Legal Compliance

Data Processing Agreement (DPA)

For agencies and enterprise customers who require a formal agreement regarding the processing of personal data.

Agreement Overview

Scope

Processing of Make.com Blueprints and associated metadata for documentation generation.

Data Location

Australia (Vercel Network) / Australia (Operational Base)

Authorized Sub-processors

Entity	Purpose	Location
Vercel Inc.	Cloud Hosting & Serverless Functions	Australia
Supabase Inc.	Authentication & Database	Australia
Stripe Inc.	Payment Processing	USA
PostHog Inc.	Product Analytics (EU-hosted, opt-in)	EU (Germany)

Subprocessor Notification & Change Policy

The following policy governs how we notify you of changes to subprocessors, as required by Article 28 GDPR and APP 8:

Advance Written Notice: We will provide at least 30 days' written notice (via email to the registered contact and in-app notification) before authorising any new subprocessor or materially changing the scope of an existing subprocessor's processing activities.
Right to Object: The data controller (you) may object to a new subprocessor within the notice period by written notice to [email protected]. If you object, we will either (a) refrain from engaging the subprocessor for your data, or (b) provide you the option to export your data and terminate the agreement with a pro-rata refund of prepaid fees.
Due Diligence: Before engaging any new subprocessor, we conduct a security and privacy assessment including: SOC 2 Type II or ISO 27001 certification review, execution of a data processing agreement with the subprocessor, and verification of appropriate data transfer mechanisms (Standard Contractual Clauses for international transfers).
Subprocessor Register: The current register of subprocessors is maintained in the table above and at xrayflow.io/security. Changes are reflected within 5 business days of execution.
Annual Review: We review all subprocessors annually for continued compliance, necessity, and proportionality. Subprocessors no longer required are removed within 30 days.

Execute this DPA

Request the standard Data Processing Agreement via email, and our team will send you a countersign-ready copy.

Request DPA via Email

Version 1.0 (June 2026) — Custom countersign required

Entity

Purpose

Location

Vercel Inc.

Cloud Hosting & Serverless Functions

Australia

Supabase Inc.

Authentication & Database

Australia

Stripe Inc.

Payment Processing

USA

PostHog Inc.

Product Analytics (EU-hosted, opt-in)

EU (Germany)

Subprocessor Notification & Change Policy

The following policy governs how we notify you of changes to subprocessors, as required by Article 28 GDPR and APP 8:

Advance Written Notice: We will provide at least 30 days' written notice (via email to the registered contact and in-app notification) before authorising any new subprocessor or materially changing the scope of an existing subprocessor's processing activities.

Right to Object: The data controller (you) may object to a new subprocessor within the notice period by written notice to [email protected]. If you object, we will either (a) refrain from engaging the subprocessor for your data, or (b) provide you the option to export your data and terminate the agreement with a pro-rata refund of prepaid fees.

Due Diligence: Before engaging any new subprocessor, we conduct a security and privacy assessment including: SOC 2 Type II or ISO 27001 certification review, execution of a data processing agreement with the subprocessor, and verification of appropriate data transfer mechanisms (Standard Contractual Clauses for international transfers).

Subprocessor Register: The current register of subprocessors is maintained in the table above and at xrayflow.io/security. Changes are reflected within 5 business days of execution.

Annual Review: We review all subprocessors annually for continued compliance, necessity, and proportionality. Subprocessors no longer required are removed within 30 days.