Data Processing Agreement

Last updated: October 16, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service or other agreement (the "Agreement") between WebCatalog, Inc. ("WebCatalog", "we", "us") and the customer that has agreed to it ("Customer", "you"). It applies whenever we process Customer Personal Data on your behalf, for example in an organization or workspace, and takes effect automatically when you accept the Agreement. If you need a signed copy, email contact@webcatalog.io.

1. Definitions

Customer Personal Data: personal data that we process on your behalf as part of providing the Services, including the account details of your members and the content they submit.
Data Protection Laws: all laws on the processing of personal data that apply to that processing, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), and the California Consumer Privacy Act ("CCPA").
Subprocessor: a third party we engage to process Customer Personal Data.
Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
SCCs: the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
UK Addendum: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.

Terms such as "controller", "processor", "personal data", and "processing" have the meanings given in the GDPR. "Services" has the meaning given in the Agreement.

2. Roles and scope

For Customer Personal Data, you are the controller (or a processor acting for your own controller), and we are your processor (or subprocessor). Annex 1 describes the processing.

We act as an independent controller, under our Privacy Policy, for data we process for our own purposes: managing customer accounts and billing, securing the Services, understanding how the Services are used, and meeting our legal obligations.

3. Your instructions

We process Customer Personal Data only on your documented instructions, unless the law requires otherwise; in that case we'll tell you first, unless the law prohibits it. Your instructions are the Agreement, this DPA, and your use and configuration of the Services. We'll tell you if we believe an instruction infringes Data Protection Laws.

You are responsible for having a lawful basis for the Customer Personal Data you submit and for your instructions.

Where the CCPA applies, we act as your service provider: we won't sell or share Customer Personal Data, retain, use, or disclose it outside our direct business relationship with you or for any purpose other than providing the Services, or combine it with personal data we receive from others, except as the CCPA permits.

4. Confidentiality

We ensure that everyone we authorize to process Customer Personal Data is bound by confidentiality obligations.

5. Security

We implement the technical and organizational measures in Annex 2 to protect Customer Personal Data, appropriate to the risk of the processing. We may update them as the Services change, but we won't reduce the overall level of protection.

6. Subprocessors

You give us general authorization to engage Subprocessors. Our current Subprocessors are listed on our Subprocessors page.

Before a new Subprocessor starts processing Customer Personal Data, we'll update that page. If you'd like to be told by email when it changes, ask us at contact@webcatalog.io. You may object to a new Subprocessor on reasonable data protection grounds within 5 days of the update. We'll then work with you in good faith to resolve the objection; if we can't, you may terminate the affected Services, and we'll refund any prepaid fees for the remainder of the term.

We bind each Subprocessor to data protection obligations at least as protective as this DPA, and we remain responsible for its performance.

7. AI processing

Some features send Customer Personal Data to AI model providers to produce a result, for example to translate or transcribe content. The providers are listed on our Subprocessors page.

We don't use Customer Personal Data to train AI models, and we only use AI providers that don't train on it or collect it for their own purposes.
Where Customer's plan includes zero data retention, we use it wherever our AI providers support it, so those providers don't keep the data after answering. Otherwise, AI providers may keep requests for a limited time under their own terms, for example to detect abuse.

8. Requests from individuals

Taking into account the nature of the processing, we'll help you respond to requests from individuals to exercise their rights under Data Protection Laws, mainly through the features of the Services. If we receive such a request about Customer Personal Data, we'll forward it to you and won't respond ourselves, except to tell the individual to contact you.

9. Security Incidents

We'll notify you without undue delay, and within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data. We'll tell you what we know about its nature, the data and individuals affected, its likely consequences, and the measures taken, and update you as we learn more. We'll take reasonable steps to contain it and help you meet your own notification obligations.

10. Impact assessments

Taking into account the nature of the processing and the information available to us, we'll give you reasonable help with data protection impact assessments and prior consultations with supervisory authorities about the Services.

11. Deletion

You can delete Customer Personal Data in the Services at any time. Data in an organization or workspace is kept until you delete it, including after a subscription ends. After the Agreement ends, if you ask us in writing, we'll delete the remaining Customer Personal Data within 30 days, except where the law requires us to keep it. Backups are overwritten on a rolling schedule.

12. Audits

We'll make available the information reasonably necessary to demonstrate compliance with this DPA, including written answers to security questionnaires, up to once a year.

If that's not enough to meet a requirement of Data Protection Laws or a supervisory authority, you may audit our compliance yourself or through an independent auditor bound by confidentiality, at your expense, with at least 30 days' notice, during business hours, without disrupting our operations, and no more than once a year unless a Security Incident or a supervisory authority requires otherwise.

13. International transfers

We store Customer Personal Data in the United States, and our Subprocessors may process it in the countries listed on our Subprocessors page.

EEA. For transfers of Customer Personal Data from the European Economic Area to a country without an adequacy decision, the SCCs are incorporated into this DPA by reference, with you as data exporter and us as data importer:

Module 2 applies where you are a controller, and Module 3 where you are a processor.
Clause 7 (docking clause) does not apply.
Clause 9(a): Option 2 (general written authorization) applies, with the notice and objection process in section 6.
Clause 11(a): the optional language does not apply.
Clause 13: the competent supervisory authority is determined under that Clause. Where you have no establishment in the EU and have appointed a representative, it is the authority of the member state where your representative is established; otherwise, the Irish Data Protection Commission.
Clauses 17 and 18: the SCCs are governed by Irish law, and disputes are resolved by the courts of Ireland.
Annexes I, II, and III of the SCCs are completed by Annexes 1, 2, and 3 of this DPA.

United Kingdom. For transfers from the United Kingdom, the UK Addendum applies, completed with the information in this DPA and its Annexes. Either party may end the UK Addendum as set out in its Section 19.

Switzerland. For transfers from Switzerland, the SCCs apply with these changes: references to the GDPR include the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for those transfers; and "member state" includes Switzerland, so that individuals there can bring claims in their place of habitual residence.

If the European Commission adopts new standard contractual clauses for transfers to importers already subject to the GDPR, we may adopt them by updating this DPA.

14. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Agreement, except where the SCCs or Data Protection Laws don't permit them. If there is a conflict, the SCCs and UK Addendum prevail over this DPA, and this DPA prevails over the Agreement.

This DPA lasts as long as we process Customer Personal Data. We may update it to reflect changes in law or the Services; we won't reduce the protection it gives you without your agreement.

Annex 1: Description of the processing

Data exporter: Customer, as identified in its account. Contact: the account's admins.

Data importer: WebCatalog, Inc., 1111B S Governors Ave #92887, Dover, DE 19904, United States, contact@webcatalog.io. EU representative: Euverify Limited, Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland. UK representative: Euverify Ltd, 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom.

Categories of individuals: Customer's members and invited users, and individuals whose personal data appears in content Customer's members submit.

Categories of personal data:

Member account data: name, email address, profile picture, role, and single sign-on identifiers.
Organization and workspace activity.
Content members create or submit, such as items, links, and settings, and the text, files, audio, or images they ask the Services to process.
Technical data: IP address, device and browser details, and how the Services are used.

Special categories of data: none are intended. If content submitted by Customer includes them, they're processed with the measures in Annex 2.

Frequency: continuous, for as long as Customer uses the Services.

Nature and purpose: hosting, storing, synchronizing, and displaying data; processing content with AI models at members' request; and support, all to provide the Services under the Agreement.

Duration and retention: for the term of the Agreement, as described in section 11. Files uploaded only to be processed, and their results, are deleted within 24 hours.

Subprocessors: see Annex 3.

Annex 2: Technical and organizational measures

Encryption: data is encrypted in transit with TLS. Our hosting and storage providers encrypt data at rest. Credentials for connected accounts are additionally encrypted by us.
Access control: access to production systems and Customer Personal Data is limited to authorized personnel who need it for their role, and removed when it's no longer needed. The Services check every request against the user's own data and their organization or workspace membership.
Infrastructure: we run the Services on established cloud providers, listed on our Subprocessors page, and protect our sites with Cloudflare against attacks and abuse.
Availability and backups: our database provider takes regular automated backups.
Monitoring: we monitor the Services for errors and outages.
Data minimization: files uploaded only to be processed are deleted within 24 hours, some apps keep history only on the user's device, and AI requests go only to providers that don't train on them.
Personnel: everyone with access to Customer Personal Data is bound by confidentiality obligations.
Vendors: we engage Subprocessors under written terms with appropriate data protection obligations.
Security Incidents: we follow the process in section 9.

Annex 3: Subprocessors

The Subprocessors you authorize are those listed on our Subprocessors page, as updated under section 6.