Legal

Data Processing Agreement (DPA)

Last Updated: March 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the user ("Customer", "Controller") and Metapher Media Labs, the owner and operator of Magpiie ("Processor", "Company").

This DPA governs the processing of Personal Data in connection with the use of Magpiie, a Software-as-a-Service platform available at https://magpiie.com.

This agreement ensures compliance with applicable data protection laws including:

General Data Protection Regulation (GDPR)
UK GDPR (where applicable)
California Consumer Privacy Act (CCPA)
California Privacy Rights Act (CPRA)
Other applicable data protection regulations

1. Parties

Data Controller (Customer)

The organization or individual using Magpiie who determines the purpose and means of processing personal data.

Data Processor (Company)

Metapher Media Labs, which processes personal data on behalf of the Customer in order to provide the Magpiie platform.

2. Purpose of Processing

The purpose of data processing under this DPA is to enable the functionality of the Magpiie platform, including:

Managing user accounts
Hosting and processing project data
Enabling draft and revision workflows
Supporting collaboration between users
Providing technical support
Processing subscription payments
Maintaining platform security and reliability

Personal data will only be processed to the extent necessary to provide these services.

3. Nature of Data Processing

Magpiie processes personal data in order to deliver SaaS services to customers. Processing activities may include:

Collection
Storage
Organization
Retrieval
Transmission
Deletion
Security monitoring

These operations are performed using secure cloud infrastructure and software systems.

4. Categories of Personal Data

Depending on how the customer uses the platform, Magpiie may process the following categories of personal data:

Account Information

Name
Email address
Organization name
Login credentials

Workspace Data

User activity logs
Collaboration comments
Project metadata
Uploaded files

Billing Information

Billing name
Billing address
Transaction details

Technical Data

IP address
Device information
Browser data
Usage logs

Magpiie does not intentionally collect sensitive personal data unless uploaded by users within their own content.

5. Categories of Data Subjects

The categories of individuals whose personal data may be processed include:

Customers using the Magpiie platform
Team members invited to workspaces
Enterprise client employees
Support contact persons
Website visitors

6. Duration of Processing

Personal data will be processed for the duration of the customer's use of Magpiie. Upon termination of services:

Customer data may be retained for a limited period for operational or legal reasons
Customers may request deletion of personal data
Data will be securely deleted or anonymized when no longer necessary

7. Obligations of the Data Processor

Metapher Media Labs agrees to:

Process personal data only on documented instructions from the Customer
Ensure staff handling personal data are bound by confidentiality obligations
Implement appropriate security measures
Assist the Customer in complying with data protection obligations
Notify the Customer of any data breaches without undue delay
Delete or return personal data upon termination of services when requested

8. Security Measures

Magpiie implements industry-standard security measures to protect personal data. These include:

Encryption of data in transit using HTTPS/TLS
Secure authentication mechanisms
Access control systems
Infrastructure monitoring
Role-based access permissions
Secure cloud hosting environments

These measures aim to protect against unauthorized access, disclosure, alteration, or destruction of personal data.

9. Sub-Processors

Magpiie may use third-party service providers ("Sub-Processors") to assist in delivering the platform. These may include providers of:

Cloud hosting infrastructure
Email delivery systems
Payment processing services
Security monitoring tools
Analytics services

Examples of payment sub-processors include:

Razorpay – subscription payment processing
PayPal – enterprise and international transactions
Payoneer – enterprise client payments
Banking institutions for direct transfers

Sub-processors are required to maintain adequate security and privacy protections consistent with this DPA.

10. International Data Transfers

Magpiie may process or store data in jurisdictions outside the Customer's country. Where personal data is transferred internationally, appropriate safeguards may be implemented including:

Standard Contractual Clauses (SCCs)
Secure infrastructure agreements
Data protection compliance procedures

These safeguards ensure personal data receives adequate protection under applicable law.

11. Data Subject Rights

Magpiie supports the Customer in responding to requests from data subjects exercising their rights under GDPR and other privacy regulations. These rights may include:

Right of access
Right to correction
Right to erasure
Right to restriction of processing
Right to data portability
Right to object to processing

Customers may contact Magpiie for assistance in fulfilling these requests.

12. Data Breach Notification

In the event of a confirmed personal data breach, Metapher Media Labs will:

Notify the Customer without undue delay
Provide information regarding the nature of the breach
Describe potential impact
Outline mitigation steps

This enables Customers to fulfill their own regulatory reporting obligations where necessary.

13. Assistance with Compliance

Magpiie will reasonably assist customers with compliance obligations related to:

Data protection impact assessments (DPIA)
Regulatory inquiries
Data subject requests
Security incident investigations

Such assistance may be provided to the extent required by applicable data protection laws.

14. CCPA / CPRA Compliance

For the purposes of the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), Metapher Media Labs acts as a Service Provider processing personal information on behalf of customers.

Under this role:

Personal data is processed solely to provide services to the customer
Personal information is not sold
Personal data is not used for unrelated commercial purposes

Customers retain control over the personal data they submit to the platform.

15. Confidentiality

Metapher Media Labs ensures that employees and contractors with access to personal data are bound by confidentiality obligations and trained in appropriate data protection practices.

16. Data Deletion or Return

Upon termination of services or at the Customer's request:

Personal data may be deleted from active systems
Data may be returned to the Customer where technically feasible
Backup data will be securely removed according to retention schedules

17. Changes to this DPA

Metapher Media Labs may update this Data Processing Agreement periodically to reflect:

Changes in legal requirements
Updates to the Magpiie platform
Improvements to security or privacy practices

The updated version will be published on https://magpiie.com with a revised "Last Updated" date.

18. Governing Law

This DPA shall be governed by and interpreted in accordance with the laws applicable under the Terms of Service of Magpiie, unless otherwise required by applicable data protection regulations.