Skip to content
Cryovo
Cryovo

Legal

Cryovo Data Processing Agreement

Last updated October 8, 2026

Between Cryovo ("Processor") and the customer ("Controller").

Plain-language summary — not the legal text

  • The customer is the controller and Cryovo is the processor: Cryovo processes Personal Data only on the controller's documented instructions and does not determine whether the controller is compliant.
  • Processing is limited to providing and securing the Service, generating compliance records and reports, complying with law, and improving the product using aggregate non-identifying data.
  • The sub-processors are Stripe (payments), Supabase (database and authentication), Netlify (hosting and CDN) and The Cold Standard — the ThermoNeural newsletter publication, which receives only the email address submitted through the footer newsletter form.
  • Security uses appropriate technical and organisational measures — encryption in transit, access controls and least privilege. Cryovo claims no specific certification (e.g. SOC 2 or ISO 27001) unless separately obtained.
  • Cryovo assists with data-subject requests and deletes or returns data on termination or at the controller's direction through the in-app controls at /account; transfers outside the EEA/UK use appropriate safeguards such as Standard Contractual Clauses where required by law, and liability stays as allocated in the Terms.

A reading aid only — the full DPA below is the version that applies. The summary does not change the agreement.

This DPA applies to any Personal Data Cryovo processes on the Controller's behalf in connection with the Cryovo cold-chain/F-gas compliance platform. Cryovo is operated by R7AD (Yahia Riad Hanniz), sole proprietor, Markham, Ontario, Canada.

1. Roles & allocation of responsibility

The Controller is responsible for the lawfulness of its processing, the accuracy of the data it provides, and satisfying its own regulatory obligations (FSMA 204, 21 CFR Part 11, F-gas). Cryovo is the Processor and processes data only on the Controller's documented instructions. Cryovo does not determine whether the Controller is compliant; providing the service is not a representation of compliance.

2. Permitted processing

Only to: provide and secure the service, generate compliance records/reports, comply with law, and improve the product with aggregate non-identifying data. Cryovo shall not use Compliance Data for unrelated purposes.

3. Sub-processors

Cryovo uses the sub-processors Stripe (payments), Supabase (database & authentication), Netlify (hosting & CDN) and The Cold Standard (the ThermoNeural newsletter publication, which receives only the email address submitted through the footer newsletter form), maintains a current list of them, and informs the Controller of material changes.

4. Security

Appropriate technical and organisational measures (encryption in transit, access controls, least-privilege). Cryovo does not claim a specific certification (e.g. SOC 2, ISO 27001) unless separately obtained.

5. Data subject rights

Cryovo will assist the Controller in responding to data subject requests (access, correction, deletion, portability) and complying with applicable data protection law. Account-level export and deletion are available directly from the in-app controls at /account.

6. Retention & deletion

On termination, or at the Controller's direction from the in-app controls at /account, Cryovo will delete or return the data as directed, except where retention is required by law. Data is processed only as long as needed for the service or as required by law.

7. International transfers

Where data is transferred outside the EEA/UK, Cryovo will use appropriate safeguards (e.g. Standard Contractual Clauses) to the extent required by law.

8. Liability

Nothing in this DPA alters the liability allocation in the Cryovo Terms of Service.