Data Processing Agreement

1 Scope and roles #

This DPA covers the personal data in Customer Data that AR Dynamics processes on Customer's behalf to provide the Service ("Customer Personal Data"). For that data Customer is the controller (or processor for its own customers) and AR Dynamics is the processor (or subprocessor). For account, billing and website data that AR Dynamics determines the purposes of, AR Dynamics is an independent controller as described in the Privacy Policy.

2 Customer's instructions #

AR Dynamics will process Customer Personal Data only to provide, secure and support the Service and on Customer's documented instructions, which are these Terms, this DPA, and Customer's use of the Service's settings (including the telemetry level and retention period it chooses). AR Dynamics will tell Customer if it believes an instruction infringes data-protection law.

3 Details of processing #

Subject matter

Providing the CybrGate control plane for the browsers Customer enrolls.

Duration

While Customer's organization exists, and then until erasure on request.

Nature and purpose

Storing, scoring and displaying extension inventories; storing the audit timeline; delivering signed policy; authenticating administrators; billing through Stripe.

Data subjects

Customer's administrators, and the employees, contractors and other users of the browser profiles Customer enrolls.

Categories of data

Administrator email, role, password hash and TOTP secret; sign-in IP address and user-agent; a random profile fingerprint and optional seat label; each enrolled browser's extension inventory (id, name, version, permissions, host permissions, install type, update URL) and the scores computed from it; hostnames other extensions contacted; and, if Customer selects the events level, the allow-listed event fields in the Privacy Policy, including the origin of a page where an injection was detected or an action gated.

Special categories

None intended. Page content, full URLs, form values and browsing history are never received.

Frequency

Continuous: the extension scans hourly and uploads on schedule, within the telemetry level Customer sets.

4 Confidentiality #

AR Dynamics will ensure that people it authorizes to process Customer Personal Data are bound by confidentiality obligations.

5 Security measures #

AR Dynamics maintains the technical and organizational measures described in the Privacy Policy, Security measures, including: HTTPS-only transport from the extension; signed policy and seat licenses; row-level security enabled and forced on every customer table; a least-privilege database role without permission to bypass it or to update or delete the audit log and events; hashed passwords and hashed session and enrollment tokens; mandatory two-factor authentication for owner and admin accounts; per-IP and per-account rate limiting; an append-only audit log; and an application firewall with auto-expiring bans. Security measures will not be materially reduced during the term.

6 Subprocessors #

Customer gives general authorization to the subprocessors in Section 7. AR Dynamics will impose data-protection obligations on each that are no less protective than this DPA, and remains responsible for their performance. We will give at least 30 days' notice of a new subprocessor by updating this page and writing to the organization's owner. Customer may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, Customer may stop using the affected part of the Service.

7 Current subprocessor list #

List last updated 2026-10-23. These are the only subprocessors that handle Customer Personal Data.

Google is not a subprocessor. The local classifier runs in the user's browser and CybrGate sends no page text to Google. CybrGate uses no analytics, advertising or email-delivery provider.

8 Data subject requests #

If AR Dynamics receives a request from someone about Customer Personal Data, it will pass it to Customer without responding on the substance, and it will help Customer respond, taking into account the nature of the processing, by providing the information it holds.

9 Personal-data breach #

AR Dynamics will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data, and will give Customer the information it has to meet its own notification duties, including what happened, the data and seats affected, and what is being done.

10 Deletion and return #

Customer controls retention of events (1 to 730 days, default 90). On Customer's written request, or after the Service ends and Customer asks, AR Dynamics will erase Customer Personal Data, including from the append-only tables, which the database permits only on an owner connection asserting an erasure context. AR Dynamics may keep what the law requires it to keep, and billing records held by Stripe follow Stripe's retention. Enforcement of scheduled deletion at the retention limit: The retention purge runs daily as a Vercel cron at 03:00 UTC. Backups are not scheduled on Vercel. The database is Neon Postgres, and Neon's built-in point-in-time restore applies.

11 Information and audits #

AR Dynamics will make available the information reasonably necessary to show compliance with this DPA, including the measures above. AR Dynamics holds no third-party security certification for CybrGate and does not claim one. Customer may carry out a reasonable audit on written notice, no more than once a year unless a breach or a regulator requires it, at Customer's cost and under confidentiality, without access to other customers' data.

12 International transfers #

AR Dynamics will transfer Customer Personal Data out of the EEA, the UK or Switzerland only under a lawful transfer mechanism. Where the transfer needs one and no adequacy decision applies, the parties will enter the EU Standard Contractual Clauses (Module Two, controller to processor, or Module Three where Customer is itself a processor) and, for the UK, the UK Addendum, completing their annexes from Section 3, on Customer's request at hello@ardynamicsinc.com. We have not independently certified our providers' safeguards.

13 Liability and precedence #

Each party's liability under this DPA is subject to the limitations in Terms of Service, Section 16, to the extent the law allows. If this DPA and the Terms conflict about the processing of Customer Personal Data, this DPA controls. Nothing here limits a data subject's rights.

14 Contact #

DPA questions and requests for a countersigned copy: hello@ardynamicsinc.com. Postal address: 200 Vineyard Blvd, Suite A325 #5128, Honolulu, HI 96817.