This Data Processing Agreement ("DPA") forms part of the IVGraph Terms of Use ("Terms") between IVGraph, 1459 Haro St, Vancouver, BC V6G 1G4, Canada ("IVGraph"), and the business customer that uses IVGraph, meaning an organization that uses IVGraph for its work through its own accounts or those of its staff ("Customer"). It applies when IVGraph processes personal data contained in Customer's Notion content on Customer's behalf.

1. Definitions

Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the EU General Data Protection Regulation 2016/679 ("GDPR"). "Customer Personal Data" means personal data in the Notion content that Customer or its users connect to IVGraph. "Customer's accounts" means the IVGraph accounts whose email address is on an email domain that Customer has given IVGraph; an account counts as one of Customer's accounts once IVGraph has recorded that domain. "Data Protection Laws" means the GDPR, the UK GDPR and other data protection laws that apply to the processing.

2. Roles

2.1. For Customer Personal Data, Customer is the controller and IVGraph is the processor.

2.2. For account data, billing data, usage analytics and messages sent to IVGraph, IVGraph is an independent controller under its Privacy Policy. This DPA does not apply to that data, except for section 7.4.

3. Instructions

3.1. IVGraph processes Customer Personal Data only on Customer's documented instructions. The instructions are this DPA, the Terms, and Customer's choices in Notion and in the IVGraph dashboard: which pages and databases are shared with IVGraph, whether page text is copied, and which widgets and API keys are created.

3.2. IVGraph tells Customer without delay if it believes an instruction breaks Data Protection Laws.

3.3. IVGraph does not use Customer Personal Data to train or improve any AI model and does not use it for any purpose of its own. IVGraph may use technical metadata, such as the number of pages and databases synced, to run, bill and support the service.

3.4. IVGraph does not sell Customer Personal Data and does not share it with advertisers.

4. Details of processing

Annex 1 describes the subject matter, nature, purpose and duration of the processing, and the types of personal data and data subjects.

5. Confidentiality

Everyone at IVGraph who can access Customer Personal Data is bound by a duty of confidentiality and accesses it only as needed to provide and support the service.

6. Security

IVGraph applies the technical and organisational measures in Annex 2 and keeps them at least at that level.

7. Retention and deletion

7.1. Customer can delete Customer Personal Data at any time. Disconnecting a workspace in the dashboard (⋯ → Disconnect) deletes its copy and search index. Deleting an account (Profile → Danger zone → Delete account) deletes the account and all Customer Personal Data in it. Removing IVGraph's access in Notion only stops future syncs: the copy stays until the workspace is disconnected or the account is deleted.

7.2. When the Terms end, IVGraph deletes the Customer Personal Data in Customer's accounts within 30 days, unless Customer has already deleted it. The original content stays in Customer's Notion, so no return of data is needed.

7.3. Backups of the database are encrypted, kept for up to 12 months and deleted when their retention period ends. They are used only to recover from a failure, to test that recovery works, and to check, before a new version of IVGraph is released, that it updates the database without losing or damaging data. Copies restored for these tests and checks are made on IVGraph's servers and deleted right after. Deleted data therefore disappears from backups within 12 months.

7.4. If an account was one of Customer's accounts when it was deleted, IVGraph does not keep the note under the account number described in section 7 of the Privacy Policy, and on Customer's request it deletes the record described there that holds a keyed hash of the email address, the Notion user and workspace IDs, the last plan, usage counts and the creation and deletion dates. The request names the email addresses concerned, because IVGraph can find that record only by the email address. Only a "no news" choice may be kept with the hash of the email address, so that the person is not sent news and tips again.

7.5. IVGraph confirms deletion in writing on request.

8. Sub-processors

8.1. Customer gives general authorisation to the sub-processors listed at ivgraph.com/subprocessors/.

8.2. IVGraph informs Customer by email at least 30 days before adding or replacing a sub-processor that processes Customer Personal Data, at the email addresses of Customer's accounts or at another address Customer gives at [email protected]. Customer may object on reasonable data protection grounds. If the parties cannot resolve the objection, Customer may end the Terms and receive a pro-rata refund of prepaid fees.

8.3. IVGraph imposes data protection obligations on each sub-processor that are no less protective than this DPA and remains responsible to Customer for its sub-processors.

9. International transfers

9.1. IVGraph is established in Canada, which benefits from an adequacy decision of the European Commission (Decision 2002/2/EC). Customer Personal Data is stored on IVGraph's servers in the European Union (Finland); encrypted backups are stored with Cloudflare, as listed at ivgraph.com/subprocessors/.

9.2. Where a transfer of Customer Personal Data to IVGraph or to a sub-processor is not covered by an adequacy decision, it is protected by the EU–US Data Privacy Framework or by the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914). Between Customer and IVGraph, Module 2 (controller to processor) applies and is incorporated by reference, with these choices: clause 7 does not apply; clause 9, option 2, with 30 days' notice; the optional wording of clause 11 does not apply; clause 13: the supervisory authority competent for Customer; clauses 17 and 18: the law and courts of the EU Member State where Customer is established. Annexes 1–3 of this DPA serve as the annexes of the clauses. For the UK, the UK International Data Transfer Addendum applies in the same way.

10. Assistance

10.1. IVGraph helps Customer answer requests from data subjects, mostly through the dashboard functions described in section 7, and passes on any request it receives directly.

10.2. IVGraph gives reasonable help with data protection impact assessments and consultations with supervisory authorities, to the extent they concern IVGraph's processing.

11. Personal data breaches

IVGraph notifies Customer without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice describes what happened, the data and data subjects concerned, the likely consequences and the measures taken.

12. Audits

IVGraph makes available the information needed to demonstrate compliance with this DPA and answers Customer's reasonable written questions, once a year or after a personal data breach. If this is not enough, or a supervisory authority requires it, Customer may audit IVGraph with 30 days' notice, at Customer's cost, without access to other customers' data.

13. Liability and precedence

Liability under this DPA is subject to the limitations in the Terms, unless Data Protection Laws do not allow this. If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data. If it conflicts with the Standard Contractual Clauses, the clauses prevail.

14. Term

This DPA applies for as long as IVGraph processes Customer Personal Data. Questions about it: [email protected].

Annex 1. Details of processing

Subject matter and purpose: providing IVGraph to Customer: the graph of Notion pages, search, widgets and the API.
Nature: copying the content Customer shares from Notion, storing it, indexing it for search, and showing it to Customer's users and to people who open the widgets Customer publishes.
Duration: while Customer uses IVGraph, and until deletion under section 7.
Data subjects: Customer's employees and contractors, members of Customer's Notion workspace, and people mentioned in Customer's Notion content.
Types of personal data: the content of the pages and databases Customer shares (titles, properties, dates, links, icons, covers); names, profile pictures and, where Notion shares them, email addresses of workspace members; the text inside pages, only if Customer turns on Page text.
Special categories of data: not intended. Customer should not share such data with IVGraph.

Annex 2. Technical and organisational measures

Hosting: servers of Hetzner Online GmbH in Helsinki, Finland, in ISO/IEC 27001-certified data centres.
Network: the servers accept web traffic only through Cloudflare; direct connections are refused. Traffic is encrypted with TLS 1.2 or higher, both between visitors and Cloudflare and between Cloudflare and our servers.
Administrative access: only with personal SSH keys; password login and direct root login are disabled; access is limited to the IVGraph team.
Read-only access to Notion: IVGraph never changes content in Customer's Notion. Page text is copied only if Customer turns it on.
Credentials: on IVGraph's servers in Finland, the IVGraph database stores Notion access tokens encrypted, and the sync software (Airbyte) keeps an unencrypted working copy of them in its own database on the same servers. Airbyte can't be reached from the internet. API keys are stored only as hashes.
API: the IVGraph API hides email addresses and phone numbers in page properties and people's details.
Backups: daily, encrypted by IVGraph before storage, so Cloudflare cannot read them; kept for up to 12 months; a full restore is tested every week.
Logs: server logs are kept for 90 days and then deleted.
Session recordings (Microsoft Clarity): text typed into form fields is masked; in the dashboard and the graph app, all text is masked.
Deletion: the functions in the dashboard described in section 7.

Annex 3. Sub-processors

As listed at ivgraph.com/subprocessors/ on the date of this DPA.