Roles and scope
Plain language
You are the controller of your brand's data. We are the processor — we process your data only on your documented instructions to provide the service described in the Terms.
Read the legal-grade detail
For the purposes of GDPR (and equivalent regimes), the customer (you) is the controller and Optima IA (operating Creativity) is the processor. The DPA applies whenever we process personal data on your behalf — for example, end-customer email hashes stored in `ecom_events` or review texts that include personal information.
Authorized sub-processors
Plain language
We use a small, EU-leaning set of sub-processors: Supabase (DB+Storage), Vercel (web), Render (agents), Anthropic + Google AI Studio + OpenAI (AI), LangSmith (observability), Konnect (billing), Resend (email). Full list with purpose and region in the Privacy Policy.
Read the legal-grade detail
We give 30 days' notice before adding or replacing a sub-processor. The current list lives in the Privacy Policy under “Sub-processors”. Notifications go to the billing email on file.
Security measures
Plain language
Row-Level Security on every table that stores brand data. Fernet-encrypted connector tokens. Hashed passwords (bcrypt). TLS 1.2+ in transit. EU-region storage. Quarterly access reviews. No production access from outside Tunisia or the EU.
Read the legal-grade detail
At rest: Supabase-managed encryption. Connector OAuth tokens are Fernet-encrypted before write.
In transit: TLS 1.2+ enforced across Vercel, Render, Supabase, and all third-party API calls.
Access control: Postgres RLS scoped by `brand_id`. Operator console gated by allowlist (`OPERATOR_EMAILS`) at the middleware + server-action + API layer.
Logging: auth events, billing events, and operator-route accesses logged with a 90-day retention.
Data-subject requests
Plain language
If one of your end-customers asks you for access, deletion, or portability of their data, we'll help you fulfill the request within 30 days. Email aziz@optimaia.pro with the request and the brand it relates to.
Read the legal-grade detail
As your processor, we don't respond directly to your end-customers. You initiate the request; we provide the tooling and, where needed, manual extraction. Typical SLA: 7 days for access exports, 30 days for full erasure (matches the soft-delete-then-purge schedule).
International transfers
Plain language
All primary data stays in the EU. AI calls that route through US-headquartered providers (Anthropic, OpenAI) rely on Standard Contractual Clauses. Where the provider offers EU inference regions (Anthropic `inference_geo=eu`, Google AI Studio EU billing), we use them by default.
Read the legal-grade detail
Transfers to third-country sub-processors are governed by the EU Standard Contractual Clauses (Module 3: processor-to-processor). For Anthropic Claude calls we set inference_geo=eu on supported models. For Google Gemini we use the AI Studio EU billing region. For OpenAI image generation we use the EU-aware endpoints where available.
Return and deletion on termination
Plain language
On termination, you have 60 days to export your data. After that we soft-delete and purge per the Privacy Policy retention schedule. We'll provide a written deletion certificate on request.
Read the legal-grade detail
Within 60 days of termination, you may request a final JSON export. After the export window, we soft-delete brand rows and purge them 30 days later. Backups containing deleted data roll out of the 35-day PITR window automatically. A written deletion certificate is available on request to aziz@optimaia.pro.
Procurement
Need a signed copy?
Email aziz@optimaia.pro with your company name and we'll send the latest signed DPA. Pair it with the sub-processor list in the on-page summary above for your vendor review.
Questions? Reach us at aziz@optimaia.pro.