Data processing addendum
DPA, in plain words.
Effective August 30, 2026. This addendum applies when your team stores personal data in a Memava vault and forms part of the terms. A countersigned copy is included with Office and Enterprise plans; ask through the form.
Roles
Your team is the controller of whatever personal data it puts in its vault. Memava (Avihay Zanetti, Israel) is the processor, and processes that data only to provide the service described in the terms.
What we commit to
- Instructions only. Vault content is processed solely to host, sync, back up, and display it as your access rules direct. No other use.
- Confidentiality. The people who can touch production are bound to confidentiality, and structurally there is one operator.
- Security. Per-team isolated instances, encryption in transit, single-use sign-in links, one access evaluator behind every door, owner-only private trees, attributed history, daily backups, and continuous health monitoring.
- Subprocessors. Exactly those listed in the privacy policy (infrastructure, email delivery, the AI model providers named in the privacy policy for the Chief of Staff, the payment merchant of record, and website analytics on the marketing pages: Microsoft Clarity, only for visitors who accept the notice, and never inside a vault). Changes are posted there with 30 days' notice, and you may object on reasonable grounds.
- Breach notice. If a breach affects your vault, the admin contact is notified without undue delay and within 72 hours of us knowing, with what we know and what we are doing.
- Assistance. We help you answer data-subject requests that touch vault content, which is easy, because your vault is readable, searchable, and exportable by you at any time.
- Deletion. On termination, you export freely; on your instruction we delete the vault and its backups within 30 days and confirm in writing.
- Transfers. Vaults are hosted in the United States (our infrastructure subprocessor's Ashburn, Virginia data center). For customers in the EU or UK: your data reaches us under the EU adequacy decision for Israel, and the United States hosting leg is covered by the EU Standard Contractual Clauses in our subprocessor agreement. Countersigned transfer terms are available on request.