Data Processing Agreement (DPA)

The Parties expressly agree on the following qualification, which governs the allocation of the obligations described below:

• The Customer, Data Controller: it alone determines the purposes and means of the processing carried out within its Generated Application. It chooses the data it collects, the data model of its application, the retention periods specific to its activity and the recipients of that data. The Company exercises no control or decision over these choices.
• The Company, Processor: it processes this data on the Customer's behalf, only on its documented instructions, solely for the purpose of providing hosting, execution, backup, maintenance and deployment of the Generated Application.
• Sub-processor: any provider the Company uses to carry out, in whole or in part, processing performed on the Customer's behalf. The exhaustive list is in article 6.
• Data subject: any natural person whose data is processed within the Generated Application, in particular the Customer's End Users, its prospects, its staff and the third parties whose data it enters.

The Customer acknowledges that, by alone determining these purposes and means, it assumes the obligations borne by the controller under the GDPR, in particular the lawfulness of processing, informing data subjects and, where applicable, obtaining their consent.

2.3 Categories of data processed

The categories of personal data processed are determined by the Customer, who defines them by configuring the data model of its Generated Application. By design, the following categories pass through the Company's infrastructure:

• Identification and account data: identifiers, email addresses, password hashes and session tokens of the Generated Application's End Users, and any identity data the Customer chooses to collect.
• Connection and technical data: IP addresses, timestamps, request headers, device identifiers, status codes and execution logs. The technical logs kept by the Company for security and diagnostic purposes are kept for 14 days.
• Content and files: texts, images, documents and attachments uploaded by the Customer or by End Users, and the associated metadata.
• Customer business data: all records in the Generated Application's database, the nature of which depends entirely on the data model defined by the Customer.

The following constitute the Customer's documented instructions, within the meaning of article 28.3.a of the GDPR:

• the Terms and this DPA, which define the basis of the processing;
• the configuration of the Generated Application and its data model, as the Customer defines and changes it from the platform;
• the requests the Customer sends to the platform, including code generation and modification instructions (prompts);
• any particular instruction sent in writing to the Company at the address given in article 13.

If the Company considers that a Customer instruction infringes the GDPR or any other provision of Union or Member State data protection law, it informs the Customer immediately. It may suspend execution of the disputed instruction until the Customer confirms or withdraws it; the Customer then alone bears responsibility if it maintains it.

In accordance with article 32 of the GDPR, the Company implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing. These measures are as follows:

• Partitioning of customer spaces: strict isolation of pooled server spaces, so that one customer can never access another customer's data. Partitioning is applied at the level of databases, file storage and caches.
• Encryption of flows and secrets: encryption in transit of all communications. Technical secrets (API keys, tokens, deployment passwords) are end-to-end encrypted under a "Zero-Knowledge" protocol operated by the Third-Party Secrets Manager: neither the Company nor that provider's staff hold the keys that would give access to them in clear text.
• Access control and traceability: authentication of administration access, logging of modification operations carried out on data, and retention of this audit log for twelve months.
• Backup and continuity: automated daily backup of databases and essential files, with thirty (30) days' retention, outsourced to a physical infrastructure separate from the production servers.
• Monitoring and security maintenance: continuous monitoring of the platform's availability and behaviour, automatic alerts on access and volume anomalies, and regular application of security patches to the components used.

These measures are an obligation of means. They may evolve to take account of the state of the art, provided that they do not result in a reduction in the level of security. The Company keeps their description up to date and available to the Customer.

It is for the Customer to implement, on its side, the measures within its sphere of control: management of its own users' permissions, strength and non-sharing of its credentials, accuracy of the configuration of its Generated Application, and making its own backup exports in accordance with article 9.3 of the CGV.

• OVHcloud (OVH SAS) : hébergement physique, stockage des fichiers et des bases de données de l'Application Générée, et acheminement des e-mails transactionnels de la plateforme.
• SharedEnv : hébergement hautement sécurisé, isolation et chiffrement des secrets, jetons d'accès et mots de passe de déploiement.
• Anthropic PBC (États-Unis) : fourniture des modèles de langage qui génèrent et modifient le code. Seuls les prompts et les extraits de Contenu Client nécessaires au traitement d'une demande lui sont transmis, le temps de celle-ci. Ce transfert hors de l'Union européenne est encadré par les clauses contractuelles types adoptées par la Commission européenne, intégrées aux conditions commerciales de ce prestataire.
• Stripe : traitement des paiements et conservation des coordonnées bancaires. Stripe collecte ces données directement auprès du Client ; la Société n'a jamais accès au numéro de carte.
• Google (hors Union européenne) : fourniture de reCAPTCHA v3, qui vérifie qu'un envoi de formulaire provient d'un humain et non d'un automate, sur les formulaires exposés aux abus. Aujourd'hui la connexion et les signalements de bug ou d'abus. Cette vérification est exécutée à chaque envoi de formulaire protégé, y compris lorsque tous les traceurs facultatifs sont refusés : elle repose sur l'intérêt légitime de sécurité et non sur le consentement. Google reçoit à cette occasion l'adresse IP et des signaux d'interaction avec la page. Le même prestataire fournit également la mesure d'audience, mais celle-ci n'est activée qu'après consentement. Ces transferts hors de l'Union européenne s'opèrent sous les propres garanties de transfert de Google.
• Discord (hors Union européenne) : réception des alertes techniques de supervision de l'infrastructure. Aucune donnée personnelle n'y transite : une alerte ne porte que l'identifiant technique du service concerné, la route appelée, le code de statut et des taux d'erreur. Les extraits de journaux applicatifs consultables depuis ce canal sont expurgés des adresses IP avant transmission.
• healthchecks.io (hors Union européenne) : surveillance du bon fonctionnement de la chaîne d'alerte, par signal périodique. Aucune donnée personnelle n'y transite.

The Company informs the Customer of any planned addition or replacement of a sub-processor at least 30 days before it is implemented, by any written means, in particular by the dated update of this list. The Customer has this period to object, in writing and on grounds relating to data protection. If the objection prevents the Company from providing the Services, either Party may terminate the contract without compensation or penalty, the Customer benefiting from the reversibility provided for in article 10.

The Company contractually imposes on each sub-processor the same data protection obligations as those incumbent on it under this DPA, in particular as regards security, confidentiality and location. It remains fully liable to the Customer for these providers' performance of their obligations.

The following exceptions, exhaustively listed, involve providers established outside the European Union:

• Code generation (Anthropic PBC, United States): the prompts and project excerpts strictly necessary to process a code generation or modification request are transmitted to it, for the time needed to process it. This transfer is covered by the standard contractual clauses adopted by the European Commission pursuant to article 46.2.c of the GDPR, incorporated into that provider's commercial terms, and accompanied by a contractual ban on using this data for training purposes.
• Technical monitoring (Discord, healthchecks.io): these services receive the infrastructure's operating alerts. By design, no personal data is sent to them: an alert carries only the technical identifier of the service concerned, the route called, the status code and error rates, and the log excerpts viewable from this channel have IP addresses removed before transmission.
• Anti-bot verification (Google, outside the European Union): when a form protected by reCAPTCHA is submitted, this provider receives the person's IP address and page-interaction signals. This verification rests on the legitimate security interest and runs independently of consent to optional trackers. The transfer takes place under this provider's own transfer safeguards.

Payment data that may be processed by Stripe is processed under that provider's own transfer safeguards; the Company never has access to card numbers. Outside the cases listed in this article, no transfer of personal data to a third country or international organisation is made without the Customer's documented instruction. The Company keeps a copy of the safeguards applicable to these transfers available to the Customer.

At the end of the service, whatever the cause, the Customer chooses between the return of its data and its destruction. Failing an express choice by the Customer, the Company proceeds to destruction on expiry of the reversibility period.

• Return: for a maximum of 30 days following the effective date of termination, the Company returns to the Customer all of its Customer Content and the raw state of its databases in a standard, usable format (JSON for databases, original format for files).
• Destruction: on expiry of this period, the Company carries out a complete, definitive and secure purge of all data, files, databases and backups linked to the Customer's account across the whole infrastructure, including with sub-processors. No copy is kept.
• Excluded scope: the return obligation covers exclusively the Customer's data and content. It does not apply to the Scaffold, the source code of the software infrastructure, or the Company's scripts and connectors, which remain its exclusive property.

The Company provides written proof of destruction at the Customer's request. Beyond this purge, it keeps only data whose retention is required by a legal obligation or necessary for the establishment, exercise or defence of legal claims, for the duration of that obligation only and under the same security and confidentiality safeguards.

The Customer may have an audit carried out, including an inspection, of the compliance of the processing performed on its behalf, by itself or by an independent auditor it appoints who is not a competitor of the Company. This audit is carried out under the following conditions:

• on at least thirty (30) days' written notice, during working hours, and at most once in any period of twelve (12) months, except in case of a proven security incident or an order from a supervisory authority;
• without it being able to undermine the security, confidentiality or service continuity of the other customers of the pooled infrastructure, or give access to another customer's data;
• subject to the auditor first signing a confidentiality undertaking;
• at the Customer's expense, unless the audit reveals a substantial breach by the Company of its obligations, in which case the Company bears the cost and implements a remediation plan without delay.

The Company may meet this obligation by providing existing audit reports or certifications covering its infrastructure or that of its sub-processors, where these cover the scope of the request.

The Customer undertakes to:

• give the Company lawful, documented instructions, and ensure the lawfulness of the legal basis of each processing operation it implements within its Generated Application;
• inform data subjects, under articles 13 and 14 of the GDPR, of the use of the Company as processor, of the location of the data and of the transfers mentioned in article 7, and obtain their consent where consent is the legal basis of the processing;
• respect the principles of minimisation, accuracy and storage limitation in designing its data model, and document these periods;
• keep its own record of processing activities and carry out, where required, the data protection impact assessment;
• supervise the processing, including by exercising the audit right provided for in article 11, and handle data subjects' requests to exercise their rights;
• not enter into its Generated Application special categories of data within the meaning of articles 9 and 10 of the GDPR outside the conditions set out in article 2.3.

The Customer holds the Company harmless against any claim, action or penalty resulting from a breach of these obligations or from the unlawful nature of the instructions it gave.