Data Processing Agreement

For personal data uploaded by a customer to Nyrava, the customer acts as data controller and Nyrava acts as data processor. Nyrava processes personal data solely on the customer's documented instructions and for the purposes of providing the service.

• Subject matter: analysis and organization of legal case materials.
• Categories of data: such personal data as the customer chooses to upload in the context of a matter.
• Categories of data subjects: parties, witnesses, counsel, and other individuals identified in the matter.
• Duration: for the duration of the customer's subscription and any retention period thereafter.

Nyrava uses managed infrastructure providers to operate the platform and, where the customer has not configured their own keys, contracted AI-model providers for analysis. A current sub-processor list is maintained and can be requested via the Contact page.

Nyrava implements technical and organizational measures appropriate to the risks of processing legal case data, including encryption in transit and at rest, workspace isolation via row-level security, restricted production access, audit logging, and secure storage of provider secrets. See Security Practices.

Nyrava assists the customer, to the extent reasonably possible, in responding to requests from data subjects to exercise their rights under applicable law.

Upon termination of the service, the customer may export workspace data through in-app tools. Nyrava will delete customer personal data within a reasonable period thereafter, subject to any legal retention obligations.

A countersigned copy of this DPA can be requested via the Contact page.