Data Processing Agreement (Zero-Storage DPA)
This Data Processing Agreement (“DPA”) governs the processing of Customer Personal Data in connection with Utilvo’s web utility platform. Because Utilvo processes data exclusively within the client-side browser runtime, this agreement provides enterprise teams with contractual proof of zero remote processing.
Zero-Knowledge Enterprise Guarantee
For the purposes of GDPR (Article 28), UK GDPR, and CCPA/CPRA, Utilvo warrants that it does not act as a remote data processor of your files. Customer documents remain under the sole custody and physical control of the user's local workstation at all times.
1. Scope and Architectural Framework
This DPA supplements the Utilvo Master Terms of Service. It applies to any business, institution, or individual customer subject to European Data Protection Legislation (Regulation (EU) 2016/679 or UK GDPR) who utilizes Utilvo for document transformation, PDF manipulation, OCR extraction, or data calculation.
2. Definitions
- “Customer Data”: Any electronic data, files, PDF documents, raster/vector images, text records, or code snippets submitted by the Customer to a Utilvo tool interface.
- “Client-Side Runtime”: The local web browser environment (including CPU, GPU, and RAM) executing compiled WebAssembly, WebGL, and JavaScript within the Customer's physical device sandbox.
- “Zero-Storage Architecture”: The technical model wherein no Customer Data is ingested, transmitted across external networks, or retained on servers operated by Utilvo or its vendors.
3. Processing Operations & Customer Data Safeguards
Utilvo covenants and warrants as follows:
- No Ingestion: Utilvo shall not transfer Customer Data to any central server, cloud storage bucket, or remote processing pipeline.
- No AI Model Training: Utilvo does not ingest, harvest, or aggregate Customer Data to train, fine-tune, or calibrate artificial intelligence models or machine-learning weights.
- Immediate Memory Purge: When the Customer navigates away or terminates their browser session, all buffers holding Customer Data in volatile memory are unlinked and subject to operating system garbage collection.
4. Technical & Organizational Security Measures (TOMs)
To protect the integrity of the delivery pipeline, Utilvo maintains robust organizational and technical controls:
- TLS 1.3 Transport Security: All static code assets are served strictly over HTTPS with modern cipher suites and HSTS enabled.
- Strict Content Security Policy (CSP): Utilvo enforces a restrictive CSP header preventing unauthorized third-party script injection and restricting network calls.
- Integrity Verification: Static WebAssembly binaries are delivered with Subresource Integrity (SRI) hashes and strict versioning.
5. Sub-Processors
Because Utilvo does not transmit Customer Data to any backend processing service, Utilvo utilizes zero data-processing sub-processors. Utilvo engages only edge content delivery network (CDN) providers (e.g. Cloudflare) strictly to cache and deliver static web application assets (HTML, CSS, compiled JS, and WASM binaries) to the Customer's browser.
6. Data Subject Rights & Audits
Since Customer Data is never retained on Utilvo infrastructure, Data Subject requests (such as access, rectification, portability, or erasure under GDPR Articles 15-22) are fully exercised directly by the Customer on their local workstation. There is no central server registry or database to query or delete from.
7. Governing Law & Execution
This DPA is incorporated into the Master Terms of Service. By accessing or using Utilvo, you confirm that your organization has reviewed and accepted these terms. For custom enterprise legal execution, contact [email protected].