Ryan Jarvis trading as DPPLogic · Nanny Cay, Tortola, British Virgin Islands · support@dpplogic.com
Versions: tos-2026-09-17-v1 · privacy-2026-09-22-v2 · dpa-2026-09-17-v1. Not a BVI company, not VAT registered, no company number, no licensing claim.
Processor / service-provider: Ryan Jarvis trading as DPPLogic. Business correspondence address: Nanny Cay, Tortola, British Virgin Islands. Notices: support@dpplogic.com. Fly, Stripe, Resend and Google Workspace data-processing terms are in force for this production environment. Production Evidence AI is OFF.
Subject matter: hosting and processing of personal data contained in the customer’s DPPLogic workspace, supplier-collection portal and related support of those features.
Duration: the subscription and any post-termination retention that actually exists. Cancellation does not automatically delete organisation data.
Nature and purpose: storage, retrieval, display, export, audit-event recording, document storage, local OCR when available, and customer-controlled publication of intended public fields. Production Evidence AI is OFF.
DPPLogic processes this processor data only on documented instructions from the customer, including product controls (invite, revoke, publish, delete document, export) and written instructions to support@dpplogic.com, unless applicable law requires otherwise.
Persons authorised to process the data are under a confidentiality obligation. Security measures implemented: tenant isolation, RBAC, private document storage, hashed tokens, signed webhook validation, and audit events. No ISO 27001, SOC 2 or PCI certification is claimed.
Production subprocessors include Fly.io for hosting. Resend processes authentication email when enabled; automatic supplier email is OFF. Stripe processes DPPLogic billing data, not general workspace content. OpenAI is not a subprocessor.
Material new subprocessor changes: DPPLogic will update the public register and this page, and email the organisation owner address where available, at least 30 days before the change is used for production customer data where reasonably practicable.
The customer may raise a reasonable data-protection objection to support@dpplogic.com before the effective date. If the objection cannot reasonably be resolved, the customer’s remedy is cancellation of the affected service at period end under the Terms. Individual veto or individual approval of every provider is not offered.
Where a restricted transfer is needed, DPPLogic will rely on the transfer mechanism in the relevant provider’s then-current DPA if that contract is in force. This notice does not attach or invent SCC or IDTA schedules.
The customer may export workspace data while the account can sign in. After cancellation, organisation data is not automatically deleted. Organisation deletion is a manual support process. Document deletion removes the stored original and associated metadata according to the implemented product action. Copies in backups may persist until backup rotation. No automatic purge job is implemented.
The customer may request information reasonably necessary to demonstrate these processor obligations, limited to existing documentation and written answers. On-site or third-party audits are not an implemented operational capability.