Data processing agreement
Last updated: 28 October 2026
Version 2026-10-28. Between Laivo and an organisation on Laivo’s Organization plan (“the organisation”), accepted in Laivo by the organisation’s owner. Laivo processes the organisation’s personal data for it, as its processor.
1. Instructions
Laivo processes the organisation’s data only to run Laivo for it, as the organisation and its people use it, and as this agreement says. If the law asks Laivo to do anything else, Laivo tells the organisation first, unless the law forbids it.
2. Purpose and kinds of data
The purpose is to let the organisation’s people make, keep and share designs. The data is the people’s names and emails, their designs and the photos, videos, fonts and files in them, and the organisation’s brand kit. The people are the organisation’s owner, admins and members.
3. No AI training
Neither Laivo nor any service it uses trains AI on the organisation’s data. Something is sent to an AI service only when a person presses an AI tool, and only what that tool needs.
4. Confidentiality
Only Laivo’s operator can reach the organisation’s data, and only to run or fix Laivo or to answer the organisation. They keep it confidential.
5. Security
Data travels encrypted, is stored with Cloudflare, and every request is checked against the person’s account and role. Laivo keeps these measures up to date.
6. Sub-processors
The services Laivo uses are listed on Where your data lives. Laivo tells the organisation in the app 30 days before it adds or replaces one. The organisation may object; if Laivo can’t meet the objection, the organisation may leave and gets a refund for the unused part of its plan.
7. Helping with requests
Laivo helps the organisation answer its people’s requests to see, correct or delete their data, within 45 days under Omani law, or 30 days for people in Saudi Arabia.
8. Breaches
If the organisation’s data is exposed, Laivo tells the organisation’s owner within 48 hours of finding out, with what happened, what data and people it touches, and what Laivo is doing about it.
9. Records
Laivo keeps a record of what it does with the organisation’s data and of any breach, and shares it with the organisation on request.
10. Transfers abroad
The data is stored and processed outside Oman by the services on Where your data lives. Laivo uses only services that protect it at least as well as this agreement does, and each person agrees to this transfer when they join.
11. When the plan ends
When the plan ends, the organisation’s work can be read and downloaded as a ZIP for 6 months; when the owner closes the organisation, it can be undone for 30 days. Then the data is deleted, and it is gone from backups within 30 days more.
12. Law
This agreement follows the law of the Sultanate of Oman, including its Personal Data Protection Law.
Contact: support@laivo.dev