Data Processing Agreement
Last updated June 2026
1. Scope
This Data Processing Agreement applies to enterprise clients and governs personal data processed by CleyflowAI.
2. Roles
Client acts as data controller. CleyflowAI acts as data processor.
3. Security Measures
AES-256 encryption at rest, TLS 1.3 in transit, role-based access controls, audit logging.
4. Sub-Processors
Supabase (database), Meta (channel APIs), Anthropic Claude (AI processing). Full list available on request.
5. Data Breach Notification
CleyflowAI will notify clients within 72 hours of becoming aware of any personal data breach.
6. Data Subject Rights
We will assist clients in fulfilling data subject access, deletion and correction requests.
7. Return or Deletion
On termination, data is returned or deleted within 60 days per client instruction.
8. Contact
For DPA questions: cleyflowai@gmail.com or +254702161933