This DPA forms part of the Terms of Service between you ("Controller") and Middle East Live ("Processor") for processing of personal data under the GDPR and equivalent regulations.

1. Subject matter & duration

Middle East Live processes the personal data described in your account (email, usage logs, billing metadata) solely to provide the contracted service, for the duration of your subscription plus any legally required retention period.

2. Nature & purpose

Hosting, storage, authentication, alert delivery, billing, and analytics required to operate the platform.

3. Categories of data

Account identifiers (email, name), authentication metadata, billing identifiers, usage logs, alert configuration. No special-category data is processed.

4. Sub-processors

Supabase, Stripe, Resend, Google AI Gateway. We give 30 days' notice before adding new sub-processors. See the full list on the GDPR page.

5. Security measures

Encryption in transit (TLS 1.2+) and at rest (AES-256), row-level security on all user data tables, least-privilege access, audit logging, and regular dependency scanning.

6. Breach notification

We will notify affected Controllers within 72 hours of becoming aware of a personal data breach, with all information required under Art. 33 GDPR.

7. Data subject requests

We assist Controllers in responding to access, rectification, erasure, and portability requests within reasonable time and at no additional cost.

8. Audit & deletion

On termination, we delete or return all Controller personal data within 30 days, except where retention is legally required.

Request a signed DPA

Enterprise customers can request a counter-signed copy at legal@middle-east.live.