Data Processing Agreement
Draft — last updated 22 July 2026.
Draft — this text is under review and does not yet form a binding legal document.
Roles of the parties
For personal data contained in the projects and files your organisation places in Asads, your organisation is the data user (controller) — it decides what is uploaded and why — and Asads acts as the data processor, processing that data only to deliver the service and on your documented instructions. For the account and billing records of registered users, Asads is itself the data user.
Scope of processing
Processing covers the data your team places in the platform: account and member details, uploaded drawings and door schedules, project and questionnaire data, generated schedules and specification documents, and related messages. Its purpose is hosting, automated document analysis, schedule and document generation, supplier matching and communication, and billing. Processing lasts for the term of your subscription plus the retention and deletion windows described in the Privacy Policy.
Sub-processors
We use a small set of service providers to run Asads: Vercel (application hosting), Neon (database), Cloudflare (file storage), Clerk (sign-in and identity), Google Cloud (document analysis and cloud computing), Stripe (payments), Resend (transactional email), Pusher (in-app realtime updates), Upstash (request rate limiting) and Sentry (error monitoring). Each processes data only for the purpose listed, under its own data-protection commitments. This list will be updated when providers change.
Security measures
Tenant data is isolated by design: access is scoped to your organisation at sign-in, scoped again by the application on every query, and enforced a third time by row-level security in the database itself. Data is encrypted in transit and at rest. Administrator access on our side follows least privilege; sensitive administrative actions require you to re-verify your identity immediately beforehand, and are recorded in an access log. Uploaded original files are permanently deleted within about two hours of upload.
International transfers
Our providers operate cloud infrastructure that may be located outside Hong Kong, including in the United States. Where personal data is processed outside Hong Kong it remains subject to the commitments in this agreement and to each provider’s own contractual data-protection commitments, and we will provide reasonable information to support your own compliance assessments.
Contact us
For questions about data processing, or to request a countersigned copy of this agreement for your records, contact us through the contact form on this site.