This data processing agreement ("DPA") is between you, the business using naits (the controller), and Sapply AS, Norway, org. no. 935 038 278 (the processor). It is part of our terms of service and follows article 28 of the General Data Protection Regulation (GDPR). It applies from the day you start using naits.

1. Subject, nature and purpose

We process personal data only to provide naits to you: to store and send your agreements, let your clients review and sign them, request and register payments, create and deliver invoices and e-invoices, and send reminders.

2. Duration

For as long as you use naits, and until the data is deleted or returned under section 10.

3. Types of personal data

Names, e-mail addresses, company names, org. numbers, addresses and titles of your clients and their contacts; signature data (typed name, time, time zone, IP address, device / browser information, document fingerprint); hashed signing codes; payment status; content of agreements and invoices that you enter.

4. Data subjects

Your clients and their contact persons, and other people named in your agreements and invoices.

5. Your instructions

We process the data only on your documented instructions. Your use of naits and its settings, together with this DPA, are your instructions. If we believe an instruction breaks data protection law, we'll tell you. We only process data for other purposes when the law requires it, and then we'll tell you unless the law forbids it.

6. Confidentiality

Everyone at Sapply AS who can access the data is bound by confidentiality.

7. Security (GDPR article 32)

We use appropriate technical and organisational measures, including:

  • encryption in transit (HTTPS) and encrypted storage at our hosting provider;
  • strict separation between workspaces in the database, so one customer can't read another's data;
  • private file storage, shown only through short-lived signed links;
  • signing codes stored only as hashes, with limited attempts and expiry;
  • access to production data limited to the people who need it.

8. Sub-processors

You give us general permission to use sub-processors. The current list is:

  • Lovable — runs the naits application and its server functions (on Cloudflare's global network) and sends our e-mails (sign-in, agreements, signing codes, invoices, reminders).
  • Supabase — database, sign-in and file storage (agreements, signed PDFs, invoices). Hosted in the EU (Ireland).
  • Stripe — card and bank payments into the seller's own Stripe account, and payments for naits subscriptions.
  • Paddle — may be used to bill naits subscriptions.
  • Storecove — Peppol access point that delivers EHF / Peppol e-invoices.
  • Anthropic (through Lovable's AI gateway) — the optional AI agreement check and AI writing help. The agreement text you send for a check can include names and company details.

We'll tell you at least 30 days before we add or replace a sub-processor, so you can object. If you object on reasonable grounds and we can't solve it, you can end the agreement. We put the same data protection obligations on every sub-processor, and we remain responsible for them. Transfers outside the EU/EEA rely on adequacy decisions or the EU standard contractual clauses.

9. Helping you

We help you, as far as we reasonably can, to answer requests from data subjects (access, correction, deletion and so on), and with security, breach notifications, impact assessments and prior consultation (GDPR articles 32–36).

Personal data breaches: we'll tell you without undue delay, and no later than 48 hours after we become aware of a breach that affects your data, with the information we have.

10. When the agreement ends

When you close your account, we delete your clients' personal data within 90 days, unless you ask us to return it first or the law requires us to keep it. You can export agreements and invoices before you close the account.

11. Audits

We make available the information you need to show that we follow this DPA, and allow audits by you or an auditor you choose, with reasonable notice and at your cost.

12. Liability and law

The limits of liability in our terms apply to this DPA, unless the law says otherwise. Norwegian law applies.

Contact for this DPA: privacy@sapply.io.