Data Processing Addendum

This Data Processing Addendum (“DPA”) is part of the Terms of Service between ТОВ «АПРИКОД» (APRICODE LLC; EDRPOU code 41644485, 9 Rustaveli St., Kharkiv 61001, Ukraine, “Apricode”, “we”) and the customer that uses APROS (“Customer”, “you”). It applies whenever we process personal data on your behalf to provide APROS. By accepting the Terms, you accept this DPA. If you need a signed copy for your records, write to hello@apri-code.com.

Definitions

Data Protection Law means the laws that apply to the processing of Customer Data under the Terms. These include the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and the Swiss Federal Act on Data Protection where they apply, and the Law of Ukraine “On Personal Data Protection” No. 2297-VI.
Customer Data means personal data that you, your users, or the services and channels you connect put into your APROS workspace, and that we process on your behalf.
Sub-processor means a company we engage that processes Customer Data for us.
Controller, processor, data subject, personal data breach and supervisory authority have the meanings given in the GDPR. Under Ukrainian law, the controller is the “owner of personal data” (володілець) and the processor is the “manager of personal data” (розпорядник).

Roles

You are the controller of Customer Data. If you use APROS to process personal data for your own clients, you act as their processor and we act as your sub-processor; this DPA then applies in the same way.
We are the processor. We process Customer Data only on your behalf and as this DPA describes.
We are a separate controller for the data described in our Privacy Policy as ours: account and billing details, website and support data, the technical part of crash reports, and usage and security data we need to run the service. This DPA does not cover that data. Customer Data that appears in crash reports, such as text that was on the screen, stays Customer Data: we process it under this DPA, only to find and fix the fault.
For data APROS receives through Meta platforms, we also act as a Tech Provider under Meta’s Platform Terms: we process that data only on your behalf and at your direction, and we keep it separate from other customers’ data.

Details of the processing

Subject matter. Providing APROS to you under the Terms.

Duration. For as long as you use APROS, and afterwards until the data is deleted or returned under Return and deletion.

Nature of the processing. Storing, organising, retrieving, displaying and transmitting Customer Data; synchronising it with the services you connect; sending messages and email you or your AI agents send; processing it with AI features (generating text, suggesting replies, summarising, translating, transcribing, searching and indexing); and deleting it.

Purpose. To provide, secure and support APROS as you configure and use it.

Data subjects.

your users: employees, contractors and other people you give access to your workspace;
your customers, leads, contacts and their representatives;
people who message your connected channels (for example Facebook Messenger, Instagram, WhatsApp, Telegram, Viber) or your website chat;
your email correspondents and calendar attendees;
participants in calls you hold or record in APROS;
any other people whose data you put into APROS.

Categories of personal data.

identification and contact data: names, email addresses, phone numbers, usernames, messaging-platform ids, profile photos, job titles;
communications: messages, emails, attachments, call recordings and transcripts;
calendar events and attendees;
sales and customer data: leads, deals, companies, notes, activity history;
documents and files;
financial data: invoices, quotes, payments, imported bank transactions (including counterparty names and account numbers);
work data: tasks, projects, time tracking, user roles and departments;
technical data: IP addresses, browser and device details in sign-in sessions and the audit log;
AI data: prompts, AI outputs and the memories AI agents keep in your workspace;
website chat visitor data: browser details, page addresses and campaign tags.

Special categories of data. APROS does not ask for special categories of data (such as health data). They may still appear in content you or the people you deal with put into APROS, such as messages. You decide whether to process them and must have a lawful basis to do so. They are protected by the same measures as other Customer Data (Annex 2); APROS has no additional safeguards for them.

Frequency of transfer. Continuous, for as long as you use APROS.

Contacts. For you: the account owner of your workspace. For us: hello@apri-code.com.

Your instructions

Your instructions are the Terms, this DPA, the way you configure and use APROS, and any other instructions we agree in writing (email is enough).
Configuration is an instruction. For example, connecting a channel or a mailbox, switching on AI features or attaching an AI agent to a channel instructs us to process Customer Data that way.
Some features are switched on by us by default: in new workspaces, call recording (with recordings kept for 90 days), the AI call coach, automatic post-call AI analysis, smart reply suggestions, creating leads from new conversations and emails, and automatic crash reports. By keeping a default, you instruct us to process Customer Data that way. Our Privacy Policy describes each of them.
We tell you immediately if we believe an instruction breaks Data Protection Law. We may suspend that processing until you confirm or change the instruction.
If a law requires us to process Customer Data in another way, we tell you before doing so, unless that law forbids it.

Your obligations

You are responsible for:

having a lawful basis for the Customer Data you process in APROS and for each feature you switch on;
giving the people concerned the information the law requires, including people who message your channels, and participants in calls you record or that the AI call coach joins;
following the rules of the services you connect, such as Meta’s and WhatsApp’s business messaging policies;
managing your users, their permissions and the autonomy of your AI agents.

Confidentiality

Everyone at Apricode who can access Customer Data is bound by a duty of confidentiality and accesses it only as far as their work on APROS requires.

Security

We apply the technical and organisational measures in Annex 2. We may change them as technology develops, but we will not reduce the overall level of protection they give.

Sub-processors

General authorisation. You authorise us to use the sub-processors listed on our Sub-processors page.
Changes. We email your account owner at least 30 days before a new sub-processor starts processing Customer Data, and update the Sub-processors page at the same time. You may object in writing within those 30 days, on reasonable data-protection grounds. We will then discuss your objection with you in good faith. If we cannot resolve it, you may end your subscription with written notice, and we will refund the unused part of the period you paid for.
Our duties. We have a written contract with data-protection obligations with each sub-processor, except those the Sub-processors page lists as having no data-processing contract. We remain responsible to you for all our sub-processors, including those.
Services you connect (for example Meta, Google, your mail provider or your bank) are not our sub-processors. They act under their own terms with you.

Requests from data subjects

APROS lets you view, correct and delete most Customer Data directly.
If a data subject asks us about Customer Data, we pass the request to you without undue delay and do not answer it ourselves, except to say that we have passed it on.
Deletion requests under platform rules. Meta’s Platform Terms and Google’s API Services User Data Policy require us to honour deletion requests from the people whose data we receive through those platforms. You instruct us to act on such requests sent under our Data Deletion Instructions for data APROS received through Meta platforms or Google APIs. We tell you when we act on one.
Where you cannot answer a request with APROS features alone, for example to remove copies kept in the audit log or files left in storage, we help you. We do this at no extra charge unless requests are clearly excessive.

Other assistance

We give you the information and help you reasonably need to meet your obligations on security, personal data breaches, data protection impact assessments and prior consultation with supervisory authorities, taking into account what we know about the processing.

Personal data breaches

We notify you without undue delay after we become aware of a personal data breach affecting Customer Data. We send the notice to your account owner’s email address.
The notice describes, as far as we know at the time: what happened; the categories and approximate number of people and records affected; the likely consequences; the measures we have taken or propose; and who you can contact. If we do not have all this at once, we send it in stages.
We take reasonable steps to contain the breach and reduce its effects, and we cooperate with you on it.
A notice is not an admission of fault or liability.

Return and deletion

While you use APROS, you can delete Customer Data yourself. Some copies cannot be removed from the interface, such as the full copy of a deleted record that the audit log keeps, or files that stay in storage after a conversation is deleted. We remove those on your request.
When your subscription ends, we keep Customer Data under this DPA for 90 days after the end of your last paid period, so that you can renew or ask for a copy. At least 30 days before those 90 days run out, we email your account owner. When they run out, your account is closed and we delete Customer Data as described under Deletion.
Return. You can take Customer Data out with APROS’s export features and the REST API. If those do not cover what you need, we provide a copy of your workspace’s data in a common machine-readable format, such as a database export with your files, on request.
Deletion. When you ask us to delete your workspace, or when your account is closed, we delete Customer Data from its database and file storage, including audit-log copies and data received through Meta platforms, within 30 days, and confirm this to your account owner in writing. We cannot remove single entries from our system logs or from backups; such copies remain until those logs or backups are themselves deleted.
Exceptions. We may keep data where a law requires us to keep it, and only for that purpose. Data that AI providers already received is kept by them under their own terms, as described in our Privacy Policy.

Audits and information

On request, we give you the information reasonably needed to show that we meet this DPA: this document, our Security page, the Sub-processors list and answers to reasonable security questionnaires.
If that is not enough, or a supervisory authority requires it, you or an independent auditor bound by confidentiality (not a competitor of ours) may audit our compliance with this DPA. Audits are limited to once in any 12 months unless a supervisory authority requires more or a personal data breach occurred. You give us at least 30 days’ notice, the audit takes place during business hours without disrupting the service and without access to other customers’ data, and you bear its cost. We prefer remote audits where they are enough.

International transfers

Customer Data is stored on servers in Germany. Apricode is established in Ukraine, and our staff access the data from Ukraine. Ukraine does not have an adequacy decision from the European Commission, so this access is a transfer of personal data out of the European Economic Area.
Standard Contractual Clauses. For Customer Data subject to the GDPR, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (“SCCs”) are incorporated into this DPA by reference. Module Two applies where you are a controller, and Module Three where you are a processor. You are the data exporter and we are the data importer. For the SCCs:
- Clause 7 (docking clause) does not apply;
- under Clause 9, Option 2 (general written authorisation) applies, and the time period for notice of changes is 30 days, as described in Sub-processors;
- the optional wording in Clause 11 does not apply;
- under Clause 13, the competent supervisory authority is the one competent for you;
- under Clause 17, the SCCs are governed by the law of the EU Member State in which you are established, or, if that law does not allow third-party beneficiary rights or you are not established in the EU, by the law of Germany;
- under Clause 18, disputes are resolved by the courts of that Member State;
- Annex I is completed by Roles and Details of the processing; Annex II by Annex 2; Annex III by the Sub-processors page.
UK and Switzerland. For Customer Data subject to the UK GDPR, the SCCs apply as amended by the UK International Data Transfer Addendum issued by the Information Commissioner. For data subject to Swiss law, they apply with the changes the Swiss data protection authority requires, and references to the GDPR are read as references to the Swiss Federal Act on Data Protection.
Onward transfers. Some sub-processors process data outside the European Economic Area (see the Sub-processors page). For sub-processors with which we have a data-processing contract, we use an appropriate safeguard, such as the SCCs or an adequacy decision, including the EU-US Data Privacy Framework where the recipient is certified under it. For those the Sub-processors page lists as having no data-processing contract, no such safeguard is in place.
Ukrainian law. Transfers of personal data subject to Ukrainian law to other countries are made under Article 29 of the Law of Ukraine “On Personal Data Protection”.
If the SCCs and this DPA conflict, the SCCs prevail.

Liability and order of precedence

Each party’s liability under this DPA is subject to the limits in the Terms, except where Data Protection Law or the SCCs do not allow a limit.
If this DPA and the Terms conflict on the processing of Customer Data, this DPA prevails.
This DPA stays in force for as long as we process Customer Data.

Language versions

This DPA is published in Ukrainian and English, and both versions have the same content. If they differ, the Ukrainian version prevails. This does not limit any right you or the people whose data we process have under the law that applies. The Standard Contractual Clauses apply in the official wording adopted by the European Commission.

Annex 2: Technical and organisational measures

These are the measures in place today. They are described in more detail on our Security page.

Separation of customers

A separate application instance and database for each workspace; every record is also tied to its workspace in the database.
Shared services (integration service, AI gateway, cache and job queue, file storage, video calls, document editor, real-time messaging) are used by each workspace with its own credentials, storage bucket, key prefix, AI budget or access token.

Access to the application

Sign-in with email and password; passwords stored as bcrypt hashes (12 rounds); every password at least 8 characters with upper-case and lower-case letters and a digit; by default also at least 12 characters and a special character, a rule an administrator can switch off.
Limits on repeated failed sign-ins from one IP address.
Sign-in tokens valid for 30 minutes; refresh tokens that change on every use, with reuse detection; sessions of up to 7 days in a browser and up to 90 days on an enrolled desktop or mobile device; an inactivity timeout set by the workspace; immediate revocation of sessions; deactivated users cannot sign in.
Role-based permissions per action and type of record, record scopes (own, team, department, company), field-level restrictions and per-workspace module switches.
APROS AI agent tools pass the same workspace, permission, record-scope and module checks as people do.
API keys stored as SHA-256 hashes, with no permissions until granted, optional expiry and a rate limit. Tokens issued to connected AI clients are stored as hashes.

Encryption

HTTPS for connections from browsers and apps, with HTTP Strict Transport Security.
Application-level encryption with AES-256-GCM, using per-secret keys wrapped by a rotatable master key, for these stored credentials: channel and bot tokens, Meta and WhatsApp tokens, OAuth tokens, mailbox passwords, payment and bank connection credentials, AI provider keys, MCP and Git tokens, and telephony settings. Notification webhook secrets, Telegram linking codes, the client id and account number of a PrivatBank connection, and some tokens saved by older versions of APROS are not yet encrypted.
Other Customer Data, including messages, emails and files, is not encrypted at the application level and is protected by the access controls in this annex.

Files

Private storage buckets per workspace; download links are signed and expire after one hour. Public share links that users create work until revoked or until the expiry the user sets.

Logging and integrity

An audit log of creations, changes and deletions of CRM records, changes to roles and permissions, API keys, connected accounts, views of stored secrets, exports, merges and AI approvals, with user or agent, time, IP address and browser.
Changes made by APROS AI agents carry a reference to the agent run that made them.
AI usage is logged per workspace as metadata (feature, model, tokens, cost, duration), without the content.
Application logs remove values whose names indicate a secret. They can still contain identifiers, names, email addresses and IP addresses.
Webhooks from Meta are verified against Meta’s signature at our integration service and passed to the workspace with a signed voucher or, for workspaces not yet moved to vouchers, a shared secret; Telegram webhooks are verified against a secret.

AI controls

Autonomy levels per APROS AI agent with an approval matrix; deletions by APROS AI agents always need a person’s approval. AI clients you connect over MCP act with the permissions you grant them, outside this matrix.
Text from customers, emails and web pages is marked as untrusted in AI prompts.
A spending limit on AI use for each workspace.

People

Infrastructure access limited to Apricode staff who need it for their work, under a duty of confidentiality.

Physical security

Servers are hosted in Hetzner data centres in Germany, which are responsible for the physical security of the hardware.

Availability and restore

This DPA does not describe a backup or restore service, and we make no commitment about restoring lost data. Keep your own copies of data that is critical to you (see the Terms of Service).

Not currently in place

Two-factor authentication and single sign-on are not available. Apricode holds no third-party security certification.

Annex 3: Sub-processors

The current list is on our Sub-processors page.