Data Processing Agreement (DPA).

You are the Controller. We (IE Spiridonov D. V.) are the Processor. Only people who need access to run the service have it, under a confidentiality obligation.

Processing is limited to what's required to deliver the service. No profiling of your visitors on our behalf, no ads, no third-party enrichment.

Hosting: dedicated server at HostLab (Kazakhstan, Almaty). Email: Sendersy (outbound mail). Backups: GitHub cloud storage (encrypted only). Payments: UnitPay. Sign-in with Google — Google (at the user's choice). Analytics on overcap.ru: Yandex Metrika. We announce changes in advance at support@overcap.ru.

Technical and organizational measures: TLS 1.3 in transit, AES-256 encrypted backups, bcrypt password hashes, 2FA, role separation, audit log, sign-in rate limits, SSH-key-only server access.

On request — export within 14 days (JSON + media). Deletion at contract end — within 30 days. Security logs rotate on a 12-month schedule.

Any security incident posing a risk to data subjects' rights — notification within 72 hours with scope, response actions and contact.

On request we provide a description of our technical and organizational measures; on-site checks by mutual agreement.

The DPA runs alongside the main agreement and cannot be unilaterally terminated while the subscription is active.