Legal
Data Processing Agreement
Questions about it can go to hello@operate.as.
Effective October 23, 2026
This Data Processing Agreement ("DPA") is between Arcaro Labs LLC ("Operate As", "we", "us") and the agency that uses Operate As ("you"). It forms part of our terms of service and applies automatically to every plan, Free included, whenever we process personal data on your behalf. You don't need to sign anything for it to apply. On the Agency plan and above, we'll countersign a copy for your records on request.
The short version: your clients' data is yours. We process it only to run the calls you direct, we keep it confidential and secure, we tell you about any breach quickly, we list everyone who helps us, and we delete it when you're done.
1. Definitions
Words such as "personal data", "processing", "controller", "processor", "data subject" and "supervisory authority" mean what they mean in the Data Protection Laws. In this DPA:
- Data Protection Laws means every law that applies to the processing of Customer Personal Data under this DPA, including the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act as amended (CCPA).
- Customer Personal Data means personal data we process on your behalf in providing the Service: your clients' details, the connections and permissions they grant, the data your calls carry, and the records of those calls.
- Sub-processor means a third party we engage to process Customer Personal Data.
- Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
- Service has the meaning in our terms of service.
2. Roles
For Customer Personal Data, you are the controller (or a processor acting for your client), and we are your processor (or sub-processor). For the account information of you and your team, such as names, emails and billing details, we are an independent controller, as described in our privacy policy, and this DPA doesn't apply to it.
The services your clients connect, such as Google, Slack or HubSpot, are chosen by you and your clients and act under their own terms. They aren't our sub-processors: sending a call to the service you direct is the processing you ask us to do.
3. Your instructions
We process Customer Personal Data only on your documented instructions, which are this DPA, the terms of service, and your use and settings of the Service, such as the clients you add, the keys you create and the calls you make. If we believe an instruction breaks the Data Protection Laws, we'll tell you. If the law requires us to process Customer Personal Data otherwise, we'll tell you first, unless the law forbids it.
You're responsible for having a lawful basis for the processing you instruct, including your clients' agreement before you request access to their services, and for the notices your work requires.
4. Confidentiality
Everyone at Operate As who can access Customer Personal Data is bound by confidentiality, and has access only as far as their work needs. Our staff don't read the data your calls carry, except with your permission, to keep the Service secure, or where the law requires.
5. Security
We maintain the technical and organizational measures in Annex 2, which are designed to protect Customer Personal Data against Security Incidents. We may improve them over time, but won't reduce the overall protection they give.
6. Sub-processors
You authorize us to use the sub-processors in Annex 3. Before we add or replace one, we'll update this page and tell you by email at least 30 days ahead. If you object on reasonable data protection grounds, tell us within that time. We'll work with you on an alternative, and if we can't find one, you may end the affected part of the Service and receive a refund of any prepaid fees for the time remaining.
Each sub-processor is bound by a written contract with data protection obligations at least as protective as this DPA. We remain responsible to you for their work.
7. Helping you
Taking into account the nature of the processing, we'll help you:
- Answer data subject requests. Most can be handled directly in the Service: you can see, correct and remove a client and their connections, and clients can remove any connection from their page. If a request reaches us directly, we'll pass it to you and not answer it ourselves, unless you ask us to or the law requires.
- Meet your other obligations, such as data protection impact assessments and consultations with a supervisory authority, by giving you the information we reasonably can about the Service.
8. Security Incidents
If we become aware of a Security Incident, we'll tell you without undue delay, and within 72 hours at most. We'll say what we know, such as what happened, the data and people likely affected, its likely consequences, and what we're doing about it, and send more as we learn it. We'll take reasonable steps to contain it and limit its effects. Telling you isn't an admission of fault.
9. Deleting data
When you remove a client or a connection, we cancel the access with the service where it allows and delete our copy. When your organization is deleted, or the Service ends, we delete the Customer Personal Data we hold within 30 days, unless the law requires us to keep it. Call records are deleted sooner, at the end of your plan's call history. The activity log, which records who did what and can name your clients and members, is kept for 2 years as a security record, including after your organization is deleted, then deleted; until then it's protected by this DPA and used only for security, audits and legal claims. Copies in encrypted backups are deleted as the backups are replaced, and are protected by this DPA until then.
10. Audits
We'll make available the information reasonably needed to show we meet this DPA, including answers to a reasonable security questionnaire once a year. If that isn't enough to meet a requirement of the Data Protection Laws, or a supervisory authority asks, you may audit our processing, with at least 30 days' notice, during business hours, at your own cost, no more than once a year, and under confidentiality terms that protect our other customers and our security.
11. International transfers
We're based in the United States, and process Customer Personal Data there. Where the Data Protection Laws require safeguards for a transfer out of the European Economic Area, the United Kingdom or Switzerland:
- From the EEA, the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914 apply and are incorporated by reference: Module 2 (controller to processor) where you are a controller, and Module 3 (processor to processor) where you are a processor. Clause 7 (docking) applies; under Clause 9, option 2 (general authorization) applies, with the notice period in section 6; the option in Clause 11 doesn't apply; under Clauses 17 and 18, the clauses are governed by, and disputes are resolved in, the courts of Ireland. Annexes I and II are completed by Annex 1 and Annex 2 of this DPA.
- From the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner applies, completed with the information in this DPA.
- From Switzerland, the Standard Contractual Clauses apply as above, with the Swiss Federal Data Protection and Information Commissioner as the competent authority, and references to the GDPR read as references to the Swiss Federal Act on Data Protection.
If these clauses conflict with the rest of this DPA, the clauses win.
12. US state privacy laws
Where the CCPA or a similar law applies, we're your "service provider" or "processor". We won't sell or share Customer Personal Data, keep, use or disclose it for any purpose other than providing the Service, or combine it with personal data we get from others, except as those laws allow. We'll tell you if we can no longer meet these obligations. We certify that we understand and will comply with these restrictions.
13. General
This DPA lasts as long as we process Customer Personal Data for you. Limits of liability in the terms of service apply to it. If it conflicts with the terms of service, this DPA wins for the processing of Customer Personal Data. It is governed by the law that governs the terms of service, except where the Data Protection Laws or the Standard Contractual Clauses require otherwise. We may update it as described for the terms of service, and will never reduce the protection it gives Customer Personal Data without telling you first.
Annex 1: Details of processing
| Item | Details |
|---|---|
| Data exporter | The agency using the Service, as controller or processor |
| Data importer | Arcaro Labs LLC, as processor. Contact: hello@operate.as |
| Data subjects | The agency's clients and their staff, and people whose data appears in the calls the agency makes through its clients' connected services |
| Categories of data | Client names and email addresses; access tokens and keys to connected services (encrypted); the permissions approved and account identifiers calls need; passkey public keys; records of calls (key, client, service, action, method, path, status and timing); and the data calls carry, which the agency decides |
| Sensitive data | None intended. The agency decides what its calls carry, and should not send special categories of data through the Service unless the law allows it and it has assessed the risk |
| Frequency | Continuous, for as long as the agency uses the Service |
| Nature and purpose | Storing clients' connections securely, renewing them, and passing the calls the agency directs to the services it connects, with records of each call, so the agency can work in its clients' tools |
| Retention | As in section 9: connections until removed; call records for the plan's call history, from 7 days to a year; the data calls carry isn't stored |
| Competent authority | The supervisory authority of the EU member state where the agency is established, or where its representative is |
Annex 2: Security measures
- Encryption. Connection tokens and keys are encrypted at rest, with encryption keys kept in a secrets manager, apart from the database. All traffic is encrypted in transit with TLS. Database and storage are encrypted at rest by our hosting provider.
- Minimal secrets. API keys, sessions, invitation links and recovery codes are stored only as hashes. Agents get their own keys, never a client's token, and keys can be limited to clients, services, actions and addresses.
- Access control. Production access is limited to the people who need it, uses separate accounts with least privilege for each part of the system, and requires two-factor sign-in, as does our admin area. Roles and permissions limit what each agency member can do. Every organization's owners sign in with two-factor, and an organization can require it of all its members.
- Isolation. Each agency's data is separated by organization in every query. Calls to connected services refuse private network addresses.
- Monitoring and logging. Sign-ins, key use and security events are logged and rate limited. Unusual activity, such as a key used from an address it isn't allowed, is refused and reported.
- Resilience. Hosting on Google Cloud, with automatic, encrypted database backups.
- Secure development. Automated tests for every change, scanning of code for leaked secrets and of dependencies for known vulnerabilities, and security updates applied promptly.
- People. Confidentiality obligations for everyone with access.
- Incident response. A process to find, contain and report Security Incidents, as in section 8.
Annex 3: Sub-processors
| Sub-processor | What it does | Where |
|---|---|---|
| Google LLC (Google Cloud) | Hosting, database, file storage and secrets management | United States |
| Google LLC (Google Workspace) | Sending email, such as client links and connection alerts | United States |
Payments go through Stripe, which processes your billing details as an independent controller, not Customer Personal Data.
Contact
Questions about this DPA, or a request for a countersigned copy:
Arcaro Labs LLC
hello@operate.as