Data processing agreement (art. 28 GDPR)

Version of 12 November 2026.

Parties

• Controller (“the customer”): the company or professional that owns a Boolu workspace, who accepts this agreement by accepting the terms of service (or signs it separately).
• Processor (“Boolu”): Pitinvestment, S.L. (single-member company), tax id B70784723, address Calle Gasco Oliag, 6, entresuelo 10, 46010 València (Spain), contact e-mail hello@boolu.app.

This agreement is part of Boolu's terms of service and applies while Boolu processes personal data on behalf of the customer. Where they conflict on data protection, this agreement prevails. If the Spanish and English versions differ, the Spanish version prevails.

1. Subject matter

Boolu processes, on behalf of the customer, the personal data the customer's team puts in its Boolu workspace, for the sole purpose of providing the service described in the terms: keeping the notes about its websites, with their screenshots, videos and conversations, showing them to those the workspace gives access to, and delivering them to the tools the customer connects.

The subject matter, duration, nature and purpose of the processing, the types of data and the categories of data subjects are described in Annex I.

2. Duration

While the workspace exists and until the data is deleted under clause 10.

3. The customer's instructions

Boolu processes the data only on the customer's documented instructions. These are instructions: this agreement, the terms of service and what the customer sets up in Boolu (who is in the workspace and with which role, which projects each person sees, which integrations it turns on, what it exports or deletes). If Boolu considers an instruction infringes data protection law, it will tell the customer at once.

If a law requires Boolu to process the data otherwise, it will tell the customer first, unless that law forbids it.

4. Confidentiality

Boolu ensures that the people authorised to process the data have committed to confidentiality or are under a legal duty of confidentiality. Nobody at Boolu accesses a workspace's content except when needed to provide the service, to handle a request of the customer, to resolve a security incident or to comply with a legal obligation.

5. Security

Boolu applies the technical and organisational measures of Annex II, appropriate to the risk under art. 32 GDPR, and reviews them when the service changes. It may improve them, but not lower the level of protection.

6. Sub-processors

• The customer gives Boolu general authorisation to use the sub-processors of Annex III.
• Boolu will tell the customer of any new or replaced sub-processor at least 15 days in advance (by e-mail to the owner or in the panel). The customer may object on reasonable data protection grounds; if no agreement is reached, it may end the service and export its data before the change.
• Boolu imposes on each sub-processor, by contract, the same data protection obligations as this agreement and remains liable to the customer for their compliance.
• Not Boolu's sub-processors are the tools the customer or its team connect on their own: Slack (when an admin connects a project) and Claude Code or other MCP clients (when a person connects them to their account). Data Boolu sends to them, or that they read, is processed under the customer's relationship with those providers.

7. International transfers

Data is stored in the European Union. Boolu transfers no data outside the European Economic Area except through the sub-processors of Annex III that are US companies, and with appropriate safeguards (the EU-US Data Privacy Framework or the European Commission's standard contractual clauses).

8. Helping the customer with data subjects' rights

Boolu helps the customer answer requests for access, rectification, erasure, restriction, portability and objection. The product already lets the customer:

• Access and portability: the owner exports the whole workspace (people and roles, invitations, projects, notes with their conversation and files) in a zip readable without Boolu, in JSON, CSV and the original files. Each person exports their own data.
• Rectification: edit notes and comments; each person corrects their name and e-mail.
• Erasure: delete notes and files, remove a person from the workspace and delete the workspace. Each person can delete their account: what they wrote in the workspace stays in the customer's workspace, signed “Deleted account” without their name or e-mail, and their mentions are rewritten the same way.

If a data subject contacts Boolu about a workspace's data, Boolu will refer them to the customer and tell it without delay, without answering on its own unless the customer says so.

Boolu also helps the customer, with the information it has, with data protection impact assessments and prior consultations with the supervisory authority.

9. Personal data breaches

Boolu will notify the customer without undue delay, and in any case within 48 hours of becoming aware of it, of any security breach affecting the customer's data, with the information available: what happened, which data and roughly how many data subjects, the likely consequences and the measures taken or proposed. If it does not have all the information at once, it will provide it in phases.

10. End of processing: return and deletion

• Before leaving, the customer can export its workspace (clause 8). Each export is available for 48 hours.
• When the owner deletes the workspace, it is closed to everyone for 7 days, during which it can be undone. After that, Boolu permanently deletes the workspace and all its content: projects, notes, conversations, integrations (with their secrets), invitations, exports, and their files on the disk or in storage (screenshots, thumbnails, videos, after images, unfinished uploads and previews). Unfinished uploads are deleted within a day.
• If the owner deletes their account and is alone in the workspace, the workspace goes with it, without those 7 days.
• What is outside Boolu and cannot be deleted from it: e-mails and Slack messages already sent, invoices issued by Stripe and whatever the assistants connected by the customer have already read.
• Backups: deleted data leaves the backups when they expire, after 30 days.
• Boolu will keep data after deletion only if a law requires it, blocked and only for that purpose.

11. Audits

Boolu makes available to the customer the information needed to show it complies with this agreement and allows audits and inspections by the customer or an auditor it appoints, with reasonable notice of 15 days, during business hours, without access to other customers' data and at most once a year, unless after a security breach or at an authority's request. The customer bears the cost of the audit, unless it reveals a breach by Boolu.

12. Records of processing

Boolu keeps the record of the processing activities it carries out on behalf of its customers (art. 30.2 GDPR).

Annex I. Description of the processing

Nature and purpose. Hosting, storing, organising, showing, exporting and deleting the notes the customer's team leaves about its websites, and sending them to the integrations and tools the customer or its team connect.

Categories of data subjects.

• The customer's team members and those it invites to its projects (owner, admins, team and per project).
• People whose data appears on the customer's websites when they are captured: for example, its customers or the users of those websites.
• Whoever appears or speaks in a video recorded with the camera or the microphone.

Types of data.

• About the team: name, e-mail, role, authorship and date of notes, comments, mentions, assignments and status changes; who is looking at a project at a given moment.
• About the notes: page address, text, element pointed at (selector and text), drawings, screen size and browser (user agent), and the page's design values if asked for.
• Files: screenshots, thumbnails, after images, project previews and videos of the tab, with voice and, if turned on, the camera's image.
• Whatever any screenshot or video shows of the page. Special categories: Boolu neither asks for nor needs them; if a page shows them and is captured, it processes them on the customer's instructions. The customer will see that its team does not capture them when the note does not need them.

Duration. That of the workspace, plus the periods of clause 10.

Annex II. Technical and organisational measures

They describe the product as it is on the date of the agreement.

Access and isolation

• Each workspace is isolated: every query goes through the person's membership of the workspace and its projects. A request for something in another workspace gets the same answer as something that does not exist. Automated tests check it.
• Roles with different permissions (owner, admin, team, per project). People “per project” only see the projects they are invited to.
• Random public identifiers (UUID) in addresses, the API and links, so the number of records is not revealed.

Authentication

• Passwords stored with a one-way hash (bcrypt). Attempt limits on sign-in, password reset, sign-up and e-mails sent.
• Irreversible actions (deleting, handing over, exporting) ask for the password again, with a limit of five attempts every ten minutes, and can only be done from a web session.
• The extension and MCP clients sign in with OAuth 2.0 (authorization code with PKCE S256): one-hour access, refresh tokens that rotate on every use and revoke the whole grant if reused, and explicit consent on every authorisation. API tokens are stored hashed and can be revoked one by one.
• Changing or resetting the password ends every session and revokes every token.

Encryption

• HTTPS for all communications.
• Integrations' secrets (such as the Slack webhook) encrypted in the database, and never written to the logs.

Files

• Private server disk or private storage (no public access): each file is served only after checking access, through a signed link that expires after 10 minutes. Direct uploads to storage use a signed address valid for 30 minutes, and the server checks size and type before accepting the file.
• Exports are kept on the server's disk, never in the shared storage, can only be downloaded by whoever asked for them and are deleted after 48 hours.

Continuity

• Periodic backups of the database and the files, in the same region as the server, kept for 30 days.
• Zero-downtime deployments; migrations are prepared so the previous version keeps working during the switch.

Organisation

• Every change goes through review and the project's test suites before reaching production: continuous integration runs the server's on every change, and a person runs the browser's and the extension's before each deploy.
• Only the people who run Boolu access the production server, with personal SSH keys, and they are bound to confidentiality.

Annex III. Sub-processors