Data Processing Agreement

Version 1.1 · Effective from October 18, 2026

This agreement is part of the Bitácora Terms and Conditions. It applies when you use Bitácora to store or process personal data about other people (your clients, their contacts, the people who visit your portal or receive your deliveries). You accept it when you accept the Terms, and it does not need to be signed separately. If you need a signed copy, write to us at hola@bitacora.live.

1. Who is who

• You (the “Customer”): the person or studio that holds the account and uses Bitácora for their work. For the data covered by this agreement, you are the controller: you decide what data you put into Bitácora and for what purpose.
• We: A.SMITH GROUP, EIRL, RNC 132654226, Calle Miguel A. Piantini, Ed. 73, #101, San Carlos, Distrito Nacional, Dominican Republic. We are the processor: we process that data only on your behalf and to provide you with the service.

This agreement does not cover the data of your own account or of people who use Bitácora with their own account (your team, for example): we are the controller of that data, and the Privacy Policy explains it.

The terms “personal data”, “processing”, “controller”, “processor”, “sub-processor” and “personal data breach” have the meaning given to them by the EU General Data Protection Regulation (GDPR) and Law 172-13 of the Dominican Republic. If the Customer is in Brazil or the data is subject to Law 13.709/2018 (LGPD), “controller” and “processor” have the meaning given to them by that law (“controlador” and “operador”).

2. What data we process on your behalf

The details are in Annex I. In short: the data about your clients and contacts that you keep in My clients, the data of people who open your portal or receive your deliveries (access links, visits, comments), and the personal data you include in your projects. We process it while you use the service and during the deletion periods in section 11.

Do not put special categories of data into Bitácora (health, political opinions, religion, sex life, biometric data, criminal records) or data about minors unless you have a clear legal basis for it. Bitácora is not designed for that data.

3. Your instructions

• We process the data only on your documented instructions. Your instructions are these Terms, this agreement, and what you configure and do in the app (for example, inviting someone to the portal, sending a delivery or deleting a person from My clients).
• If we believe an instruction of yours breaks data protection law, we tell you and may stop following it until it is clarified.
• We will only process the data in any other way if a law requires us to. In that case we will tell you first, unless the law forbids it.
• We do not use your data for our own purposes. We do not sell it or use it for advertising or to train artificial intelligence. If you record the amount of a project, we only use it added up with other people’s and anonymously, with no data that identifies your client or anyone else, as market data.

4. Your obligations

As controller, you:

• have a legal basis to process the data you put into Bitácora and to share it with us;
• inform those people that you use Bitácora, that you will see their visits and comments in the portal, and how to exercise their rights;
• answer their data subject requests (we help you, section 9);
• decide which AI tool you work with. The AI tool you connect through MCP or with your own API key is not our sub-processor: you choose it, and the content it reads goes through its provider under your own terms with that provider.

5. Confidentiality

The people who work for us and can access the data are bound by confidentiality. They only access a project’s content when needed to give you support at your request, to investigate a report or a security risk, or to comply with the law, and every access is logged with who, when and why.

6. Security

We apply the technical and organizational measures in Annex II, appropriate to the risk. We may improve them over time, but never lower their level of protection.

7. Sub-processors

• You give us a general authorization to use the sub-processors listed in Annex III, which we also publish on this page.
• Before adding or replacing a sub-processor, we notify you by email at least 30 days in advance and update the list.
• You can object on reasonable data protection grounds within that period by writing to hola@bitacora.live. If we cannot find a solution, you can terminate the contract without penalty and we refund the part you paid and have not used.
• We impose on each sub-processor, by contract, data protection obligations equivalent to those in this agreement, and we are liable to you for what it does.

8. International transfers

We provide the service from the Dominican Republic, with servers and providers in the United States (Annex III).

• If you are in the European Economic Area: transfers of your data to us are governed by the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914), Module 2 (controller to processor), which are incorporated into this agreement by reference, with these options: Clause 7 does not apply; Clause 9, Option 2 (general authorization, with the 30-day notice in section 7); Clause 11 without the independent dispute resolution body option; Clause 13, the supervisory authority of the EEA country where you are established; Clause 17, the law of Spain; Clause 18, the courts of Spain. Annexes I, II and III of this agreement serve as the annexes to those clauses, with you as data exporter and us as data importer.
• If you are in the United Kingdom or Switzerland: the UK International Data Transfer Addendum and the Swiss adaptations to those same clauses also apply.
• Our sub-processors in the United States are certified under the EU-US Data Privacy Framework or have signed standard contractual clauses (Module 3) with us, as shown in Annex III.
• If an authority requests your data from us, we act as the Privacy Policy describes: we review the request, hand over the minimum and tell you if the law allows.
• If this agreement and the standard contractual clauses conflict, the clauses prevail.

9. Help with data subject rights

• The app lets you view, correct, export and delete the data of your clients and visitors (My clients, the portal, Take your things).
• If a person writes to us to exercise their rights over data we process on your behalf, we forward the request to you within 5 business days at most and do not answer it ourselves unless you ask us to. If the person is in Brazil, we forward it within 3 business days at most, so that you can reply within the LGPD’s 15-day period.
• We help you with whatever you cannot do yourself from the app.

10. Personal data breaches

If we suffer a personal data breach affecting data we process on your behalf, we notify you without undue delay and within 48 hours at most of becoming aware of it, by email, with what we know at that moment: what happened, which data and people are affected (approximately), what the likely consequences are and what measures we have taken. We send you the rest of the information as soon as we have it, so that you can notify the authorities and the people affected if needed. If the incident affects data subject to the LGPD, we give you what you need to report it to the ANPD and to the people affected within the 3-business-day period of Resolution CD/ANPD 15/2024.

We also help you, with the information we have, with any data protection impact assessments and consultations with authorities you need to carry out.

11. On termination

• When the contract ends, or if you delete your account, you can download your data first (Take your things). If we close your account, you have at least 30 days to download it.
• After that we delete it. It disappears from our backups within 35 days at most.
• We only keep something if a law requires us to, and we block it until that obligation ends.

12. Demonstrating compliance and audits

• We give you the information needed to show that we comply with this agreement: answers to questionnaires, a description of the measures in Annex II, and our sub-processors’ reports or certifications.
• If that is not enough, you can carry out an audit, yourself or through an independent auditor bound by confidentiality, with 30 days’ notice, during business hours, at your cost and at most once a year, unless there has been a personal data breach or an authority requests it.

13. Liability and precedence

• Each party’s liability under this agreement is governed by the Terms, except where data protection law does not allow it to be limited.
• If this agreement and the Terms say different things about personal data, this agreement prevails. If there is a conflict with the standard contractual clauses, the clauses prevail.
• This agreement lasts as long as we process data on your behalf. We may update it with the notice in section 25 of the Terms.
• Apart from the standard contractual clauses (governed as stated in section 8), this agreement is governed by the same law as the Terms.

---

Annex I. Details of the processing

Annex II. Security measures

• Encryption: all connections encrypted (HTTPS); API keys encrypted on the server; passwords stored hashed; backups encrypted in transit.
• Separation: prototype content is served from a separate domain (bitacora.id) with signed links that expire; each space’s data is kept separate on the server.
• Access: users sign in with an email link or code, Google or a password, with additional verification for sensitive actions; operator access to the server and the admin panel with personal keys and additional verification; access to content is logged.
• Service protection: network protected against attacks by Cloudflare; request limits per IP and per account; audit log of sensitive actions kept for 365 days.
• Availability: nightly backups, stored on the server and in external storage, with tested restoration; version history for every screen.
• Minimization: dictation audio is deleted 30 days after each log is closed; errors are logged without IP addresses; automatic deletion periods (Annex I).
• Organization: access to the data only for the people who operate the service, bound by confidentiality; procedures for handling personal data breaches and data subject requests.

Annex III. Sub-processors

The following are not our sub-processors: the AI tool you connect through MCP or with your own key (you choose and contract it), Lemon Squeezy (it only processes your own payment data, as controller, never your clients’ data), and Pexels and Pixabay (they only receive the text of photo searches).