Data Processing Agreement

PLACEHOLDER — replace before you ship to business customers. This is a Data Processing Agreement (DPA). You need one when a BUSINESS customer's users' personal data flows through your product — under GDPR they are the controller, you are the processor, and Article 28 requires a written agreement between you. You do NOT need one to sell to consumers. If every customer is an individual using the product for themselves, delete this file and its route. Placeholders below are substituted from lib/site-config.ts: Your Company, InstantPrep, https://instantprep.krd1stlabs.com, 2026-10-19. DATA PROCESSING AGREEMENT Last updated: 2026-10-19 1. PARTIES AND ROLES Your Company ("Processor") processes personal data on behalf of the customer ("Controller") in the course of providing InstantPrep, available at https://instantprep.krd1stlabs.com. 2. SUBJECT MATTER AND DURATION Processing continues for as long as the Controller holds an active account, and ends when the account is deleted. 3. NATURE AND PURPOSE Personal data is processed solely to provide the service. It is not sold, and it is not used to train models or for advertising. 4. CATEGORIES OF DATA [List exactly what you store. Be specific and be honest — this is the section a customer's legal team actually reads. As shipped, this template stores: account identifier, email address, authentication timestamps, and any files the user uploads.] 5. SUB-PROCESSORS [List every third party that touches customer data, with its purpose and region. As shipped that is: Supabase (database, authentication, file storage), Vercel (hosting), and — where configured — Stripe (payments), Upstash (rate limiting), Sentry (error reporting), PostHog (analytics). Delete any you do not use. This list must stay accurate; an out-of-date sub-processor list is a compliance failure on its own.] 6. SECURITY MEASURES [Describe your actual controls. This template provides: encryption in transit (HTTPS enforced), encryption at rest via the database provider, row-level security on every table, authentication on every endpoint, and rate limiting. Do not claim a control you have not configured.] 7. DATA SUBJECT RIGHTS The Controller can delete an account and all associated data at any time from the account settings. Deletion removes database records and stored files, and it is irreversible. 8. INTERNATIONAL TRANSFERS [State where data is stored, and the legal basis for any transfer outside that region. Your database region is a deliberate choice — check it.] 9. BREACH NOTIFICATION The Processor will notify the Controller without undue delay after becoming aware of a personal data breach. 10. DELETION AND RETURN On termination, personal data is deleted. [State your retention window for backups, and remember that a backup containing deleted data is still personal data.] ⚠️ NOT LEGAL ADVICE. Have this reviewed before relying on it.