Add to Chrome
Legal

Data Processing Addendum

Last updated July 15, 2026

Data Processing Addendum (DPA)

This Data Processing Addendum (“DPA”) forms part of the agreement between Zoy (“Processor”, “we”) and the customer (“Controller”, “you”) for the use of the InTab service. It applies whenever you, as a Controller, use InTab to process personal data of individuals in the European Economic Area (EEA), the United Kingdom, or other jurisdictions where similar data-protection laws apply.

Need a signed copy for your records? Email help@intab.io with your company name and we’ll send a counter-signed PDF within one business day.

1. Definitions

Terms not defined here have the meaning given in the EU General Data Protection Regulation (GDPR) and the UK GDPR.

  • Personal Data - any information about an identified or identifiable natural person processed by us on your behalf in the course of providing the Service.
  • Sub-Processor - any third party we engage to process Personal Data on your behalf.

2. Scope and roles

You are the Controller; we are the Processor. We process Personal Data only on your documented instructions, including with regard to transfers of Personal Data to a third country or an international organization, unless required to do so by law.

3. Categories of data and data subjects

  • Categories of data: account profile (email, name, encrypted password or Google identifier), product preferences, saved tab sessions, highlights and notes you store with us, anonymized feature-usage events (if you’ve kept analytics on).
  • Categories of data subjects: individual users of the InTab service authorized by you.

4. Confidentiality

We ensure that personnel authorized to process Personal Data are subject to appropriate confidentiality obligations.

5. Security

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

  • Encryption in transit (TLS 1.2+) and at rest.
  • Scoped access tokens; no long-lived production credentials on developer laptops.
  • Least-privilege access controls; audit logs for production data access.
  • Annual review of vendor security posture for all Sub-Processors.

6. Sub-Processors

We use the following Sub-Processors. We notify you (via the changelog or by email if you’ve signed up for our updates list) at least 30 days before adding any new Sub-Processor that materially changes data flow:

  • Cloudflare, Inc. - application hosting, database (D1), object storage (R2), queues. Regions: EU + global edge.
  • Groq, Inc. - AI text generation and speech-to-text. Used only when you invoke an InTab AI feature.
  • ElevenLabs, Inc. - text-to-speech. Used only when you invoke the “Listen” feature.
  • Paddle.com Market Limited - payments processing (merchant of record).
  • Amazon Web Services, Inc. (AWS SES) - transactional email delivery.
  • PostHog, Inc. - product analytics. On by default; honoring the opt-out described in our Cookie Policy.
  • Google LLC (Google Analytics 4) - anonymous analytics. On by default; honoring the opt-out described in our Cookie Policy.
  • Advertising measurement recipients (intab.io website only) - Google Ads (Google LLC), Meta Platforms, Inc., Microsoft Corporation (Microsoft Advertising), X Corp. (X Ads), TikTok Inc., Snap Inc., Pinterest, Inc., Reddit, Inc., and Quora, Inc. receive conversion events and hashed conversion identifiers from the intab.io website for ad-campaign measurement. They act as independent controllers of that data (not Sub-Processors of extension or account content) and never receive data from inside the extension. Visitors can opt out via the Cookie Policy controls.

7. International transfers

Where Personal Data is transferred outside the EEA / UK, the transfer is covered by the European Commission’s Standard Contractual Clauses (Module 2: Controller to Processor), incorporated here by reference, and any additional safeguards required by applicable supervisory authorities.

8. Data-subject requests

If we receive a request from a data subject (right of access, rectification, deletion, restriction, portability, objection), we will:

  • Promptly notify you.
  • Not respond to the request ourselves except on your documented instructions or as required by law.
  • Provide reasonable assistance, taking into account the nature of the processing, for you to respond.

9. Personal data breaches

We will notify you without undue delay (and in any case within 48 hours) after becoming aware of a Personal Data breach affecting Personal Data we process on your behalf. The notice will include the information required by GDPR Article 33(3).

10. Audits

You may, on reasonable prior written notice (not more than once per year, unless required after a Personal Data breach), and at your expense, audit our compliance with this DPA. Most audit obligations are discharged by our then-current security documentation, which we make available on request.

11. Deletion or return of data

On termination of the agreement, at your option, we will delete or return all Personal Data we process on your behalf, except where law requires retention. Standard deletion timeline is 30 days from termination.

12. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions of liability set out in our Terms of Service.

13. Contact

For privacy / DPA matters: help@intab.io. Mark your email “DPA” so we route it to the right person.