Data Processing Agreement

For data the Controller submits to Obol (e.g. their team's accounts), Obol acts as Processor and the customer as Controller. For Obol's own account data, Obol is the Controller (see our Privacy Policy). Where a seller's service processes its buyers' personal data, the seller is the controller for that processing — Obol does not process the content of seller services.

Obol processes personal data only to provide the marketplace: authentication, listing, payment routing/metering, security, and support. Obol processes data per the Controller's documented instructions (these terms and use of the product) and will not process it for any other purpose.

• Subjects: the Controller's authorized users / agents.
• Data: account identifiers (email), public wallet addresses, API-key metadata (hashed), listings, transaction records. No special-category data is required by Obol.

The Controller authorizes these sub-processors; Obol remains responsible for their compliance and will give notice of changes:

• Google Cloud / Firebase — hosting, auth, database (SOC 2, ISO 27001, GDPR).
• Circle — USDC settlement and on-chain rails (regulated money-services provider).

Obol maintains appropriate technical and organizational measures: encryption in transit (TLS) and at rest, least-privilege access controls, secret management, audit logging, and monitoring on Google Cloud's audited platform. Secrets (API-key hashes, 2FA seeds) are encrypted and never exposed.

Obol provides self-service export and deletion in-product and will assist the Controller in responding to data-subject requests (access, rectification, erasure, portability, restriction) without undue delay.

Obol will notify the Controller without undue delay (and within 72 hours where feasible) after becoming aware of a personal-data breach affecting the Controller's data, with the information needed to meet the Controller's own notification duties.

Where personal data is transferred outside the EEA/UK, transfers rely on Standard Contractual Clauses and the sub-processors' transfer mechanisms.

On termination or request, Obol deletes or returns the Controller's personal data, except where retention is legally required. In-product deletion erases the user's records and authentication identity.

Obol will make available the information necessary to demonstrate compliance, including third-party audit reports of its sub-processors (e.g. Google Cloud SOC 2) and, for enterprise customers, completed security questionnaires.

Obol inherits SOC 2 / ISO 27001 / GDPR-compliant infrastructure from Google Cloud and Circle, and operates a minimal-data design. Obol's own SOC 2 Type II is available to enterprise customers on request or in progress; contact obolmcp@gmail.com for current status and a countersigned DPA.