Back to Zing

Data Processing Agreement

Template version: 2026-05-15

This DPA forms part of the Service Agreement between Nekuda Ltd. ("Processor", operating Zing) and the subscribing professional/organisation ("Controller") and governs the processing of personal data on behalf of the Controller's end-users ("Data Subjects").

1. Roles

• The Controller decides what client (end-user) data is uploaded into Zing and for what purpose.
• The Processor processes that data only on documented instructions from the Controller — primarily through the in-product UI and API.

2. Categories of data

Category	Examples
Identifiers	Client name, phone, age
Health-adjacent	Diagnosis text, treatment goals, completion history
Caregiver contacts	Parent/spouse name and phone
Communications	WhatsApp messages, voice notes, photos, videos

3. Sub-processors

The following sub-processors are engaged with the Controller's authorisation:

Sub-processor	Purpose	Region
Twilio	WhatsApp message delivery	US/EU
OpenAI	Voice transcription (Whisper)	US
Stripe	Subscription billing (Controller-side only)	US
Google (optional)	Calendar event mirroring	US
Railway	Hosting + database	US
Cloudflare	DNS + CDN	Global

Changes to this list will be notified at least 30 days in advance by email and in-app banner. The Controller may object in writing; on unresolved objection, the Controller may terminate.

4. Security measures

The Processor maintains technical and organisational measures including:

• TLS 1.3 in transit for all client-server and server-sub-processor connections.
• Database encryption at rest (Railway-managed volumes).
• bcrypt (cost factor 10) for passwords.
• Role-based access control with an explicit admin allowlist.
• Audit logging of authentication, register, broadcast, push, and moderation events; immutable append-only.
• Idempotent backups; production data lives on a persisted volume.
• Cryptographic state-parameter validation for OAuth flows (HMAC-signed).

5. Data subject rights

The Processor will, on the Controller's request, assist with responding to data subject rights within statutory deadlines. The in-product features that already serve these rights:

• GET /api/me/export — full JSON export of the Controller's data (incl. their clients).
• DELETE /api/me — soft-delete that blocks further access immediately.
• Per-client PATCH/DELETE endpoints for granular correction/erasure.

6. Personal data breach

In the event of a personal data breach, the Processor will notify the Controller without undue delay and in any case within 72 hours of becoming aware, providing:

• Nature of the breach and categories/numbers of records affected.
• Likely consequences.
• Measures taken or proposed to mitigate.

7. International transfers

Data may be transferred to the United States via the listed sub-processors. Transfers rely on each sub-processor's contractual safeguards (Standard Contractual Clauses where applicable).

8. Return / deletion at end of service

On termination of the Service Agreement, the Processor will:

1. Disable further access to the Controller's account immediately.
2. Retain the data in cold storage for 90 days to allow recovery requests.
3. Delete all Controller data thereafter, except records required for legal/tax obligations (e.g. invoices retained for 7 years per Israeli tax law).

9. Audit

The Controller (or an independent auditor) may, on 30 days' written notice and no more than once per 12 months, audit the Processor's compliance with this DPA — typically by reviewing security documentation rather than on-site inspection. Costs borne by the Controller unless a material breach is found.

10. Governing law

Israeli law. Disputes — Tel Aviv courts.

---

To execute: print, sign, return to privacy@zing.co.il or counter-sign electronically.