Data processing agreement

Preamble

This agreement governs the processing of personal data on behalf of a controller under Art. 28 of the General Data Protection Regulation (GDPR) between the customer as controller (“customer”) and Wimbex UG (haftungsbeschränkt), Pulverturmstraße 8, 84028 Landshut, Germany, represented by its managing director, Felix Wimberger, registered in the commercial register of the Local Court (Amtsgericht) of Landshut under HRB 15568, as processor (“provider”).

It applies to customers who use Napyon as a business (Section 14 German Civil Code, BGB) and process third parties’ personal data in it, for example of clients, contacts or employees. It becomes part of the contract of use when the customer agrees to the terms of service. On request we also send it for signature; write to support@napyon.com.

§ 1 Subject matter and duration

The subject matter is operating Napyon for the customer: storing, displaying, sharing, exporting and, on request, automatically processing the content that the customer and the people they invite store in Napyon. This agreement runs as long as the contract of use and ends with it, but not before the provider has deleted all of the customer’s data (§ 10).

§ 2 Nature and purpose of processing

• Hosting and storage of content and files in a database and file storage
• Display, search, real-time collaboration, sharing with members, guests and via links
• Providing content to the customer’s clients through client areas, share links and delivery approvals without login, including storing views, approvals, change requests and files these people upload
• Sending emails that Napyon sends on the customer’s behalf (invitations, shares, reminders, notifications)
• Export and import of content
• Processing by Napyon AI (models from Anthropic), only when an authorized person starts an AI feature; results are labeled “Created with Napyon AI”
• Recording, storage and transcription of conversations in client files and their analysis by Napyon AI, only when an authorized person records or uploads a conversation; before every recording they confirm the consent of everyone involved, which the customer obtains under the law where those involved are (in Germany Section 201 of the German Criminal Code); the customer determines the legal basis for the conversation partners’ data
• Providing content to AI assistants that an authorized person connects to Napyon themselves (Claude by Anthropic, ChatGPT by OpenAI), only at their instruction (§ 6)
• Backups, error analysis and abuse prevention

§ 3 Types of data and data subjects

Types of personal data: content the customer stores (texts, tasks, comments, files, images, tables), contact and project data contained in it, recordings and transcripts of conversations (voice and spoken content), names and email addresses of members and guests, roles and permissions, usage and log data (for example times, versions, sessions).

Data subjects: the customer’s users (workspace members, guests), the customer’s clients, prospects, contacts, conversation partners and service providers, people who open a client area, share link or delivery approval link of the customer, and other people named in the customer’s content.

Special categories of personal data (Art. 9 GDPR) are not covered by this agreement. If the customer stores such data anyway, the customer is responsible for ensuring the processing is lawful.

§ 4 Instructions

The provider processes the data only on documented instructions from the customer, including with regard to transfers to third countries, unless required by law to process it otherwise; in that case the provider informs the customer beforehand, unless the law prohibits this. The instructions result from this agreement, the terms of service and the customer’s and their authorized persons’ use of Napyon’s features. The customer gives further instructions in text form. If the provider considers an instruction unlawful, it informs the customer.

§ 5 Obligations of the provider

• The provider processes the data only within this agreement and not for its own purposes. In particular, it does not use the data for advertising or to train AI models.
• Everyone with access to the data is bound to confidentiality.
• The provider takes the technical and organizational measures under Art. 32 GDPR described in Annex 1 and develops them further. The level of protection must not decrease.
• The provider supports the customer with appropriate measures in responding to data subject requests (Arts. 12 to 22 GDPR). The customer can fulfil many rights directly in Napyon, for example by exporting, editing and deleting.
• The provider supports the customer with the obligations under Arts. 32 to 36 GDPR (security, breach notification, data protection impact assessment, prior consultation).
• The provider has not appointed a data protection officer because the legal requirements are not met. The contact person is the managing director, Felix Wimberger, support@napyon.com.

§ 6 Subprocessors

The customer grants general authorization to engage subprocessors. The subprocessors engaged when the contract is concluded are listed in Annex 2 and are deemed approved. The provider contractually binds each subprocessor to data protection obligations equivalent to those in this agreement.

If an authorized person connects Napyon to their own AI assistant (Claude by Anthropic or ChatGPT by OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland), the assistant retrieves content of the workspace chosen when connecting at that person’s instruction, and only the content the assistant is working on at that moment. Anthropic or OpenAI is not a subprocessor of the provider in this case, but a recipient chosen by the customer or the authorized person; their processing is governed by that person’s own contract with Anthropic or OpenAI. The provider does not send content to these recipients on its own. Any connection can be disconnected in Napyon at any time; afterwards no further access is possible.

The provider informs the customer by email at least 30 days before engaging a new or changed subprocessor. The customer may object for an important data protection reason within 14 days. If the parties find no solution, the customer may terminate the contract of use as of the date of the change.

§ 7 Transfers to third countries

Data is only processed outside the EU or EEA if the requirements of Arts. 44 to 49 GDPR are met, in particular on the basis of an adequacy decision (for example the EU-U.S. Data Privacy Framework) or the European Commission’s standard contractual clauses. The customer’s content is stored in data centers in Frankfurt, Germany.

§ 8 Audits

On request, the provider demonstrates compliance with this agreement, in particular through information, the description of measures in Annex 1 and evidence from its subprocessors (for example certifications and audit reports). In addition, the customer may carry out audits itself or through an auditor bound to confidentiality, after timely notice, usually at least 30 days in advance, during normal business hours and without disproportionately disrupting operations. The customer bears the cost of on-site audits unless the audit reveals a significant breach.

§ 9 Notification of breaches

The provider notifies the customer of a personal data breach without undue delay after becoming aware of it, where possible within 48 hours. As far as known, the notification contains the information under Art. 33(3) GDPR. The provider immediately takes measures to remedy the breach and mitigate its consequences.

§ 10 Deletion and return

The customer can export their data anytime (full backup as ZIP as well as Markdown, PDF and images) and delete it. After the contract of use ends, the provider deletes the data unless there is a legal obligation to retain it. If the customer deletes a workspace or their account, the data is deleted immediately; it is no longer contained in the daily backups after seven days at the latest. The provider deletes audio files and recordings of conversations immediately after a successful transcription, and after seven days if processing fails for good; transcripts remain until the customer deletes them.

§ 11 Liability

Liability is governed by Art. 82 GDPR. Otherwise, the liability rules of the terms of service apply.

§ 12 Final provisions

In case of conflict, this agreement takes precedence over the terms of service in matters of data protection. Changes and additions require text form. If a provision is invalid, the remaining provisions remain valid. German law applies; the place of jurisdiction is Landshut, Germany.

Annex 1: Technical and organizational measures

Confidentiality

• Physical access control: Napyon does not run its own servers. The data is stored in data centers of the subprocessors (Amazon Web Services in Frankfurt via Supabase, Vercel server functions in Frankfurt), which are certified under recognized standards and control physical access.
• System access control: Login with email and password (at least ten characters, checked against known data breaches), optionally a second factor via an authenticator app. Sessions are visible and can be ended everywhere. Login and sign-up attempts are rate-limited. Only the provider’s managing director has administrative access to the systems, through personal accounts with the service providers.
• Data access control: Every database table is protected by row level security rules: only members of a workspace see its data, in the role assigned to them (owner, editor, viewer; guests only on shared pages). New tables receive no default permissions. Files are kept in private storage and can only be reached through signed links that expire. Keys with elevated rights are only on the server. Share links, links to client areas and approvals, invitations and access keys are stored only as hashes, link passwords as secure hashes with lockout after failed attempts. Links without login can be revoked anytime, only show the shared content, are blocked for search engines (noindex) and protected against guessing by limits per address; after a justified report, the provider can block such a link.
• Separation control: Data of different workspaces is logically separated by the access rules. Development and testing run in a separate local environment without production data.
• Pseudonymization: @-mentions of people are sent to the AI only as codes; names written in the text itself, in transcripts or in client files are sent to the AI as they are there. A full backup replaces other people’s names and email addresses with random codes.

Integrity

• Transfer control: All connections are TLS-encrypted, including to the database and when sending emails. The database and its backups are encrypted at rest by the service provider (AES-256). Security headers and a Content Security Policy limit what pages may load and where forms may send data.
• Input control: Page version history with author and time, content marked with its creator and content from Napyon AI marked as such, logs of AI requests (without content) and of payment events.

Availability and resilience

• Daily database backups by the service provider, kept for seven days.
• Trash and version history protect against accidental deletion.
• Limits on requests and amounts per workspace and protection against requests to internal addresses (link previews) keep the system resilient.
• Operation with established service providers on redundant infrastructure.

Regular review

• Security reviews of code and settings (most recently in October 2026) with documented fixes.
• Automated tests before every change, including a test for every table that users cannot see other people’s data.
• Regular checks of the libraries used for known vulnerabilities.
• Content Security Policy reports are collected and evaluated.
• Privacy-friendly defaults: the daily digest and email notifications are off until a person turns them on; AI only on explicit request.

Annex 2: Subprocessors

The provider sends a copy of the standard contractual clauses on request. Payment processing via Stripe only concerns the contractual relationship between customer and provider and is not covered by this agreement. Anthropic (for the customer’s own Claude) and OpenAI (for the customer’s own ChatGPT) are not subprocessors for connections that an authorized person sets up themselves (§ 6).