Data processing agreement

Last updated: 25 September 2026

This is the template we sign with customers on the Compliance plan, and on request on any paid plan. It is published so your legal team can read it before you buy. The signed version may be adapted to your jurisdiction. To sign, write to support@sahifa.dev.

Download as PDFتنزيل النسخة العربية (PDF)

1. Parties and roles

This agreement is between the customer named in the signed copy (the controller) and Yimello LLC, UAE Business Center, Al Messaned, United Arab Emirates, Trade License 243080201, operator of Sahifa (the processor). It forms part of the Terms & Conditions and applies whenever the processor processes personal data on the controller's behalf through the Sahifa API.

2. Subject matter and duration

The processor converts HTML and web pages into PDF documents and images at the controller's request. The agreement lasts as long as the controller uses the service, and the obligations on deletion and confidentiality continue after it ends.

3. Nature and purpose of the processing

Each request is processed in memory on a server in Jeddah, Saudi Arabia, only to produce the file requested. The result is returned in the same response. Content and results are not written to disk, logged, backed up or used for any other purpose.

4. Types of personal data and data subjects

Any personal data the controller places in the HTML, web addresses or settings it sends, such as the names, contact details and transaction data of the controller's own customers. For the account itself: the email address and, if given, the company name of the controller's users.

5. Obligations of the processor

• Process personal data only on the controller's documented instructions, which are the API requests themselves and this agreement.
• Make sure everyone with access to the service is bound by confidentiality.
• Apply the technical and organisational measures in Annex 1, and keep them at least at that level.
• Help the controller meet its obligations on security, breach notification, data protection impact assessments and requests from data subjects, as far as the nature of the processing allows.
• Tell the controller if an instruction appears to break applicable data protection law.

6. Location of processing

Content sent to the API is processed only in Saudi Arabia. Where each part of the service runs is described in the data residency statement. The processor will not move the processing of API content outside Saudi Arabia without the controller's written consent.

7. Sub-processors

The controller authorises the sub-processors in Annex 2. The processor will announce a new sub-processor at least 30 days in advance; the controller may object on reasonable data protection grounds and, if no solution is found, end the service with a pro-rata refund of prepaid fees. The processor imposes data protection obligations on each sub-processor equivalent to those in this agreement.

8. Personal data breaches

The processor will notify the controller without undue delay, and in any case within 48 hours of becoming aware of a breach affecting the controller's personal data. The notice will describe what happened, the data and people likely affected, the likely consequences and the measures taken. This allows the controller to meet the 72-hour notification period of the Saudi Personal Data Protection Law.

9. Requests from data subjects

Because API content is not kept, there is nothing to access, correct or delete after a request has been answered. For account data, the processor will act on the controller's instructions within 14 days.

10. Deletion at the end of the service

When the account is deleted, account data is removed from the live system at once and from backups within 35 days, when the last backup containing it expires. Records the processor must keep for tax or accounting purposes are kept only as long as the law requires.

11. Audits

The processor will make available the information needed to show compliance with this agreement, including this template, the data residency statement and a description of the security measures, and will answer reasonable written questionnaires once a year. On-site audits are possible by separate agreement, at the controller's cost and with 30 days' notice.

12. Liability and precedence

Liability under this agreement is subject to the limits in the Terms & Conditions. If this agreement and the Terms & Conditions conflict on data protection, this agreement prevails. The governing law and courts are those stated in the signed copy.

Annex 1: technical and organisational measures

• Encryption in transit: the API and the website are served only over HTTPS.
• No retention of content: request content and results stay in memory and are discarded after the response. Logs record only the method, the path without parameters, the status and the duration.
• Isolation: every request runs in a separate browser context that is discarded afterwards. The browser runs in an operating system sandbox, as an unprivileged user, and receives no secrets in its environment.
• Network restriction: the rendering service cannot reach private networks, the cloud metadata service or the server itself, including through redirects.
• Access control: the server accepts administrative access only with SSH keys; repeated failed attempts are blocked. API keys, sign-in links and sessions are stored only as fingerprints (hashes).
• Backups: the account database is backed up daily within the Jeddah region, encrypted before upload with a key not kept on the server, protected from deletion for 14 days and removed after 35 days.
• Maintenance: operating system security updates are applied automatically; the browser engine is updated at least monthly, and at once for critical security fixes.
• Availability: the service is checked every minute on the server and restarted automatically if it stops responding, and is also monitored from outside.

Annex 2: sub-processors