Data Processing Agreement

Version 2026-10-24.4

This DPA forms part of the Terms of Service between the customer ("Controller") and WANG PENG YUAN, an individual business operator in Japan trading as Hibira ("Processor"). It applies when the Processor processes personal data in Customer Data on the Controller's behalf. Where it conflicts with the Terms, this DPA prevails.

1. Scope of processing

2. Processor obligations

The Processor will:

1. process the data only on the Controller's documented instructions, which are the Terms, this DPA and the Controller's configuration of the Service, and tell the Controller if it believes an instruction breaks the law;
2. make sure staff with access are bound by confidentiality;
3. apply the security measures in Annex A;
4. help the Controller, as far as reasonably possible, respond to data subject requests and carry out impact assessments and prior consultations;
5. make available the information needed to show compliance, and allow audits as set out in section 7.

3. Controller obligations

The Controller is responsible for having a lawful basis, giving notices to its end users, and the accuracy and lawfulness of the data it sends. It must keep its app secrets confidential and use private or encrypted channels for sensitive data.

4. Sub-processors

1. The Controller authorises the sub-processors listed at hibira.io/legal/subprocessors (Annex B).
2. The Processor will give at least 30 days' notice of a new sub-processor by email and on that page. The Controller may object on reasonable data protection grounds; if the parties cannot resolve it, the Controller may terminate the affected Service and receive a pro-rata refund.
3. The Processor binds each sub-processor to data protection terms no less protective than this DPA and remains liable for its performance.

5. International transfers

The Processor is based in Japan and processes data in Hong Kong (AWS ap-east-1) and Singapore (Neon, on AWS ap-southeast-1); Cloudflare's network may route connections through the nearest edge location. Where a transfer needs a safeguard, the parties agree to the EU Standard Contractual Clauses (Module 2 or 3 as applicable), the UK Addendum, or the equivalent contract required by the law of the Controller's country (for example Korea's PIPA standard contract or China's PIPL standard contract), which are incorporated by reference.

6. Personal data breaches

The Processor will notify the Controller without undue delay and in any case within 48 hours of becoming aware of a personal data breach affecting the Controller's data. The notice will describe the nature of the breach, the data and subjects affected where known, likely consequences, and measures taken. This lets the Controller meet its own deadlines, such as 72 hours under GDPR, prompt reporting under Japan's APPI and Korea's PIPA, and Taiwan's notification duty.

7. Audits

The Processor will answer reasonable security questionnaires and share third-party audit reports or certifications when available. If those are not enough to show compliance, the Controller may carry out an audit once a year, at its own cost, with 30 days' notice, during business hours, under confidentiality, and without access to other customers' data.

8. Return and deletion

On termination the Controller can export its account and app configuration for 30 days. The Processor then deletes remaining Controller data, including backups within 35 days, unless the law requires it to keep some.

9. Liability

Each party's liability under this DPA is subject to the limits in the Terms, except where the applicable data protection law does not allow it.

Annex A: Security measures

• TLS 1.2 or later for all client, API and webhook traffic; HMAC-signed API requests and private channel authorisation.
• App secrets and password hashes (Argon2id) never written to logs.
• Data stores encrypted at rest, reached only on private networks or over authenticated TLS connections; least-privilege staff access with multi-factor authentication.
• Rate limiting, per-app quotas and DDoS protection at the edge.
• Encrypted backups, monitoring and alerting, and an incident response procedure.
• Dependency updates and vulnerability fixes on a regular schedule.

Annex B: Sub-processors

Stripe, Google Analytics and Google Workspace (email) process only the Processor's own customer and website data, not Customer Data, so they are listed in the Privacy Policy rather than here.