Data Processing Addendum (hosted)

This Data Processing Addendum (“DPA”) applies when Astro Arpanet LLC, or an affiliate operating the Service (“Processor”), processes personal data on behalf of a business customer (“Customer”) under a hosted relay or managed portal agreement. It supplements the Terms of Service and Privacy Policy. Self-hosted deployments where Customer alone operates the relay are outside this DPA unless signed separately.

Liability. Processor’s liability under this DPA is subject to the disclaimers, caps, indemnities, and dispute resolution in the Terms. This DPA does not expand Processor liability beyond the Terms.

1. Roles

• Customer is the controller of account data, device metadata, and mesh payloads Customer users originate.
• Processor processes such data only to provide the hosted Service, billing, security, and support described in the agreement.

2. Processing details

• Subject matter: cross-device mesh relay, account portal, and optional subscription billing.
• Duration: term of the customer agreement plus deletion/return periods in the Privacy Policy.
• Categories: account identifiers, device names and kinds, session token hashes, billing metadata, sync queue payloads (encrypted when Customer enables E2E), support messages.
• Data subjects: Customer personnel and end users Customer authorizes on the mesh.

3. Processor obligations

• Process only on documented Customer instructions compatible with the Terms.
• Ensure confidentiality of personnel with access to production systems.
• Implement measures appropriate to risk (see Privacy Policy; no absolute security warranty).
• Assist with data subject requests where feasible via in-product export/delete or contact workflow.
• Delete or return personal data after service end, subject to legal retention and encrypted backups.
• Notify Customer of confirmed personal-data breaches without undue delay where law requires.

4. Subprocessors

Processor may use subprocessors to operate the Service. Current categories include cloud hosting (for example Vercel), managed database (for example Neon), payment processing (Stripe), transactional email (for example Brevo), rate-limit/session infrastructure (for example Upstash), and edge/tunnel providers (for example Cloudflare). Processor remains responsible for subprocessors under agreement consistent with this DPA.

A detailed subprocessor list is maintained in the Privacy Policy and may be updated on request via the contact form.

5. International transfers & audits

Transfers, Standard Contractual Clauses, and audit rights must be completed by counsel for the Customer’s jurisdiction. This template does not itself authorize cross-border transfers.

6. Contact

DPA and privacy requests: contact form. See also Privacy Policy. Hosted operators may request a signed DPA and subprocessor appendix via the contact form.