Data Processing Agreement (DPA)

Last updated: 12 July 2026

These documents are pending legal review. The entity details marked in brackets must be completed before commercial launch.

This agreement applies when we process personal data ON YOUR BEHALF: the data of your tenants and the parties to your contracts. There you are the CONTROLLER and RobyContracts (AskRoby — [LEGAL NAME], tax ID [RUC]) is the PROCESSOR. It forms part of the Terms of Service and is governed by Ecuador’s Organic Law on Personal Data Protection.

1. Subject matter and duration

We process the personal data contained in your contracts for the sole purpose of providing you the RobyContracts service, while your account is active and for the retention period described in the Privacy Policy.

2. What data, and whose

  • Categories of data subjects: tenants, landlords, guarantors, legal representatives and other parties appearing in your contracts.
  • Categories of data: name, cédula / RUC / passport, address, phone, email, line of business, and the economic terms of the lease (rent, deposit, term).
  • We neither ask for nor want special categories of data (health, biometrics, beliefs). Do not upload contracts containing them.

3. Our obligations as processor

  • Process the data only on your documented instructions, which are these terms and your use of the product.
  • Not use the data for our own purposes. In particular: we do not train AI models on it and we do not sell it.
  • Maintain confidentiality and require it of anyone with access.
  • Apply appropriate technical and organisational measures: encryption in transit and at rest, per-company isolation via Row Level Security, access control and audit logging.
  • Help you answer data subject requests (access, rectification, deletion) and meet your own security and notification obligations.
  • Notify you without undue delay if we become aware of a breach affecting this data, with the information you need to notify the authority.
  • On termination, return or delete the data as you choose, unless we must retain it by legal obligation.

4. Your obligations as controller

  • Have a valid legal basis to process the data of the parties to your contracts, and inform them as the LOPDP requires.
  • Upload only the data the contract needs.
  • Not use the service in a way that would force us to breach the LOPDP.

5. Sub-processors

You authorise us to rely on the following sub-processors. We will tell you before adding or changing one, and you may object on reasonable grounds.

  • Supabase — database and document storage (United States).
  • Vercel — application hosting (United States).
  • Resend — transactional email delivery (United States).
  • OpenRouter and the models it routes to — extracting data from the contracts you upload (United States). They do not retain your content for training.
  • OpenAI — voice transcription, only if you use dictation (United States).
  • ConvertAPI — Word to PDF conversion (European Union).
  • Polar — payment processing; handles billing data, not your contract data.

6. International transfers

The sub-processors listed process data outside Ecuador. Transfers rely on the adequate safeguards contemplated by the LOPDP: contractual clauses with security and confidentiality commitments equivalent to those in this agreement.

7. Audit

On your reasonable request, and no more than once a year unless an authority requires it, we will provide the information needed to demonstrate our compliance with this agreement.

8. Contact

For anything relating to this agreement: support@askroby.io.