Data Processing Agreement
This DPA forms part of the Pexli Terms of Service between the customer ("Controller") and Pexli ("Processor"). It applies when Pexli processes personal data on the Controller's behalf through Pexli Cloud.
1. Scope
| Subject matter | Hosting, sharing, searching and exporting workflow guides |
|---|---|
| Duration | The Controller's use of Pexli Cloud, plus the deletion period in section 9 |
| Nature and purpose | Storage, retrieval, display, indexing, video processing and transmission to integrations the Controller enables |
| Personal data | Names and emails of workspace members. Any personal data that remains in guides after on-device redaction (step text, screenshots, video, captions) |
| Data subjects | The Controller's staff and users, and people who appear in captured content |
| Special categories | Not intended. The Controller must not upload them |
2. Processor duties
The Processor will:
- process personal data only on the Controller's documented instructions. These terms, the workspace settings and the Controller's use of the Service are those instructions;
- make sure everyone who handles the data is bound by confidentiality;
- keep the security measures in Annex 2 in place;
- help the Controller answer data subject requests, and meet its obligations under GDPR Articles 32 to 36, PIPEDA, and Quebec's Act respecting the protection of personal information in the private sector, taking into account what the Processor can know;
- tell the Controller without undue delay, and within 48 hours, after becoming aware of a personal data breach (including a confidentiality incident under Quebec law) affecting the Controller's data;
- make available the information needed to show compliance, and allow audits as set out in section 7;
- tell the Controller if it believes an instruction breaks data protection law.
3. Controller duties
The Controller has a lawful basis for the processing. It sets a workspace minimum blur level that suits its data, reviews guides before sharing, and does not upload special category data. The Controller is responsible for having the right to capture people who appear in its guides.
4. Subprocessors
The Controller authorizes the subprocessors in Annex 1. The Processor will give at least 30 days' notice of any new subprocessor by email to workspace admins. The Controller may object on reasonable data protection grounds. If the parties can't resolve the objection, the Controller may stop using the affected service and delete its data. The Processor binds each subprocessor to data protection terms at least as protective as this DPA, and stays responsible for it.
5. International transfers
When personal data leaves the EEA, the UK or Switzerland for a country without an adequacy decision, the parties rely on the EU Standard Contractual Clauses (Module 2, controller to processor), with the UK Addendum where needed. Those clauses are incorporated by reference. Subprocessor transfers use the subprocessor's own SCCs. The Processor will give the Controller the information it needs to assess transfers outside Quebec or Canada, including where data is processed and the safeguards in place.
6. Data subject requests
The Processor will forward any request it receives about the Controller's data and won't answer it except on the Controller's instructions. Admins can delete guides, remove members and delete the workspace in the app. For an export or anything else, email privacy@pexli.io.
7. Audits
The Processor will answer a reasonable security questionnaire once a year and provide its subprocessors' available certifications, for example Cloudflare's SOC 2 and ISO 27001 reports. An on-site audit needs 30 days' notice, happens during business hours, and is at the Controller's cost, unless it follows a breach caused by the Processor.
8. Liability
Each party's liability under this DPA is subject to the limits in the Terms of Service, except where the law does not allow it.
9. Return and deletion
When the Controller stops using Pexli Cloud, the Controller can export its guides for 30 days. After that the Processor deletes the Controller's data within 30 days, and backups age out within 30 days after that, unless the law requires the Processor to keep it.
10. Language
This DPA is available in French and English. The French Terms link the French version. A Controller based in Quebec is bound by the French version unless it expressly chooses to be bound by this English version.
Annex 1: Subprocessors
| Subprocessor | Service | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, storage, video, search, AI inference, transactional email | Global network, US entity |
Annex 2: Security measures
- Data minimization at the source: redaction runs on the device before upload. Screenshots are flattened with blur burned in, typed values are scrubbed, and password values are never read.
- Workspace minimum blur level: checked on every upload, share and integration send.
- Encryption: TLS in transit. Data at rest is encrypted by Cloudflare's storage services. Integration tokens are sealed with AES-GCM under a per-environment key.
- Access control: roles per workspace (viewer, creator, admin), and every workspace keeps at least one admin. Agent (MCP) tokens are scoped to one workspace and can be revoked by the user.
- Credentials: passwords are hashed with PBKDF2. Session, invite and email tokens are stored only as SHA-256 hashes, and email tokens are single use and expire. Login, signup, reset and invite are rate limited.
- Isolation: every query is scoped to the workspace, and search queries filter on the workspace.
- Logging: invocation logs are off. Search queries and AI prompts aren't logged or cached.
- Releases: an automated redaction leak check must pass before a desktop release is built.
- Incident response: security@pexli.io is monitored, and breaches are notified as in section 2.5.