Data Processing Agreement

1. Subject Matter

Processor processes personal data solely on documented instructions from Controller to deliver the Service.

2. Sub-processors

• Supabase (DB/auth hosting, US)
• Vercel (app hosting, US)
• Stripe (payments, US/EU)
• Resend (email, US)
• Sentry (error monitoring, US)
• PostHog (analytics, US)

30-day written notice before adding new sub-processors.

3. Security

• TLS 1.2+ in transit; AES-256 at rest
• Least-privilege access with MFA
• 90-day audit logs
• Encrypted backups

4. Data Subject Rights

We assist with access/rectification/erasure/portability requests within 5 business days.

5. Breach Notification

We notify Controller within 48 hours of breach awareness including scope + measures taken.

6. Audit

Annual audit reports on request. On-site audits require reasonable notice.

7. Data Return/Deletion

On termination: return or delete within 30 days unless law requires retention. Backups purged per backup schedule.

8. International Transfers

SCCs (EU Commission Decision 2021/914) apply for transfers outside EEA.