Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between you (the “Customer”) and Omega Nodes Company Ltd (“Omeganodes”). You accept it when you accept the Terms. It applies whenever the apps, databases, files or logs you run on the Service contain personal data (“Customer Personal Data”).

For Customer Personal Data you are the controller (or a processor acting for your own client) and Omeganodes is your processor (or sub-processor). It meets article 28 of the EU General Data Protection Regulation (“GDPR”) and the Uganda Data Protection and Privacy Act, 2019. Your account and billing data are not covered here: for those Omeganodes is a controller, as the Privacy Policy explains.

• Subject matter and purpose: hosting, running, storing, backing up and transmitting your workloads, only to provide the Service.
• Duration: for as long as you use the Service, then until deletion under section 9.
• Nature: storage, computation, network transfer, backup and restore, and operational access by our staff when needed to keep the Service running or when you ask for support.
• Types of personal data: whatever you choose to deploy, typically contact details, account data and usage data of your own users. Do not host special categories of data (art. 9 GDPR) unless you have your own lawful basis and safeguards for them.
• Data subjects: your end users, customers, employees and other people whose data you host.

We process Customer Personal Data only on your documented instructions. These are the Terms, this DPA and the actions you take in the dashboard, CLI or API. We do not process it for our own purposes, sell it or use it to train models. If a law requires other processing, we tell you first unless that law forbids it. If we believe an instruction breaks data-protection law, we tell you.

Only staff who need access to operate the Service can reach Customer Personal Data. They are bound by confidentiality obligations. Staff access to the admin panel requires two-factor authentication and is recorded in an audit log.

We maintain at least these technical and organisational measures:

• Hosting on dedicated servers in Falkenstein, Germany (EU).
• TLS for all traffic to the dashboard, the API and your apps’ default domains.
• Secrets we store for you (environment variables, deploy keys, OAuth tokens, 2FA secrets) encrypted at rest with AES-256-GCM.
• Each app and database runs in its own container with CPU, memory and process limits. Managed databases are created without a public port: only containers on the private network of their server can reach them.
• Platform database backed up daily to encrypted off-site storage in the EU (restic). Restore is tested every week.
• Your apps’ files (Docker volumes) backed up daily to the same encrypted off-site storage, kept up to 3 months.
• Passwords stored only as Argon2id hashes. Two-factor authentication is available to every user and required for staff.
• Rate limiting, bot protection and an audit log of security-relevant actions.
• A written incident-response procedure covering personal-data breaches.

You are responsible for security inside your own apps: your code, dependencies, access control, and backups of your databases (available from the Databases page).

You give us general authorisation to use the sub-processors below. Each one is bound by written terms that protect personal data at least as well as this DPA:

• Hetzner Online GmbH (Germany and Finland (EU)) — Dedicated servers that host the platform, customer apps, databases and backups.
• Resend, Inc. (United States) — Delivery of transactional email (account, billing and deploy notices).
• Stripe (Ireland / United States) — Card payments, when you pay by card.
• PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) — PayPal payments, when you pay with PayPal.
• Cloudflare, Inc. (United States) — Bot protection (Turnstile) on sign-up and sign-in, when enabled.
• GitHub, GitLab, Google (United States) — Sign-in and repository access, only if you sign in with them or connect a repository.
• OpenRouter, Inc. (United States) — Routing Omega AI requests (your prompts, product data and images) to AI model providers that do not train on them, only when you use Omega AI.
• Telegram (United Arab Emirates) — Internal operational alerts to our staff, limited to account and project identifiers.

We announce any new or replaced sub-processor at least 30 days in advance, by email and on this page. You can object on reasonable data-protection grounds within that period. If we cannot reasonably meet the objection, you may terminate the affected Service without penalty. We remain liable for our sub-processors.

Customer Personal Data is stored in the European Union. Omeganodes is established in Uganda, which has no EU adequacy decision, and our staff may access the data from there to operate the Service. Some sub-processors are in other countries.

For transfers subject to the GDPR, the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 are incorporated by reference: Module 2 when you are a controller, Module 3 when you are a processor. The following choices apply:

• clause 7 is not used;
• clause 9(a), option 2, with 30 days’ notice;
• the optional wording of clause 11 is not used;
• clauses 17 and 18 choose the law and the courts of Italy;
• Annexes I to III are sections 2, 5 and 6 of this DPA.

Where a sub-processor relies on another lawful mechanism, such as the EU-US Data Privacy Framework, that mechanism applies.

• Data subject requests. You can read, export, correct and delete the data in your apps and databases yourself. If a request reaches us, we forward it to you and do not answer it ourselves.
• Personal-data breaches. We notify you without undue delay, and in any case within 48 hours of becoming aware of a breach affecting Customer Personal Data. We tell you what we know, then update you as we learn more, so you can meet your own deadlines (72 hours under the GDPR).
• Impact assessments. We give you the information you reasonably need for a data protection impact assessment or a prior consultation with a supervisory authority.
• Audits. We give you the information needed to show compliance with this DPA. You may audit once a year on 30 days’ written notice, at your own cost, during business hours, through an independent auditor bound by confidentiality, without access to other customers’ data. A supervisory authority may audit at any time as the law allows.

You can export your data at any time. When you delete a project, database or your account, we delete the related Customer Personal Data from the running platform within 30 days. Copies in encrypted platform backups expire within 6 months. We keep nothing longer unless the law requires it.

If this DPA conflicts with the Terms on personal data, this DPA prevails. If it conflicts with the Standard Contractual Clauses, the Clauses prevail. Write to info@omeganodes.ai for questions, or to request a countersigned copy.