# Stay OS customer data processing agreement

Draft dated 2 October 2026. English contractual text. Customer fields and provider confirmations must be completed before signature. This document is not legal advice and is not evidence of an executed agreement.

## Standard clauses and contract choices

The Customer (controller) and the Stay OS supplier (processor) agree to the unchanged clauses 1–10 in the Annex to **Commission Implementing Decision (EU) 2021/915** under GDPR Article 28(7). Those clauses, with the selections below and these completed Annexes I–IV, form this agreement. The service agreement cannot override the clauses. The draft does not use the international transfer clauses in Decision 2021/914 as a substitute for Article 28 terms.

- Official instrument: [EUR-Lex, Decision 2021/915](https://eur-lex.europa.eu/eli/dec_impl/2021/915/oj).
- Attach the [unchanged English clauses](/legal/eu-2021-915-standard-clauses-en.docx) when signing. Customer download: `/legal/eu-2021-915-standard-clauses-en.docx`.
- Source: [European Commission official controller–processor template package](https://commission.europa.eu/document/download/a53e88fe-3b08-4e83-8587-4e3869ebb1c3_en?filename=strandard_contractual_clauses_eu-eea.zip). The Commission links the instrument to EUR-Lex. Direct EUR-Lex fetches returned an anti-bot response; the unchanged English Annex was retrieved from the Commission's official package instead. See `SOURCE-AUDIT.md` for provenance and SHA-256.
- Clause 1(a): Option 1, GDPR Article 28(3) and (4). No Union-institution processing is intended.
- Clause 5: docking clause applies. Accession requires agreement of the parties and a signed Annex I.
- Clause 7.7(a): Option 2, general written authorisation. The notice period for intended additions or replacements is **30 days**. Send a written notice to the Customer contact in Annex I, with processing scope, location, transfer safeguard and objection route. The initial list is the exact verified provider selection signed in Annex IV, not every optional integration listed in the code inventory.
- These Article 28 clauses do not authorise transfers outside the EEA. Clause 7.8 and GDPR Chapter V still apply. Actual locations, remote access, onward providers and valid transfer safeguards must be established before use.
- Additional instructions may not contradict the clauses. Notify the controller without undue delay of a personal data breach and assist with rights, security, impact assessments, consultation and regulatory notification as the clauses require. These are contractual and operational duties, not a claim that the application automates them.

## Annex I: list of parties

| Field | Controller | Processor |
| --- | --- | --- |
| Legal name | **Customer: [complete legal name]** | Stay Management AS, supplier of Stay OS. Confirm legal contracting entity before signature. |
| Registration number | [complete] | 936 174 832, confirm against register before signature. |
| Registered address | [complete street, postcode, city, country] | [complete registered street, postcode and city], Norway. Code identifies Bergen but does not establish a full service address. |
| Contact for instructions, privacy, incidents and notices | [role, authorised contact, email, telephone] | Stay OS privacy contact: akshat@stay.no. [Confirm role, monitored notice channel and incident escalation contact.] |
| Data protection officer, if applicable | [complete or state not applicable] | [complete or state not applicable; no appointment is established by code] |
| Signature and accession date | [authorised signature; date] | [authorised signature; date] |

The controller is the organisation that determines the purposes and means of its rental and workforce processing. Its customers or property owners may have another role; record that role and the controller's authority before onboarding. The supplier's own account administration and security processing is described in `/privacy` and is not silently treated as customer-instructed processing.

## Annex II: description of processing

**Subject matter.** Hosting and operating the Customer's selected Stay OS rental and maintenance workflows. No permission for unrelated reuse of Customer personal data follows from this agreement.

**Data subjects and personal data.**

| Data subjects | Data categories |
| --- | --- |
| Tenants and household participants | Identity/contact, home/lease relationships, messages, maintenance reports, selected photos/audio, visit scheduling and entry permissions, feedback, protocols, signed documents and relevant financial records. |
| Property managers and administrators | Account identity/contact, organisation memberships, roles, authentication/session records, actions, decisions and correspondence. |
| Workers and crew | Identity/contact, affiliation/language, assignments, work time, visit outcomes, expense receipts, photos, voluntary voice notes, session/grant lineage, access events; location trail only under the separately authorised policy below. |
| Vendor representatives | Company/contact identity, qualifications, document review and identity/signature status, offer responses, estimates, work evidence, invoices and correspondence. |
| Owners and landlord signers | Contact/company identity, property relationships, approval packets, reports, legal documents, invoices and protected national identity data when the selected secure workflow requires it. |
| Applicants and co-applicants | Contact/recognition identity, application answers/preferences, messages, viewing appointments, uploaded documents, selected voice/transcripts, scores and follow-up recommendations; identity, credit and signature evidence only through the relevant authorised workflows. |

**Nature and purposes.** Collection from subjects, authorised staff and connected services; storage, organisation, scoped retrieval, communication, job planning, documentation, assisted drafts/translation/OCR/transcription, human review, signing, billing inputs, export and authorised restriction/erasure. The controller specifies the lawful basis and permitted use of each enabled feature. Applicant assessment must permit human review; special-category and employee-monitoring processing needs its own assessment. There is no blanket anonymisation before model calls.

**Sensitive data and restrictions.** National identity and credit data have dedicated workflows and restricted access. Free text and images can reveal special categories or third-party data even when not requested. Do not deliberately collect Article 9 or Article 10 data without a documented lawful instruction, necessary safeguards and review. Selected secrets have application encryption; ordinary messages and several property access fields do not. No claim of universal field encryption is made. Original uploads can retain EXIF/GPS; apply scope controls and minimisation before onward disclosure.

**Calls and video viewings.** Maintenance worker, PM and tenant calls are not recorded. Their call sites require Zadarma cloud recording and recording email delivery to be disabled before connecting. General Leads and Communications telephone calls keep the existing recording-enabled PBX policy when those features are enabled. The browser UI requires the PM to acknowledge call authority and that the recipient will receive the required recording notice before the conversation. This records the operator's acknowledgement, not spoken or otherwise captured recipient consent. The controller must establish the lawful basis and any required participant consent separately. Daily video viewing uses the existing participant choice to allow recording/transcription or join without recording. An early host waits for that choice or enters without recording; the public call route passes recordingAllowed=false for no-consent/no-recording entry. Missing or invalid DAILY_RECORDING_MODE defaults to cloud, not off. Configured off omits room recording capability; the token helper still enables host transcription unless recordingAllowed is false. Review provider room/token settings and the actual route's consent outcome before use. Deliberately submitted voice notes are separate processing. Existing recordings remain retained and access-controlled. Enabling Maintenance recording later requires a reviewed organisation policy, documented necessity/legal basis, participant notice and any required consent, secure custody, a retention/deletion procedure, permitted transcription routing and separate provider verification. The existing PM checkbox alone does not authorise that change.

**Worker location trail.** Off when no organisation policy exists. Enabling requires written crew consultation, its reference/date and confirmation, a necessity/proportionality assessment and information to workers about purpose, access and period. Consult workers and representatives under Norwegian working-environment control-measure rules. External vendors additionally require the agreement term `foregroundLocationTrail`. Foreground-only samples every ten minutes in 07–18 Oslo time, outside breaks and after work has started. Done for today stops collection. Gaps are unavailable observations, not evidence of presence. PM/ops access is restricted; custody is 90 days from day start, then the expiry job deletes the day's points. Count-only receipts and policy evidence remain.

**Duration.** Processing lasts for the service term and lawful controller instructions. Retention varies by family; the actual code schedule and enforcement gaps are in `RETENTION-SCHEDULE.md` and `/privacy`. Cases, many messages, committed media and recordings have no automatic deletion horizon. Configured raw-data review windows do not establish universal erasure. At termination the controller chooses return or deletion under Clause 10, including existing copies except where law requires retention. Agree the return format, scope, accountable operator and deadline in writing before signature: **[Customer choice; scope; deadline; legal-retention exceptions; backup isolation and expiry]**. A missing executor does not override Clause 10 or authorise indefinite processor retention. Complete a manual exit/erasure rehearsal and backup agreement before onboarding external customers.

**Subprocessor processing.** Each approved service receives only the selected data for its described purpose and for the agreed service/retention duration. Confirm each provider's own retained copies, inference-routing parties, support access and deletion duties in Annex IV; source code does not establish those durations.

## Annex III: technical and organisational measures

These are implemented controls and verification boundaries, not a certification. The Customer and supplier must confirm deployment and operational measures before relying on them.

| Measure | Code fact and boundary |
| --- | --- |
| Transmission | External API clients use HTTPS, including OpenRouter, Resend, LINK, Idura and Zadarma. Provider and database TLS configuration must be verified in deployment. No end-to-end encryption of communications is promised. |
| Selected-field encryption | `src/lib/crypto/aes-gcm.ts` implements AES-256-GCM. Access-pack credential copies (`src/lib/access-packs/credential-crypto.ts`), Keyhole secrets (`src/lib/tenancy-security/keyhole-secret-crypto.ts`) and protected identity (`src/lib/landlords/national-id-crypto.ts`) use scoped encryption. OAuth-token encryption is configuration dependent (`src/lib/auth/account-oauth-token-encryption.ts`). Ordinary message bodies and several canonical building/unit access-code columns remain plaintext at application level. Confirm provider disk encryption and key custody separately. |
| Organisation and role access | `src/lib/access/guards.ts`, `src/lib/access/policy.ts` and the worker session authority recheck organisation, role, relationship, assignment, contact revision and lifecycle. Public worker access does not create a PM membership. Confirm staff access review/offboarding and production configuration. |
| Bearer links | `src/lib/short-links/codes.ts` and `store.server.ts` use random, hash-indexed, expiry-bounded revocable codes with sealed targets. `/c/[code]` is rate-limited, privately redirected and fails uniformly. Underlying grant/session authority is still checked. Short links cap access at 90 days and purge sealed rows 30 days after expiry only through the enabled retention executor. This is not a claim that every historical link family shares that cap. |
| Protected reveal | Worker direct-entry reveal is assignment/visit bound and audited, with a 60-second reveal window (`src/lib/maintenance/worker-direct-entry.server.ts`). Protected values stay out of broad model/search/audit metadata where the capability enforces that boundary. There are documented legacy plaintext and retained-document risks to review. |
| Evidence and audit | Domain event tables, access audit (`src/lib/access/audit.ts`) and maintenance runtime receipts record authority/action lineage. Ledger writes and critical actions use transactional checks, concurrency control and idempotency. Metadata is minimised. This does not establish tamper-proof logging of every read or a complete PM activity UI. |
| Observability | Sentry configuration disables client replay and performance tracing. `src/lib/observability/logger.ts` and the sanitisation utilities filter sensitive context. Verify log samples, provider retention and incident access before use. |
| Availability and backup | Database and object-storage providers own physical infrastructure. The repository contains no universal backup period, verified restore-time guarantee or complete recovery service level. **[Confirm Neon restore window, R2 recovery/versioning, backup regions, encryption, access, expiry, restore test, incident owner and recovery objectives.]** Missing backup evidence is an operational gap, not an implemented measure. |
| Data minimisation and retention | Data policy registry, collection records, export/erasure review and selected raw-sensitive executors exist. Successful uploads and many originals are retained. Some executors are disabled unless explicitly configured; no universal erasure path exists for workers/vendors/owners. See the family schedule. |
| Rights and incidents | Applicant rights requests and internal erasure review exist. Identity/scope is checked before export or mutation; retained legal/work evidence may prevent simple erasure. Other roles require manual controller assistance. **[Assign request handling, breach escalation, confidentiality duties/training and rights/exit runbook; rehearse them.]** |
| Verification | Focused negative-path tests cover access, grant expiry/revocation, provider preflight and Maintenance recording-off and default-off trail, with unchanged general-call and viewing compatibility. CI/source tests do not establish external penetration testing, certifications, live provider settings or restored backups. |

No ISO/SOC certification, universally EU-only processing, universal pseudonymisation, automatic post-termination erasure or signed provider agreements is asserted.

## Annex IV: authorised subprocessors and connected services

The following is the **code-derived candidate inventory**, generated from `src/lib/legal/processing-inventory.ts`, the same source used by `/privacy` and `/subprocessors`. It is not blanket authorisation or proof that all providers are active. Before signature, attach the exact initial authorised selection, version/date, each provider's legal entity/address/contact, scope, actual locations, own retention and transfer safeguard. Resolve whether connected identity, security and public-data services act as independent controllers rather than subprocessors. Provider groups and OpenRouter model brands require the actual legal inference entities and routing to be recorded individually.

Initial authorised provider selection: **[complete and sign; optional integrations not selected remain disabled]**.

<!-- providers:start -->
| Provider | Purpose | Data | Location | Transfer basis | Condition |
| --- | --- | --- | --- | --- | --- |
| Vercel | Hosting and temporary import storage | Requests, IP addresses, sessions, operational logs and uploaded import files | Hosting region: on request. Region is account and deployment dependent and must be confirmed. | Agreement and actual access need confirmation. Transfers outside the EEA require a valid basis, such as adequacy or separate transfer clauses with necessary supplementary measures. 2021/915 is not a transfer safeguard. | When the platform is deployed with this provider. |
| Neon | PostgreSQL database | Database contacts, applications, tenancies, cases, messages and operational evidence | Hosting region: on request. Region is account and deployment dependent and must be confirmed. | Agreement and actual access need confirmation. Transfers outside the EEA require a valid basis, such as adequacy or separate transfer clauses with necessary supplementary measures. 2021/915 is not a transfer safeguard. | When the platform is deployed with this provider. |
| Cloudflare R2 | Private object storage | Documents, photos, metadata, audio and derivatives | Hosting region: on request. Region is account and deployment dependent and must be confirmed. | Agreement and actual access need confirmation. Transfers outside the EEA require a valid basis, such as adequacy or separate transfer clauses with necessary supplementary measures. 2021/915 is not a transfer safeguard. | When the platform is deployed with this provider. |
| OpenRouter | Model routing for drafts, translation and evidence reading | Selected text, images and document content that may contain personal data | Hosting region: on request. Region is account and deployment dependent and must be confirmed. | Agreement and actual access need confirmation. Transfers outside the EEA require a valid basis, such as adequacy or separate transfer clauses with necessary supplementary measures. 2021/915 is not a transfer safeguard. | Only when the integration or relevant feature is configured and used. |
| Anthropic, OpenAI, Google, xAI, DeepSeek, Mistral | Models selected through OpenRouter | The selected content in the model call; the actual inference route needs confirmation | Hosting region: on request. Region is account and deployment dependent and must be confirmed. | Agreement and actual access need confirmation. Transfers outside the EEA require a valid basis, such as adequacy or separate transfer clauses with necessary supplementary measures. 2021/915 is not a transfer safeguard. | Through the selected model route in OpenRouter. Model and actual inference provider may change; confirm the allowed route before use. |
| LINK Mobility | Inbound and outbound SMS | Phone numbers, message content, links and delivery metadata | Hosting region: on request. Region is account and deployment dependent and must be confirmed. | Agreement and actual access need confirmation. Transfers outside the EEA require a valid basis, such as adequacy or separate transfer clauses with necessary supplementary measures. 2021/915 is not a transfer safeguard. | Only when the integration or relevant feature is configured and used. |
| Resend | Inbound and outbound email | Email addresses, messages, links, attachments and delivery metadata | Hosting region: on request. Region is account and deployment dependent and must be confirmed. | Agreement and actual access need confirmation. Transfers outside the EEA require a valid basis, such as adequacy or separate transfer clauses with necessary supplementary measures. 2021/915 is not a transfer safeguard. | Only when the integration or relevant feature is configured and used. |
| Zadarma | Telephony and call connection | Phone numbers, extensions, call timing and status. Maintenance calls are not recorded. Enabled Leads and Communications calls may be recorded with PM acknowledgement of call authority and the required recipient notice; recordings enter private custody | Hosting region: on request. Region is account and deployment dependent and must be confirmed. | Agreement and actual access need confirmation. Transfers outside the EEA require a valid basis, such as adequacy or separate transfer clauses with necessary supplementary measures. 2021/915 is not a transfer safeguard. | Only when the integration or relevant feature is configured and used. |
| ElevenLabs | Speech to text and deliberate voice notes | Audio, transcripts, language and metadata | Speech transcription can use an EU endpoint after EU contract confirmation. Other audio paths use the standard endpoint. Confirm region per feature. | Agreement and actual access need confirmation. Transfers outside the EEA require a valid basis, such as adequacy or separate transfer clauses with necessary supplementary measures. 2021/915 is not a transfer safeguard. | Only when the integration or relevant feature is configured and used. |
| Idura | BankID and document signing | Identity and signature details, contracts and signing evidence | Hosting region: on request. Region is account and deployment dependent and must be confirmed. | Agreement and actual access need confirmation. Transfers outside the EEA require a valid basis, such as adequacy or separate transfer clauses with necessary supplementary measures. 2021/915 is not a transfer safeguard. | Only when the integration or relevant feature is configured and used. |
| Keyhole | Tenancy security and related identity workflow | Contact and identity details, lease and security or claim data | Hosting region: on request. Region is account and deployment dependent and must be confirmed. | Agreement and actual access need confirmation. Transfers outside the EEA require a valid basis, such as adequacy or separate transfer clauses with necessary supplementary measures. 2021/915 is not a transfer safeguard. | Only when the integration or relevant feature is configured and used. |
| Sentry | Error monitoring | Errors, stack traces and filtered technical request metadata | Hosting region: on request. Region is account and deployment dependent and must be confirmed. | Agreement and actual access need confirmation. Transfers outside the EEA require a valid basis, such as adequacy or separate transfer clauses with necessary supplementary measures. 2021/915 is not a transfer safeguard. | Only when the integration or relevant feature is configured and used. |
| Daily | Video viewings | Participant names, viewing metadata and audio/video. Video viewings may be recorded and transcribed after the participant consent choice; the participant and host can join without recording | Hosting region: on request. Region is account and deployment dependent and must be confirmed. | Agreement and actual access need confirmation. Transfers outside the EEA require a valid basis, such as adequacy or separate transfer clauses with necessary supplementary measures. 2021/915 is not a transfer safeguard. | Only when the integration or relevant feature is configured and used. |
| Google Workspace / Google OAuth | Optional sign-in, calendar and Meet imports | Account identity, OAuth access, appointment metadata and selected meeting transcripts | Hosting region: on request. Region is account and deployment dependent and must be confirmed. | Agreement and actual access need confirmation. Transfers outside the EEA require a valid basis, such as adequacy or separate transfer clauses with necessary supplementary measures. 2021/915 is not a transfer safeguard. | Only when the integration or relevant feature is configured and used. |
| Upstash / Vercel KV | Optional rate limiting | Derived client or IP keys, counters and expiry times | Hosting region: on request. Region is account and deployment dependent and must be confirmed. | Agreement and actual access need confirmation. Transfers outside the EEA require a valid basis, such as adequacy or separate transfer clauses with necessary supplementary measures. 2021/915 is not a transfer safeguard. | Only when the integration or relevant feature is configured and used. |
| Dun & Bradstreet / Bisnode | Credit assessment | Identity, national identity number and credit information when the credit workflow is used | Hosting region: on request. Region is account and deployment dependent and must be confirmed. | Agreement and actual access need confirmation. Transfers outside the EEA require a valid basis, such as adequacy or separate transfer clauses with necessary supplementary measures. 2021/915 is not a transfer safeguard. | Only when the integration or relevant feature is configured and used. |
| Parallel | Property and market research | Address and search context and publicly available listing information | Hosting region: on request. Region is account and deployment dependent and must be confirmed. | Agreement and actual access need confirmation. Transfers outside the EEA require a valid basis, such as adequacy or separate transfer clauses with necessary supplementary measures. 2021/915 is not a transfer safeguard. | Only when the integration or relevant feature is configured and used. |
| OpenStreetMap / Nominatim / Overpass | Address lookup and maps | Search text, addresses, map coordinates and technical browser metadata when using maps | Hosting region: on request. Region is account and deployment dependent and must be confirmed. | Agreement and actual access need confirmation. Transfers outside the EEA require a valid basis, such as adequacy or separate transfer clauses with necessary supplementary measures. 2021/915 is not a transfer safeguard. | Only when the integration or relevant feature is configured and used. |
| Brønnøysundregistrene, Kartverket / Geonorge, Entur, SSB | Public company, address, transport and market lookups | Organisation numbers, addresses, coordinates and bounded query context | Hosting region: on request. Region is account and deployment dependent and must be confirmed. | Agreement and actual access need confirmation. Transfers outside the EEA require a valid basis, such as adequacy or separate transfer clauses with necessary supplementary measures. 2021/915 is not a transfer safeguard. | Only when the integration or relevant feature is configured and used. |
| DuckDuckGo | Product and address information lookup | Product descriptions, addresses or search text | Hosting region: on request. Region is account and deployment dependent and must be confirmed. | Agreement and actual access need confirmation. Transfers outside the EEA require a valid basis, such as adequacy or separate transfer clauses with necessary supplementary measures. 2021/915 is not a transfer safeguard. | Only when the integration or relevant feature is configured and used. |
<!-- providers:end -->

For each selected provider: **[legal entity; registered address; contact; signed DPA; actual processing/support locations; EEA/adequacy/Article 46 safeguard; transfer impact assessment and supplementary measures if needed; provider duration/deletion; authorised feature scope]**. The public inventory may describe a new candidate but does not amend the signed authorisation. Maintain a durable notice/objection record and do not start a disputed new route before resolution under Clause 7.7.

## Wiki Backlink

- Source map entry: `docs/legal/README.md`.
- Related wiki page: `docs/llm-wiki/pages/DATA_MEMORY_AND_RETENTION_CONTROL_PLANE.md`.
- Last reviewed: 2026-10-02.