Data processing agreement

1. Definitions

In this DPA:

• Customer means the legal entity or organization that contracts or uses the Laiki platform.
• Laiki means Laiki Ltda., the provider of the platform.
• Customer Personal Data means personal data processed by Laiki on behalf of the Customer through the services.
• Controller means the party that decides the purposes and means of processing personal data.
• Operator or processor means the party that processes personal data on behalf of the controller.
• Subprocessor means a third party engaged by Laiki to assist in providing the services and that may process Customer Personal Data.
• Data Protection Laws means the LGPD (Law No. 13.709/2018) and other applicable privacy rules.
• Security Incident means unauthorized access to, loss of, alteration of, disclosure of or destruction of Customer Personal Data under Laiki's responsibility.

2. Scope and applicability

This DPA applies when Laiki processes Customer Personal Data in providing the platform, including lead management, dashboards, marketing integrations, customer-authorized credentials, webhooks and workflows.

In the event of a conflict between this DPA and other contractual terms, this DPA prevails only on matters directly related to the processing of Customer Personal Data.

3. Roles of the parties

The Customer normally acts as controller of lead data, contacts, marketing data, data entered into workflows, configured integrations and third-party destinations chosen by the Customer.

Laiki acts as operator/processor of that data, processing it according to the Customer's instructions in order to provide, protect, maintain, support and improve the contracted services.

Laiki acts as an independent controller for its own operational data, such as platform user accounts, authentication, billing contacts and internal records for support, security and service administration.

4. Processing details

Subject matter

The processing involves providing a marketing analytics platform covering lead management, segmentation, dashboards, integrations and B2B workflow automation.

Duration

Processing takes place for the duration of the Customer's account, subscription or configuration. Workflow execution logs are retained for up to 14 days. Widget caches may be retained for up to 4 hours. Pending invitations expire after 7 days. Where applicable, deleting an organization triggers permanent removal after an operational period of 48 hours, subject to legal or backup retention.

Nature and purpose

• store, segment and analyze leads and contacts;
• synchronize aggregated marketing and advertising metrics;
• generate dashboards, reports, widgets and visualizations;
• run webhooks, workflows, HTTP nodes and transformations;
• store credentials for integrations authorized by the Customer;
• provide support, security, auditing and incident response.

Categories of personal data

• platform users: name, email, role and organization membership;
• leads and contacts: name, email, phone and custom fields;
• marketing data: campaign metrics and aggregated data;
• integrations: connected accounts/properties and OAuth/API credentials;
• workflows: payloads, node outputs, metadata and logs configured by the Customer;
• billing: name, email, CPF/CNPJ where applicable and financial metadata.

Categories of data subjects

• the Customer's users and team members;
• the Customer's leads, contacts and end consumers;
• the Customer's commercial and operational contacts;
• billing contacts and authorized representatives.

5. Customer obligations

The Customer must:

• maintain a valid legal basis for processing its personal data;
• provide adequate privacy notices to data subjects;
• configure integrations, webhooks and workflows lawfully and proportionately;
• avoid sending unnecessary or sensitive personal data without an adequate legal basis and contract;
• vet third parties and HTTP destinations chosen in customer-configured workflows;
• treat webhook URLs, credentials and secrets as restricted information;
• keep the organization's users, permissions and administrators up to date;
• respond to data subject requests when acting as controller.

6. Laiki obligations

Laiki must:

• process Customer Personal Data according to the Customer's documented instructions;
• maintain confidentiality over Customer Personal Data;
• limit access to authorized people with an operational need;
• maintain reasonable technical and organizational security measures;
• reasonably assist the Customer with data subject requests, deletion, security and compliance;
• use subprocessors under obligations compatible with this DPA;
• notify the Customer if it identifies an instruction that is manifestly incompatible with the Data Protection Laws.

7. Security measures

Laiki maintains technical and organizational measures proportionate to the risk of the processing, including:

• TLS/HTTPS for data in transit;
• encryption at rest provided by the Supabase/AWS infrastructure;
• multi-tenant logical isolation through Row Level Security;
• access control by organization, role and user authentication;
• passwordless authentication via OTP sent by email;
• AES-256-GCM encryption at the application layer for OAuth/API credentials;
• secret management through vaults and managed providers, with restricted access;
• an internal policy against persisting local files containing secrets;
• structured logs, redaction of secrets and payload limits;
• independent backups and an incident response process.

8. Subprocessors

The Customer authorizes Laiki to use the subprocessors necessary to provide, secure, support and operate the services. The table below summarizes current or applicable subprocessors depending on the Customer's configuration.

Laiki may update subprocessors as the service evolves, provided it maintains obligations compatible with this DPA and reasonable protection measures. Before adding a new subprocessor that processes Customer Personal Data, Laiki will seek to notify the Customer at least 15 days in advance, by email or by notice on the platform. The Customer may object on reasoned data protection grounds; if no reasonable solution is found, the Customer may terminate the materially affected part of the service without penalty. Optional integrations apply only when configured or authorized by the Customer.

9. Customer-configured integrations and workflows

The Customer may configure webhooks, workflows, HTTP nodes, code nodes, schedules and provider credentials. The Customer controls which data enters the workflow, which transformations run and which third parties receive data.

Arbitrary HTTP destinations chosen by the Customer are not Laiki subprocessors, except where the destination is a provider expressly supported by Laiki. The Customer is responsible for the legal basis, the choice of recipient, the security of the destination and any contractual or legal obligations applicable to those third parties.

Laiki applies platform controls, including HTTPS for external production flows, encrypted credential storage, redaction of secrets, per-organization isolation and limited retention of execution logs for up to 14 days.

Public webhook URLs may carry a high-entropy secret in the query string for compatibility with providers that do not accept custom headers. The Customer must treat these URLs as secrets and rotate them if exposure is suspected.

Where available to the organization, the Customer may also authorize programmatic access to its data through the API or through an MCP (Model Context Protocol) server, allowing external tools chosen by the Customer, including artificial intelligence assistants, to query Customer Personal Data. Those tools and their model providers are not Laiki subprocessors; the processing they carry out is the Customer's responsibility and is governed by the terms of the chosen supplier, including as to retention, location and use of data for training. Laiki provides the data according to the authorization and permissions granted by the Customer and maintains authentication controls, per-organization scoping and access revocation.

10. Data subject rights

Data subject requests may be sent to dpo@laiki.co. Laiki seeks to respond to verified requests within 15 days, as applicable under the LGPD.

Where Laiki acts as controller, the request will be reviewed and answered directly by Laiki. Where the request involves lead, contact, workflow or integration data for which the Customer is controller, Laiki may forward the request to the Customer or provide reasonable technical assistance to locate, export, correct, restrict or delete the data as instructed by the Customer.

11. Security incident notification

Laiki maintains an incident response process to identify, contain, assess, remediate and document security incidents.

Where a Security Incident affects Customer Personal Data, Laiki will notify the Customer without undue delay, and within 48 hours of confirming a material impact, taking into account the nature of the incident, the data affected, the measures taken and the applicable legal obligations.

Where the LGPD or another law requires notification to the ANPD or to data subjects, Laiki will provide reasonable assistance to the Customer and will make those communications that are its own legal responsibility.

12. International transfers

The platform's primary database is kept on Supabase/AWS infrastructure in São Paulo, Brazil, where so configured. Some subprocessors and providers used by the platform may process data on international infrastructure, including hosting, email, edge, integrations and support services.

Workflows and integrations configured by the Customer may give rise to international transfers to destinations chosen by the Customer itself. In those cases the Customer is responsible for assessing the legal basis, the adequacy of the destination and the applicable contractual mechanisms.

Laiki adopts reasonable contractual mechanisms and safeguards with providers where available and applicable to the processing.

13. Audits and compliance

The Customer may request reasonable information about security, privacy and compliance relating to the processing of Customer Personal Data. Laiki may provide public documentation, questionnaire responses, control summaries or evidence proportionate to the risk and confidentiality involved.

Any audit must be agreed in advance, take place during business hours, not materially interfere with the operation of the services and not expose data, secrets, infrastructure or information belonging to other customers.

14. Retention, deletion and return of data

The Customer may delete data using the features available on the platform or request reasonable assistance from Laiki. When the account or organization is terminated, Laiki will delete or return Customer Personal Data in accordance with the contract, applicable instructions and legal obligations.

• workflow execution logs are retained for up to 14 days;
• widget caches may be retained for up to 4 hours;
• pending invitations expire after 7 days;
• financial records may be retained for the period required by law;
• deleted data may remain in backups until the backup cycle expires.
• product analytics events in PostHog may be retained for up to 7 years, depending on the applicable plan and configuration;
• PostHog session recordings are retained for up to 30 days;
• verified account deletions initiate removal of the PostHog profile and its associated events and recordings, with asynchronous processing of the events by the provider.

Backups are not used for ordinary processing and exist for recovery, business continuity, security and incident investigation.

15. Term and termination

This DPA remains in force for as long as Laiki processes Customer Personal Data. Obligations of confidentiality, security, legal retention and reasonable cooperation survive termination to the extent necessary to comply with the law, preserve rights and complete the deletion or return of the data.

16. Contact

For requests relating to privacy, data protection, performance of this DPA, subprocessors or data subject rights, contact Laiki's Data Protection Officer at dpo@laiki.co.