Data Processing Agreement
When a firm directs the processing and Oculon carries it out, the roles have names: controller and processor. This agreement is what those names commit to — written to be read before it's signed.
Last updated · June 30, 2026
Parties and roles
The firm is the controller. It decides why personal data is processed — intake, qualification, record-keeping — and what the thresholds are.
Oculon is the processor. We process that data on the firm's documented instructions, to provide Iris. We don't decide the purpose; we carry it out. Where this agreement says 'instructions,' it means the firm's configuration, this document, and the Terms of Service together.
Subject matter and nature of processing
Processing covers the operation of Iris end to end: conducting intake conversations with prospective clients who contact the firm, structuring those conversations into summaries, scoring them against the firm's criteria, storing the records, delivering summaries and alerts to the firm, and presenting them in the dashboard.
The firm instructs; Oculon executes. Nothing outside that scope is processed at all.
Duration
This agreement runs with the firm's subscription: from account activation until termination of the Terms of Service — plus the window needed to complete deletion afterward, which ends no later than 30 days after termination.
Types of personal data
Contact details prospective clients volunteer — name, email, phone. The case facts they share. The full conversation content. Qualification scores and the reasons behind them. Timestamps.
Some conversations naturally touch on health — an injury description, a treatment history. Where that occurs, the data is processed under the firm's instruction and the security measures in section 06.
Sub-processors
The complete list, by name: Postmark (email delivery), Amazon Web Services (hosting, US regions), Amazon RDS (database), and Lemon Squeezy (billing — payment data only, no access to conversations).
Each is scoped to its job under a contract that imposes the same obligations this agreement imposes on us. Before adding or replacing a sub-processor, the list changes on the data-handling page and firm admins are notified. A firm that finds a new sub-processor unacceptable may terminate without penalty.
Security measures
Encryption in transit (TLS 1.3) and at rest (AES-256). Per-firm data isolation — no firm can access another's data, by setting or otherwise. Role-based internal access, logged. US-based hosting. Encrypted backups on a 30-day rotation.
These are described in detail on the security page, which is incorporated here by reference. If the controls change materially, this agreement changes with them.
Assistance with data subject rights
A person who shared information with a firm through Iris may ask that firm for access, correction, or deletion. The firm answers — the conversation is its record.
Oculon's role is assistance: retrieving, exporting, correcting, or deleting the records within 30 days of the firm's instruction, and providing the information a firm needs to respond substantively rather than generically.
Deletion on termination
When the agreement ends, the firm chooses: full deletion, or export first and deletion after. Either way, deletion is permanent and completes within 30 days — and the backup rotation ages out anything that remains.
Absent an instruction, the retention policy applies: transcripts expire at their window, and the rest of the record is deleted on request.
Governing law and execution
This agreement is governed by the laws of the State of Wyoming, USA, and is incorporated into the Terms of Service. A standalone version — suitable for signature and filing — is available to any firm on request, through your onboarding contact or the contact page.
Questions about this document go to privacy@oculonsystems.com. A person reads every message.
Need it signed?
The operational pages behind this agreement — data handling, retention, security — and where to request the signature copy.