Overplay
Overplay
Data Processing Addendum
Last updated 20 October 2026
This Data Processing Addendum ("DPA") is part of the Terms of Service between Overplay (FOP Svitelskyi Artem, an individual entrepreneur registered in Ukraine) and each customer that uses Overplay Cloud for a business and owns a project ("Customer"). It applies automatically when Overplay processes personal data in Customer's projects that is subject to the EU or UK GDPR, the Swiss data protection law, or US state privacy laws such as the CCPA. No signature is needed. If you need a signed copy, email a.svitelskyi@gmail.com.
1. Roles
Customer is the controller (or a processor for its own client) of personal data in its projects ("Customer Data"). Overplay is the processor (or sub-processor) and, under US state laws, the service provider. For account, billing and security data, Overplay is a separate controller, as the Privacy Notice explains.
2. Details of the processing
| Subject matter and purpose | Hosting and showing website feedback for Customer's projects, and the features Customer turns on: notifications, push, integrations, element snapshots and AI agent access |
|---|---|
| Duration | While Customer uses the service, then until deletion as section 9 says |
| Nature | Storage, display, transmission, search, export and deletion |
| Data subjects | Customer's project members and invited people; people whose information appears on the pages that Customer reviews |
| Categories of data | Names, email addresses, profile pictures, comments and replies, page addresses and titles, element names, element snapshots, activity records |
| Special categories | None intended. Customer must not put special category data in projects and should mark private page areas with data-overplay-private |
3. Customer's instructions
Overplay processes Customer Data only on Customer's documented instructions. These terms, the project settings and Customer's use of the service are those instructions. Overplay tells Customer if it believes an instruction breaks data protection law, and processes Customer Data otherwise only when the law requires it, after telling Customer where the law allows.
Under US state privacy laws, Overplay will not sell or share Customer Data, will not keep, use or disclose it for any purpose other than providing the service, will not use it outside the direct business relationship with Customer, and will not combine it with personal information from other sources except as the law permits. Overplay tells Customer if it can no longer meet these duties, and Customer may then take reasonable steps to stop unauthorized use.
4. Confidentiality
Everyone who can access Customer Data for Overplay is bound by confidentiality and accesses it only when needed to run, support or protect the service.
5. Security measures
- HTTPS (TLS) for all connections, with HSTS and a strict Content Security Policy on the website.
- Passwords hashed with scrypt; session, email-link and agent tokens stored only as SHA-256 hashes.
- Optional two-factor authentication with TOTP and hashed recovery codes.
- Access checks on every request, by project membership, role, allowed website and agent permissions.
- Integration tokens and webhook addresses encrypted with AES-256-GCM.
- Snapshots leave out the widget, password, card and one-time code fields, and elements marked private.
- Rate limits, origin checks against cross-site requests, and audit logs for project changes and agent actions.
- Short retention: expired sessions and links removed daily, snapshots after 90 days, database recovery copies after 30 days.
- Hosting on Cloudflare's infrastructure, which holds ISO 27001 and SOC 2 Type II reports.
Overplay may improve these measures, but will not lower the overall level of protection.
6. Sub-processors
Customer gives general authorization for the sub-processors below. Overplay binds each one by a written contract with data protection duties at least as strict as this DPA, and stays responsible for them.
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, snapshot storage, email sending, security | Global network, USA |
| Google LLC | Firebase Cloud Messaging for push notifications to Android phones | USA |
| Apple Inc. | Apple Push Notification service for push notifications to iPhones | USA |
Services that Customer connects itself (Slack, GitHub, Linear, Jira, webhooks, AI agents) are not Overplay's sub-processors; Customer chooses them and its own terms with them apply. Paddle acts as an independent controller and merchant of record for billing.
Overplay announces a new sub-processor on this page and by email to project owners at least 30 days before it starts. Customer may object on reasonable data protection grounds within that time. If we cannot solve the objection, Customer may end the affected service and get a refund of any prepaid fees for the remaining period.
7. Help with requests and assessments
The service lets Customer find, export, correct and delete Customer Data. Overplay helps Customer with other data subject requests, data protection impact assessments and consultations with authorities, taking into account the nature of the processing. If Overplay receives a request about Customer Data directly, it sends the person to Customer.
8. Personal data breaches
Overplay tells Customer without undue delay, and in any case within 48 hours after becoming aware, of a personal data breach that affects Customer Data. The notice describes what happened, the data and people affected, the likely consequences and the steps taken, as far as known, and Overplay adds more information as it learns it.
9. Return and deletion
Customer can export project data at any time. When Customer deletes a project or its account, Overplay deletes the Customer Data at once from the live database. Recovery copies expire within 30 days, unless the law requires Overplay to keep data longer.
10. Information and audits
Overplay makes available the information needed to show compliance with this DPA, including this page, the Security page and its providers' certifications. If that is not enough, Customer may audit once a year, with 30 days' notice, at its own cost, through an independent auditor bound by confidentiality, in a way that does not harm other customers or the security of the service.
11. International transfers
Where Customer Data moves from the EEA, the UK or Switzerland to a country without an adequacy decision, the parties agree to the European Commission's Standard Contractual Clauses (Decision 2021/914), Module 2 (controller to processor) or Module 3 (processor to processor), which are included in this DPA by reference, with the UK International Data Transfer Addendum and the Swiss amendments where needed. For the clauses: clause 7 applies, clause 9 option 2 applies with the notice period in section 6, clause 11 optional language does not apply, clause 17 and 18 choose the law and courts of Ireland, and the annexes are filled in by sections 2, 5 and 6 of this DPA. Overplay's sub-processors use the EU-US Data Privacy Framework or Standard Contractual Clauses.
12. General
Liability under this DPA follows the limits in the Terms of Service, as far as the law allows. If this DPA and the Terms disagree about personal data, this DPA wins; the Standard Contractual Clauses win over both. Overplay may update this DPA to follow the law or a change of sub-processors, with notice as section 6 says.