DPPLogic legal
Privacy Notice
This notice explains what personal data the DPPLogic service processes, why, which providers process it for us, how long it is kept and how to exercise your rights. DPPLogic does not use advertising or analytics tracking, does not send marketing email and does not sell personal data.
1. Who we are
The DPPLogic service at https://pilot.dpplogic.com is operated by Ryan Jarvis trading as DPPLogic (“DPPLogic”, “we”, “us”), an individual trading as DPPLogic.
Privacy contact: support@dpplogic.com (monitored and handled by a person). Business correspondence address: Nanny Cay, Tortola, British Virgin Islands. That address is a correspondence location only. No Data Protection Officer has been appointed.
This notice covers the DPPLogic service: the workspace, sign-in and billing. The dpplogic.com website has its own privacy notice at https://dpplogic.com/privacy/.
UK and EU privacy duties that apply to personal data of people in those places are not removed because our contract is governed by the laws of the British Virgin Islands. Duties under the BVI Data Protection Act, 2021 that apply to processing in or from the Virgin Islands are likewise not removed by where a customer is located.
2. Our role
DPPLogic is the controller for account and sign-in data, billing records, support correspondence, and security and operational logs.
For personal data that customers enter into their workspace, such as supplier and manufacturer contacts, names in records and correspondence, and team member details as shown within the organisation, DPPLogic processes the data on the customer's behalf and on its instructions. The customer organisation is the controller and is responsible for having a lawful basis. See Supplier and business contacts below.
3. Personal data we process
Account and sign-in: your email address, whether it is verified, your WorkOS user identifier and a reference to your WorkOS sign-in session. DPPLogic does not receive or store your password. Any other details you give on the WorkOS sign-in pages are held by WorkOS.
Organisation membership: the organisations you belong to, your role and when you joined, and invitations you send or receive. An invitee's email address is stored only as a one-way hash until the invitation is accepted.
Sessions and security: a one-way hash of your session token and the session times, sign-in transaction records that expire after 10 minutes, and short-lived rate-limit counters keyed by your account identifier or, for checkout attempts made while signed out, your IP address. On secure response link pages, rate-limit counters are keyed by a hashed (pseudonymised) form of the IP address instead.
Activity and audit history: who created, changed, reviewed or exported records, and when; access events such as sign-in, invitations and membership changes; and billing events such as plan changes.
Workspace content: the information your organisation enters, which may include personal data such as names, job titles, email addresses and phone numbers of supplier and manufacturer contacts, and names in notes, correspondence records and evidence references.
Secure response links: when a customer creates a secure response link, DPPLogic stores a one-way hash of the link (never the link itself), who created it, when, its expiry and status, and how many times answers were sent through it. What a person sends through the link (answers, comments and source details) becomes workspace content of that customer, recorded with the time and the link it came through. No account, name or email address is requested from the person using the link. See If you received a secure response link below.
Billing: for paid plans, the Stripe customer, subscription and checkout identifiers, the plan, its status and billing period, and the email address passed to Stripe at checkout. Stripe collects your payment details directly; DPPLogic never receives full card numbers.
Support: emails you send to support@dpplogic.com and our replies.
Technical logs: Cloudflare, which hosts the service, records request information such as the time, the requested address, the response status and network details (which can include your IP address) to deliver and protect the service. DPPLogic's own error logs record error codes and route patterns only, not workspace content, identifiers or tokens.
Browser storage: see the Cookies notice (https://pilot.dpplogic.com/legal/cookies/).
DPPLogic does not use advertising, analytics or tracking cookies, does not build marketing profiles and does not send marketing email.
4. Why we use personal data and our legal bases
To create and secure accounts, sign you in and provide the workspace your organisation has requested: performance of our contract with your organisation, or steps necessary to provide the business service you asked for.
To process subscriptions, invoices and payments and keep accounting records: contract, plus legal obligations where they apply.
To answer support requests: contract and service administration.
To protect the service, prevent abuse and fraud, and keep audit history: our legitimate interests in operating a secure and trustworthy service. You may object where that right applies.
To process workspace content for a customer: the customer is responsible for the lawful basis. DPPLogic does not use its own basis for that processing.
Direct marketing: none.
5. Service providers (subprocessors)
We use the following providers to run the service. Each processes personal data to provide its service to DPPLogic.
Cloudflare, Inc.: hosts the application (Cloudflare Workers) and its database (Cloudflare D1), and delivers and protects web traffic. Processes all service data, including workspace content, account data and logs. The production database was created in Cloudflare's Western Europe (WEUR) region, where its primary copy is placed; this is a placement choice, not a contractual data-residency commitment. Requests are handled at the Cloudflare network location nearest the user. Privacy policy: https://www.cloudflare.com/privacypolicy/ . Data processing terms: https://www.cloudflare.com/cloudflare-customer-dpa/ .
WorkOS, Inc. (United States): provides the sign-up and sign-in pages, stores login credentials and manages sign-in sessions. Processes your email address, sign-in details and the technical information used to secure sign-in. Privacy policy: https://workos.com/legal/privacy . Data processing terms: https://workos.com/legal/data-processing-addendum .
Stripe (United States-based payment provider): processes subscription payments, invoices and payment methods. Processes the billing contact details and payment information you give at checkout. Privacy policy: https://stripe.com/privacy . Data processing terms: https://stripe.com/legal/dpa .
Google (Google Workspace): hosts the support@dpplogic.com mailbox. Processes emails you send to support. Privacy policy: https://policies.google.com/privacy .
No other provider receives service data. The DPPLogic service does not use AI providers, email-sending services or analytics providers.
This list will be updated before a new provider starts processing service data.
6. Other recipients
Members of your organisation can see the organisation's workspace content. Owners and admins can also see members' email addresses and roles.
Regulators, courts or professional advisers where legally required.
We do not sell personal data.
7. International transfers
DPPLogic is operated from the British Virgin Islands, and personal data may be accessed from there to operate and support the service.
Our providers may process personal data outside the UK and the European Economic Area. WorkOS and Stripe are based in the United States, and Cloudflare operates a global network. Each provider's data processing terms, linked above, describe the safeguards and transfer mechanisms that provider uses.
The laws of the British Virgin Islands that govern our contract do not replace UK or EU transfer rules that apply to personal data of people in those places.
8. How long we keep personal data
Accounts: kept while the account exists. When you delete your account in account settings, your email address, sessions and sign-in links are removed and your memberships end. Your account identifier stays in audit history, without your email address, so that past actions remain attributable within the organisation.
Your WorkOS sign-in identity is held by WorkOS. Deleting your DPPLogic account does not currently delete it automatically; email support@dpplogic.com if you want it deleted.
Organisations and workspace content: kept while the organisation exists, including after a paid subscription ends (the organisation moves to the Free plan). Organisation deletion is not yet self-service: an owner can request it at support@dpplogic.com, and requests are handled manually.
Revision and audit history: kept with the organisation for as long as the organisation exists.
Secure response links: the record of each link (its one-way hash, dates, status and number of submissions) is kept with the organisation's audit history. Answers sent through a link are workspace content. Rate-limit counters for link pages expire after 10 minutes and are cleared during later activity.
Sessions: a session ends after 30 minutes of inactivity and after 12 hours at most. Sign-in transaction records expire after 10 minutes, and rate-limit counters after their time window (between one minute and one hour). Expired records are cleared during later activity.
Billing records: kept for the period reasonably required for accounting, tax, dispute and legal obligations. Stripe keeps its own records under its terms.
Support correspondence: kept as reasonably required to support the relationship and meet legal obligations.
Logs: Cloudflare request logs are kept for a short period set by Cloudflare's logging service.
Backups: the database can be restored to any point in the previous 30 days, and a separate backup copy is refreshed periodically. Deleted data can therefore remain in backups for up to 30 days, or until the separate copy is next replaced.
9. Your rights
Depending on the BVI Data Protection Act, 2021 and, where they apply, UK GDPR or EU GDPR, you may have rights of access, rectification, erasure, restriction, objection and portability, and the right to complain to the BVI Office of the Information Commissioner, the UK Information Commissioner's Office (ICO) or another competent authority.
Self-service: in account settings you can download your account metadata (your account, memberships and recent account events) and delete your account. Members of an organisation can export its current records as JSON or CSV.
Other requests: email support@dpplogic.com. We handle requests manually and may need to confirm your identity. Requests about personal data in a customer's workspace, such as supplier contact details, may be referred to that customer organisation, which controls that data.
10. Supplier and business contacts
Customers can record contact details for people at their suppliers, manufacturers and other business partners: name, job title, department, email address, phone number, whether the person is the primary contact, and free-text notes. These people may also be named in correspondence records, requests and evidence notes.
The customer organisation decides what to record and why, and is the controller of that data. DPPLogic stores and displays it on the customer's behalf. Contact details are visible only to members of that customer's organisation.
DPPLogic does not contact suppliers or other business contacts, does not send them email, and does not give them accounts or access to the customer's workspace. Any request to a supplier is sent by the customer, outside DPPLogic. On Professional and Business, the customer can share a secure response link with a supplier: whoever has the link can see that one request (the customer's organisation name, the supplier's name, the request reference, the products concerned, the requested items still open and the customer's message) and send answers, until the link expires or is revoked, and only while the request is open and the customer's plan includes secure links.
Customers can correct contact details in the workspace. Contacts cannot yet be removed by customers in the workspace, and earlier values remain in the record's revision history. To have a contact's details erased, the customer can email support@dpplogic.com and we will act on its instructions.
If you are a supplier or business contact and want to exercise your rights, please contact the business that recorded your details. You can also email support@dpplogic.com, and we will pass your request to that business.
11. If you received a secure response link
A secure response link is created and shared by a DPPLogic customer (the business that asked you for information), not by DPPLogic. That business is the controller of what you send, and DPPLogic processes it on its behalf.
What the page shows you: the name of the business that sent the request, the supplier it was sent to, the request reference, the products concerned (name and the business's product reference), the information requested and whether each item has already been answered, the reply date and link expiry date, and the business's message. It shows nothing else from that business's workspace, and it never shows answers sent earlier; right after you send answers, your own browser shows you a copy of them, which DPPLogic does not send back.
What is recorded when you send answers: your answers, comments and the source details you enter (such as a document title, reference, issuer, date or web address), the time they were sent, and which link they came through. No account is created, and no name, email address or password is asked for. DPPLogic does not verify who uses a link.
Technical data: your IP address is not stored with your answers. A hashed (pseudonymised) form of it is used in rate-limit counters that expire after 10 minutes and are deleted during later activity, to limit repeated attempts; like other deleted data, they can remain in backups for up to 30 days. Cloudflare, which hosts the service, records request information, which can include your IP address, for a short period (see Technical logs above). The page keeps the link only in your browser tab's session storage so that reloading works; it is removed when you close the tab (see the Cookies notice). The page uses no analytics or tracking, and it tells your browser not to send its address to other sites.
How long it is kept: what you send is kept in the business's workspace for as long as the business keeps it, as part of its records and audit history (see How long we keep personal data).
Your rights: please contact the business that sent you the link. You can also email support@dpplogic.com, and we will pass your request to that business.
12. Security
We protect the service with measures including HTTPS-only access, secure session cookies, server-side tenant isolation and role checks, hashed session, invitation and response-link tokens, audit history, rate limits and signature-checked payment notifications. The full list is in the Data Processing Agreement (https://pilot.dpplogic.com/legal/dpa/#security).
No system is completely secure. DPPLogic does not hold ISO 27001, SOC 2 or similar certifications and does not guarantee security, zero data loss or uptime.
Report security concerns to support@dpplogic.com.
13. Business use
The service is offered to businesses and organisations, not consumers. It is not directed at children.
15. Changes to this notice
Material changes to this notice will be posted on this page, with 30 days' notice where reasonably practicable. Minor technical, legal-compliance or security corrections may be made without that full period.