Public draft for legal review. Negotiated signed terms and mandatory law take precedence; this page is not a certification or legal opinion.
Processing instructions, client-key reports and service metadata.
Roles and scope
For personal data submitted under a business agreement, the client determines purpose and lawful basis; Trade Eyes processes service data according to documented instructions, subject to the executed agreement. Account, billing and abuse-prevention purposes may involve separate controller responsibilities.
Local and encrypted reports
Local workbench files are processed in the browser. Optional private report storage receives AES-GCM ciphertext; the company holds the decryption key. Membership, timestamps and billing metadata remain readable for service operation. Legacy broker AI requests and other existing workspaces are separate plaintext processing paths; this DPA does not represent them as zero-knowledge.
Data categories and instructions
Limit uploads to necessary, authorized data. Do not include special-category personal data without an agreed lawful scope. Contract schedules must specify purposes, subjects, categories, duration, regions and approved subprocessors before an executed DPA is relied on.
Safeguards and incidents
Access is organization-scoped and verified server-side. Report suspected incidents to hello@tradeeyes.app. Notifications, assistance with rights requests and breach obligations follow applicable law and the signed agreement; no unapproved fixed notification deadline is asserted here.
Transfers and deletion
Hosting and payment providers may process data in their operating locations. Appropriate transfer mechanisms, subprocessor schedules and retention instructions require contractual review. Key destruction may make ciphertext unreadable but is not a claim of immediate deletion of all backups.
Contact
Questions and contract requests: hello@tradeeyes.app.