provider contract, Canada’s PIPEDA and Mexico’s LFPDPPP. Where the Customer is itself a processor, we act as its subprocessor and these terms apply accordingly.

"Customer Personal Data" means personal data in Customer Data that we process on the Customer’s behalf. "Data Protection Laws", "personal data", "processing", "controller", "processor", "data subject" and "supervisory authority" have the meanings given in the GDPR or the closest equivalent in other applicable law. "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

We process Customer Personal Data only on the Customer’s documented instructions. The Agreement, this DPA, and the Customer’s configuration of the Service (for example publishing a site, inviting members, running a CLI pass or enabling Ask AI) are those instructions. We will tell the Customer if we believe an instruction breaks Data Protection Laws.

We do not sell or share Customer Personal Data, do not use it for our own purposes, do not combine it with other data except as the Service requires, and do not use it to train AI models.

Everyone we authorise to process Customer Personal Data is bound by confidentiality. Support access to a Customer workspace by our platform administrators requires a recorded reason, is limited to that workspace, and is written to the Customer’s audit trail.

We implement the technical and organisational measures in Annex II, taking into account the state of the art, cost, and the nature and risks of the processing. We may update them as long as the overall level of protection does not decrease.

The Customer gives general authorisation for us to engage the subprocessors listed in Annex III and at gravitydocs.io/legal/subprocessors. We impose data-protection obligations on each that are no less protective than this DPA, and remain liable for their performance.

We give at least 30 days’ notice of a new subprocessor. The Customer may object on reasonable data-protection grounds within that period; we will then try to offer an alternative, and if we cannot, the Customer may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees.

Taking into account the nature of the processing, we help the Customer answer data subject requests, mainly through the Service itself: administrators can find, edit, export (for example as PDF) and delete content, manage members and audience contacts, and set Ask AI retention. We forward to the Customer any request we receive directly about Customer Personal Data and do not answer it ourselves unless instructed.

We also give reasonable help with data protection impact assessments, prior consultations and security obligations, to the extent the information is available to us.

We notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed, and will be updated as we learn more.

At the end of the Agreement the Customer may export its content for 30 days. We then delete Customer Personal Data from active systems within 30 days and from backups as they expire on their normal cycle, unless the law requires us to keep it. Audit records, which contain actor identifiers and IP addresses, are retained for the period stated in Annex II to preserve the integrity of the audit trail. We will confirm deletion in writing on request.

We make available the information necessary to demonstrate compliance with this DPA, including completed security questionnaires and, once available, third-party reports. Where that is not enough, the Customer (or an independent auditor bound by confidentiality) may audit our compliance once a year on 30 days’ notice, during business hours, at its own cost, and without access to other customers’ data.

We and our subprocessors process data in the United States, Canada and on a global edge network. For transfers of Customer Personal Data from the EEA to a country without an adequacy decision, the parties incorporate the SCCs by reference, as follows:

• Module Two (controller to processor) applies where the Customer is a controller; Module Three (processor to processor) applies where the Customer is a processor.
• Clause 7 (docking clause) applies.
• Clause 9(a): Option 2, general written authorisation, with the notice period in section 6 of this DPA.
• Clause 11(a): the optional redress language does not apply.
• Clause 13: the supervisory authority of the Customer’s EU establishment or EU representative, or otherwise Ireland.
• Clauses 17 and 18: the law and courts of Ireland.
• Annexes I, II and III of the SCCs are completed by Annexes I, II and III of this DPA.

For transfers from the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner (version B1.0) applies, with its tables completed by the information in this DPA, and either party may end it as described in its Section 19. For transfers from Switzerland, the SCCs apply with references to the GDPR read as references to the FADP, and the Swiss FDPIC as competent authority where the transfer is governed by Swiss law.

If a transfer mechanism is invalidated, the parties will cooperate in good faith to adopt an alternative.

Where the CCPA or similar US state laws apply, we are a service provider or processor. We will not sell or share Customer Personal Data, retain, use or disclose it outside the direct business relationship, or combine it with personal data from other sources except as those laws permit, and we will tell the Customer if we can no longer meet these obligations.

• Encryption: TLS for all traffic to the app, API and published sites; encryption at rest provided by Cloudflare R2 and Neon. AI provider keys stored by the Customer are encrypted at rest with a dedicated key.
• Identity and access: sign-in through Polaris with password, social login, two-factor authentication or the Customer’s SAML / OIDC identity provider; SSO enforcement and SCIM provisioning where enabled. Role-based permissions (owner, admin, member, member tags) and access granted per site, space or collection. API keys are hashed at rest; GitHub access uses short-lived installation tokens scoped per call.
• Tenant isolation: every record carries its organisation, and every request is scoped to the organisation of the authenticated caller. Suspended organisations are refused before any procedure runs.
• Audit logging: actions in the app, API and MCP server are recorded with actor, role, action, resource, result, IP address, user agent and time, in a tamper-evident hash-chained log with timestamp checkpoints. Entries are kept hot for 60 days and then archived to object storage for 10 years.
• Integrity of published content: every published version is hashed with SHA-256, chained to the previous version and signed; the chain can be verified at any time.
• Change control: content reaches Readers only through review and publish; AI-generated changes arrive as change requests like human ones.
• No execution of customer code: the Service reads source code and never executes it on our infrastructure.
• Data minimisation: Ask AI questions are PII-redacted before storage, with retention set by the Customer; the Doc Agent can blur regions it identifies as sensitive in screenshots, but nothing is masked automatically.
• Support access: platform-administrator access to a workspace requires a recorded reason and is written to that workspace’s audit trail.
• Resilience: managed Postgres with point-in-time recovery, nightly encrypted backups kept for 35 days, and a documented restore drill.
• Monitoring: error monitoring and alerting through Sentry; security fixes prioritised by severity.
• Personnel: confidentiality obligations; least-privilege access to production; secrets held in a secrets manager, never in code.

Impulso services that also process Customer Personal Data: