Operix by Black Flag AVP: Data Processing Addendum
Effective date: October 20, 2026
Last updated: October 22, 2026
This addendum sets out the processor terms required by the Texas Data Privacy and Security Act. It is part of the Terms of Service between you (the "Business" or "Customer", controller) and Nicholas J Garza, an individual doing business as Black Flag AVP, Houston, Texas ("Processor"). Contact: support@blackflagavp.com. Mailing address: 957 Nasa Pkwy, Unit #2194, Houston, Texas 77058.
1. Scope
It covers personal data about the Business's customers and contacts that the Business puts in Operix (names, phone numbers, emails, addresses, job and invoice details).
2. Instructions
We process this data only to provide Operix as the Business directs through the product and these terms, and not for our own purposes. We don't sell it or use it for advertising.
3. Confidentiality
Anyone who processes the data for us is bound by a duty of confidentiality.
4. Security
Encryption in transit and at rest, access limited to running and supporting the service, and other reasonable safeguards appropriate to the data.
5. Subprocessors
Before any content is sent to our AI provider (xAI), Processor automatically removes or replaces names, email addresses, phone numbers, payment card numbers, Social Security numbers and US addresses it can detect, and blocks the request if any remain. Automated removal may not catch every item, such as a name typed only in free-text notes or a non-US address, so Customer agrees not to enter third-party personal data into notes or AI prompts. Under xAI's enterprise terms, xAI doesn't use this data to train its models.
Optional AI features are processed by xAI with Zero Data Retention enabled, so xAI does not store Customer Data sent for AI processing after it returns a response, except where xAI's terms or the law require otherwise.
Current subprocessors:
- xAI (SpaceXAI LLC), AI processing of text you submit to AI features; set to zero data retention, so inputs and results aren't stored by xAI after the response, US
- Stripe, subscription and invoice payments, US
- Sign in with Grok (xAI / SpaceXAI LLC), sign-in
- Vercel Inc., hosting, US
- Neon (Databricks), Postgres database, US
We'll give notice before adding one, and the Business may object.
6. Assistance
We'll help the Business answer its customers' requests to access, correct or delete data, and with assessments the law requires, taking into account the nature of the processing.
7. Breach notice
If we learn of a breach affecting the Business's data, we'll tell the Business without undue delay, within 72 hours where practical, and help it meet its own notice duties, including under Tex. Bus. & Com. Code ยง521.053.
8. Deletion and return
The Business can export its desk at any time. When the Business's access ends, it can export its desk for 30 days; we delete server copies within 45 days unless the law requires us to keep them. The Business is responsible for deleting copies on its devices and any backups it downloaded. This addendum stays in effect until deletion is complete.
9. Information and audits
We'll make available the information reasonably needed to show compliance with this addendum and allow reasonable assessments, at most once a year with notice.
Contact
Nicholas J Garza, an individual doing business as Black Flag AVP, 957 Nasa Pkwy, Unit #2194, Houston, Texas 77058. support@blackflagavp.com.