Last Updated: October 2026

Parties. This Data Processing Agreement (“DPA”) is between CodeConda LLC, a limited liability company organized in Arizona, United States (“CodeConda”), and the business or organization that has entered into the Main Agreement (“Customer”).

Execution. This DPA forms part of the Terms of Service, order form, or other agreement governing Customer’s use of the Services (the “Main Agreement”). By executing or electronically accepting the Main Agreement, or continuing to use the covered Services after receiving this DPA when the Main Agreement and law permit continued use as acceptance, each party executes this DPA, including the transfer terms in Section 9 and Schedule 4 for applicable Restricted Transfers. If a separate signed DPA is required, the parties may execute a counterpart that identifies the Main Agreement.

1. Purpose and Scope

1.1 This DPA applies when and to the extent CodeConda Processes Customer Personal Data on behalf of Customer in providing the Services. “Customer Personal Data” means Personal Data submitted to, stored in, generated through, or otherwise Processed by a covered Service on Customer’s behalf.

1.2 If Customer determines the purposes and essential means of Processing, Customer is the Controller and CodeConda is its Processor. If Customer Processes Customer Personal Data for another Controller, Customer is a Processor and appoints CodeConda as its Subprocessor. References in this DPA to Customer instructions and obligations apply in either role, and Customer represents that the relevant Controller has authorized Customer to appoint CodeConda.

1.3 The Main Agreement, this DPA, Customer’s authorized configuration and use of the Services, and support requests from Customer’s authorized personnel constitute documented instructions. CodeConda shall Process Customer Personal Data only on those instructions, including for transfers, unless legally required otherwise. CodeConda may suspend the affected Processing if, in its opinion, an instruction infringes Data Protection Law.

1.4 CodeConda acts as an independent Controller, not a Processor under this DPA, for Personal Data it determines to Process for its own legitimate purposes, such as account administration, direct billing and tax records, relationship management, security and abuse prevention across customers, legal compliance, and establishment or defense of claims. That Processing is governed by the Privacy Policy and governing legal requirements. CodeConda shall not recharacterize Customer Personal Data as independent-controller data merely to avoid this DPA.

1.5 This DPA does not apply to an individual’s personal or household use where the individual is the Data Subject rather than a Controller or Processor for others. The Privacy Policy governs that Processing. This DPA does not limit rights that a Data Subject cannot waive.

1.6 Coverage is determined by the Processing relationship and Customer’s use and configuration, not by a Service name. Listing or omitting a Service or category does not by itself determine whether this DPA applies.

2. Definitions

• “Data Protection Law” means privacy, data protection, and data security laws that govern the covered Processing, including, where relevant, the GDPR, UK GDPR, Swiss Federal Act on Data Protection, and United States state privacy laws.
• “Controller,” “Processor,” “Process,” “Processing,” “Personal Data,” “Personal Data Breach,” and “Data Subject” have the meanings in Data Protection Law. “Controller” includes a CCPA “business,” and “Processor” includes a CCPA “service provider” or “contractor,” where relevant.
• “EEA” means the European Economic Area. “EU SCCs” means Commission Implementing Decision (EU) 2021/914 and its standard contractual clauses, as amended or replaced.
• “GDPR” means Regulation (EU) 2016/679. “UK GDPR” means the GDPR as incorporated into United Kingdom law.
• “Restricted Transfer” means a transfer of Customer Personal Data requiring a transfer mechanism under the GDPR, UK GDPR, or Swiss Federal Act on Data Protection.
• “Subprocessor” means a third party appointed by or on behalf of CodeConda to Process Customer Personal Data. It does not include Customer personnel or a third-party service that Customer directly instructs or contracts with independently of CodeConda.
• “UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the UK Information Commissioner and laid before Parliament on February 2, 2022, as revised under its Mandatory Clauses.
• Terms not defined in this DPA have the meanings in the Main Agreement.

3. Details of Processing

3.1 The subject matter, duration, nature and purpose of Processing, categories of Personal Data, and categories of Data Subjects are set out in Schedule 1.

3.2 Customer shall not submit special-category data, highly sensitive identifiers, precise geolocation, health data, biometric data used for identification, financial account credentials, or criminal-conviction data unless the Service receiving the data expressly supports it, the parties document the Processing, and Customer has satisfied all legal requirements. Customer shall not submit Personal Data concerning children in violation of the Main Agreement or Data Protection Law.

3.3 Customer is responsible for lawfulness, transparency, data minimization, accuracy, and its instructions, and for obtaining any required authorization from its Controller. CodeConda is responsible for its compliance as Processor or Subprocessor and does not assume obligations imposed on Customer solely because of Customer’s industry or independent activities.

4. Obligations of the Processor

4.1 CodeConda shall:

• Comply with Customer’s lawful documented instructions under Section 1.3.
• Ensure personnel authorized to Process Customer Personal Data are bound by confidentiality and access it only as needed for assigned duties.
• Implement and maintain the technical and organizational measures in Schedule 2.
• Comply with Section 8 when appointing Subprocessors.
• Taking into account the nature of Processing, assist Customer through appropriate measures, insofar as possible, with Data Subject requests. If CodeConda receives a request relating to Customer Personal Data, it shall not respond substantively unless Customer instructs it or law requires.
• Provide reasonable assistance, taking into account the nature of Processing and information available to CodeConda, with security, breach notification, data protection impact assessments, and prior consultations required of Customer.

4.2 Assistance requiring material effort beyond standard Service functionality may be subject to reasonable fees agreed in advance, except to the extent the assistance is required because of CodeConda’s breach of this DPA.

5. Confidentiality

5.1 CodeConda shall restrict access to Customer Personal Data to personnel and contractors with a need to know for the Services, security, support, or compliance. Authorized persons are bound by contractual or statutory confidentiality obligations that survive the end of their engagement.

6. Security Measures

6.1 CodeConda shall implement and maintain the measures in Schedule 2, designed to provide a level of security appropriate to the risk of accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. CodeConda may update the measures to reflect technical developments, provided the overall protection is not materially reduced.

6.2 Customer is responsible for secure configuration of the Services under its control, protecting account credentials, limiting its users’ access, maintaining appropriate copies or exports where the Service does not provide archival storage, and using available security features.

7. Personal Data Breaches

7.1 Information about a Personal Data Breach may be provided in phases as it becomes available.

7.2 Notification is not an admission of fault or liability. Customer is responsible for notifications to authorities and Data Subjects unless law allocates that duty to CodeConda.

8. Subprocessors

8.1 Customer gives general written authorization for CodeConda to appoint the Subprocessors listed in Schedule 3 and future replacements or additions under this section. A listed Subprocessor Processes Customer Personal Data only when the relevant Service or feature uses it.

8.2 CodeConda shall ensure each Subprocessor is subject to the data protection obligations required by Data Protection Law for the delegated Processing through applicable standard terms or another legally binding mechanism. CodeConda remains responsible to Customer for each Subprocessor’s performance to the extent required by Data Protection Law.

8.3 Schedule 3 lists authorized Subprocessors. Before covered Processing, CodeConda shall provide Customer with the relevant provider's legal name, address, privacy contact, delegated Processing, and expected Processing locations. CodeConda shall give Customer written notice of an intended addition or replacement at least 30 days before the new Subprocessor begins covered Processing. The notice shall provide the same information for the new provider. CodeConda may use the contact information Customer provides for the relevant Service or another written channel agreed with Customer. Customer may request current Subprocessor information through our support page.

8.4 Where Data Protection Law or applicable transfer terms give Customer a right to object to a new Subprocessor, Customer may object before the Subprocessor begins Processing on reasonable, documented data protection grounds specific to that Subprocessor. CodeConda may address an objection by changing the affected Processing or not using the Subprocessor for Customer. If the objection remains unresolved, Customer may terminate the affected Service. Refunds are governed by the Refund Policy and any rights under the incorporated transfer terms. This is Customer’s sole contractual remedy for an unresolved objection under this section, without limiting rights under the SCCs or law that cannot be changed by contract.

8.5 A third-party platform or integration directly selected, instructed, or contracted by Customer is not a Subprocessor appointed by CodeConda to the extent Customer independently determines that third party’s Processing. Customer is responsible for its instructions and relationship with that third party. If CodeConda appoints the same provider to Process Customer Personal Data for CodeConda’s delivery of the Services, Schedule 3 and this section apply.

9. International Data Transfers

9.1 Customer authorizes CodeConda and its Subprocessors to Process Customer Personal Data in the United States and other countries where an authorized Subprocessor operates, subject to this section. Each party shall use a valid transfer mechanism for Restricted Transfers for which it is responsible.

9.2 For a Restricted Transfer governed by the GDPR, the EU SCCs are incorporated by reference, with clause selections in this section and appendix information in Schedule 4. Module Two applies when Customer is a Controller and CodeConda is a Processor. Module Three applies when Customer is a Processor and CodeConda is its Subprocessor. The docking clause in Clause 7 applies. Option 2 in Clause 9(a) applies. The optional language in Clause 11(a) does not apply. In Clause 17, Option 1 applies and the governing law is the law of Ireland. Under Clause 18(b), disputes shall be resolved by the courts of Ireland.

9.3 For a Restricted Transfer governed by the UK GDPR, the EU SCCs and the UK Addendum are incorporated, with the selections and appendix information in this section and Schedule 4. Part 2 Mandatory Clauses of the UK Addendum are incorporated without amendment. For a transfer governed by Swiss law, the EU SCCs apply with references to the GDPR understood to include the Swiss Federal Act on Data Protection, references to EU or Member State law understood to include Swiss law, the competent authority being the Swiss Federal Data Protection and Information Commissioner, and Data Subjects in Switzerland able to enforce the clauses.

9.4 The EU SCCs and UK Addendum prevail over conflicting terms of the Main Agreement or this DPA for the relevant Restricted Transfer. Nothing in this DPA varies, modifies, or overrides their text. If the European Commission, UK Information Commissioner, or other competent authority approves a replacement mechanism, CodeConda may update this section to use it without reducing required protection.

10. Audit and Information Rights

10.1 CodeConda shall provide information reasonably necessary to demonstrate compliance with this DPA, including relevant policies, summaries, or independent assessments actually available.

10.2 If that information is insufficient, Customer may conduct an audit itself or through an independent auditor that is not a competitor when reasonably necessary to verify compliance with this DPA. Audits require reasonable advance notice, must occur during normal business hours, remain scoped to covered Processing, protect other customers and confidential information, and avoid unreasonable disruption. CodeConda may reject duplicative, excessive, or unnecessary audit requests unless a Personal Data Breach, regulator request, reasonable evidence of material noncompliance, or governing legal requirement justifies the request. Customer bears its costs, and CodeConda may charge reasonable costs for material assistance, unless the audit identifies CodeConda’s material breach. This section does not limit the audit rights of a Supervisory Authority or rights under the SCCs.

11. Data Retention and Deletion

11.1 During the term, Customer may access, export, or delete Customer Personal Data using available Service functionality. Customer may submit data requests through our support page.

11.2 Copies may remain where storage is required by law or in backups and Subprocessor systems until deleted through ordinary lifecycle processes, which have no fixed period across Services or providers. Retained Customer Personal Data remains protected by this DPA, is isolated from ordinary use, and is Processed only for the reason retained until deletion.

11.3 CodeConda may retain data that has been de-identified so that it cannot reasonably be linked to Customer or a Data Subject. CodeConda shall maintain technical and contractual safeguards against re-identification, shall not attempt to re-identify it other than as needed to test those safeguards in compliance with Data Protection Law, and shall require any recipient to comply with equivalent restrictions. Merely pseudonymized data remains Customer Personal Data.

12. Liability

12.1 Each party’s liability arising from this DPA is subject to the exclusions and limitations in the Main Agreement, except that no limitation applies to the extent prohibited by Data Protection Law.

12.2 To the maximum extent permitted by law, Customer shall indemnify CodeConda against third-party claims arising from Customer’s unlawful instructions, failure to establish a lawful basis, or material breach of this DPA. This obligation does not apply to the extent caused by CodeConda’s breach, negligence, or willful misconduct.

12.3 Nothing in this DPA limits Data Subject rights, liability under the EU SCCs or UK Addendum, regulatory authority, or any liability or remedy that cannot lawfully be limited or waived.

13. Content Responsibility

13.1 Customer is responsible for the accuracy, quality, and legality of Customer Personal Data, the means by which it was obtained, notices and lawful bases, and the legality of Customer’s instructions, content, and publication of outputs.

13.2 CodeConda does not comprehensively review Customer content. CodeConda may use automated or manual systems to detect security threats, spam, fraud, abuse, or prohibited content and may investigate reports, but those systems are not guaranteed to detect every issue. Additional User Content terms appear in the Legal Disclaimers.

13.3 Customer shall ensure it has authority to instruct CodeConda and, when Customer is a Processor, shall communicate relevant Controller instructions and restrictions to CodeConda.

14. United States State Privacy Laws

14.1 This section applies to Customer Personal Data governed by the California Consumer Privacy Act, as amended (“CCPA”), or another United States state privacy law that regulates contracts between a Controller and Processor. Defined terms have the meanings given by the governing statute.

14.2 CodeConda Processes personal information for the limited and specified purposes in Schedule 1 and the Main Agreement. CodeConda shall not sell or share Customer Personal Data, retain, use, or disclose it outside the direct business relationship or for a commercial purpose other than those specified, or combine it with personal information received from another person or from CodeConda’s own interaction with a Data Subject, except where legally permitted.

14.3 CodeConda shall comply with the restrictions governing the delegated Processing, provide the same level of privacy protection required of Customer, and allow Customer to take reasonable and appropriate steps to stop and remediate unauthorized use. Customer may monitor compliance through Section 10.

14.4 CodeConda certifies that it understands and will comply with the restrictions in this section. The parties agree that Customer makes Customer Personal Data available to CodeConda only for the limited and specified purposes in this DPA and not for monetary or other valuable consideration.

15. Miscellaneous

15.1 This DPA does not grant either party ownership of the other party’s data or intellectual property.

15.2 If a provision is invalid or unenforceable, it shall be modified to the minimum extent necessary and the remaining provisions remain effective. The EU SCCs and UK Addendum are modified only as their terms permit.

15.3 This DPA controls over the Main Agreement for covered data protection matters. The EU SCCs and UK Addendum then control for relevant Restricted Transfers. A law that cannot be changed by contract controls over a conflicting term.

15.4 Except where the EU SCCs, UK Addendum, or Section 15.3 requires otherwise, this DPA is governed by Arizona law and disputes are subject to the forum in the Main Agreement.

15.5 Amendments to this DPA follow the Main Agreement’s change procedure, except that CodeConda may update Schedule 3 under Section 8 and may update transfer terms as allowed by Section 9. No amendment reduces protection required by Data Protection Law.

16. Contact Information

16.1 Customer and Data Subjects may contact CodeConda through our support page. Customer must designate a contact for privacy matters involving Customer Personal Data.

Schedule 1. Processing Details

• Subject matter and purpose: providing, securing, maintaining, and supporting the covered Services according to Customer’s instructions, including hosting, storage, caching, proxying, translation, AI-assisted processing, generation, enrichment, delivery, authentication, troubleshooting, abuse prevention, and connected-platform operations enabled by Customer.
• Duration and frequency: continuous or on-demand during the Main Agreement, plus restricted retention under Section 11. Transfers occur as needed to provide configured features.
• Nature of Processing: collection from Customer or its users, recording, organization, structuring, storage, adaptation, retrieval, consultation, transmission to authorized recipients, generation, combination at Customer’s instruction, restriction, return, and deletion.
• Data Subjects: Customer personnel and authorized users, Customer’s prospects, customers, contacts, contractors, and website or service users, individuals represented in Customer content, and other Data Subjects whose data Customer submits.
• Personal Data: names, usernames, business and personal contact details, account and authentication data, IP addresses, device and usage data, support communications, connected-account identifiers and tokens, transaction metadata, user-entered addresses or coordinates, and Personal Data in prompts, uploads, files, text, images, audio, video, translations, generated outputs, or other Customer content.
• Sensitive data: not intentionally required as a general matter. It may be present in Customer content only when the Service expressly supports it and Customer lawfully instructs the Processing under Section 3.2. The frequency and volume are determined by Customer.
• Data access, retention, and deletion: as described in Section 11.

Schedule 2. Technical and Organizational Measures

The following security measures apply to covered Processing according to its nature, scope, context, and risk. Implementation varies by Service.

• Access and identity: unique workforce accounts where technically supported, role-based and least-privilege access, authentication controls, and revocation when access is no longer required.
• Transmission and secrets: encrypted network transport using current HTTPS/TLS configurations for supported Service connections. Credentials, API keys, and production secrets are stored in access-restricted configuration or secret-management facilities and are not committed to public source code.
• Stored data protection: infrastructure-provider storage protections and access controls, including encryption at rest where the configured provider or storage service supplies it. Some temporary files, caches, third-party systems, or legacy components may not be encrypted at rest.
• Segregation and minimization: logical separation through account, project, tenant, row-level, bucket, or equivalent authorization controls where Services are multi-tenant. Collection and service access are limited to data needed for configured functionality.
• Secure development and change management: source control, review or testing proportionate to change risk, dependency and vulnerability remediation based on severity and exploitability, restricted production deployment access, and separation of development and production credentials where supported.
• Logging and abuse prevention: operational and security logging, access restrictions on logs, and rate limiting or bot controls appropriate to the Service.
• Availability and recovery: provider-supported redundancy and backups or recoverable managed storage where configured and appropriate to the Service, with restoration measures proportionate to risk. Recovery time, recovery point, and backup-retention commitments apply only when stated in the Main Agreement.
• Incident response: containment, investigation, and remediation measures proportionate to the incident.
• Personnel and vendor governance: confidentiality commitments, access limited by job function, security awareness appropriate to responsibilities, risk-based Subprocessor review, applicable provider data protection terms, and removal of access at the end of engagement.
• Deletion and disposal: account or administrative deletion workflows where available, restricted retention under Section 11, and reliance on provider lifecycle deletion for backups and managed Subprocessor systems.
• Effectiveness review: periodic review of material controls and updates in response to significant architecture, threat, incident, or legal changes.

Schedule 3. Authorized Subprocessors

The following is the authorized portfolio-wide list. Actual use depends on the Service, feature, Customer configuration, and transaction. A provider is a Subprocessor under this DPA only when CodeConda appoints it to Process Customer Personal Data on CodeConda’s behalf. CodeConda shall identify and authorize a new provider under Section 8 before that provider begins covered Processing. Transfer safeguards include an adequacy decision where available, the EU SCCs and UK transfer terms, or another mechanism permitted by Data Protection Law.

• Supabase Pte. Ltd. (Supabase): database, authentication, and storage services.
• Supabase, Inc. (Supabase US affiliate): support and operations when needed.
• Vercel Inc.: website and application hosting.
• Amazon Web Services, Inc.: cloud infrastructure and storage.
• Functional Software, Inc. (Sentry): error monitoring.
• Google LLC: cloud infrastructure and AI processing.
• OpenAI OpCo, LLC: AI processing.
• ZenLeads Inc. d/b/a Apollo.io: contact enrichment.
• Sand Dune Mail Ltd (SMTP2GO): email delivery.
• Northflank Ltd: application hosting.
• Render Services, Inc.: application hosting.
• DeepL SE: translation.
• SolarWinds Worldwide, LLC: log monitoring.
• Runpod, Inc.: AI compute, training, and inference.
• Modal Labs, Inc.: AI processing.
• Features & Labels, Inc. (fal): AI processing and media generation.
• Replicate, LLC: AI model training and inference.
• Runware Ltd: AI media generation.
• DigitalOcean, LLC: application hosting.
• Cloudflare, Inc.: content delivery, security, and object storage.

Schedule 4. International Transfer Terms

EU SCC Annex I.A, List of Parties

Data exporter. Customer. Activities relevant to the transfer are Customer’s use of the Services and submission of Customer Personal Data. Role: Controller under Module Two, or Processor under Module Three, as determined under Section 1.2. Signature and date: execution of the Main Agreement as described in the Execution paragraph above.

Data importer. CodeConda LLC, an Arizona limited liability company. Activities relevant to the transfer are provision, security, support, and operation of the Services. Role: Processor under Module Two, or Subprocessor under Module Three. Signature and date: execution of the Main Agreement as described in the Execution paragraph above.

EU SCC Annex I.B, Description of Transfer

Categories of Data Subjects, categories of Personal Data, sensitive data and safeguards, frequency, nature and purpose, duration and retention are specified in Schedule 1. Transfers are continuous or initiated by Customer and its authorized users as needed to provide configured Services. Sensitive data is not generally intended. Where it is lawfully submitted under Section 3.2, Schedule 2 access controls, transmission protections, minimization, logging, confidentiality, and deletion safeguards apply. Schedule 1 describes the covered Processing, and each Subprocessor performs only the portion delegated through the applicable Service or feature.

EU SCC Annex I.C, Competent Supervisory Authority

The competent Supervisory Authority is determined under Clause 13 of the EU SCCs. Where Customer is established in an EEA Member State, it is the authority responsible for Customer’s compliance with the GDPR for the transfer. Where Customer is not established in the EEA but falls within Article 3(2), it is the authority for Customer’s appointed representative’s Member State or, if no representative is required, the authority of the Member State where relevant Data Subjects are located. Customer must identify that authority to CodeConda.

EU SCC Annex II, Technical and Organizational Measures

Schedule 2 forms Annex II to the EU SCCs. For transfers to Subprocessors, CodeConda shall select controls from Schedule 2 appropriate to the delegated Processing and rely on applicable standard terms or another legally binding mechanism that imposes the protections required by Data Protection Law for that Processing.

Subprocessor Transparency

Schedule 3 provides the authorized Subprocessor list used with the general written authorization in Section 8 and Clause 9(a), Option 2 of the EU SCCs. EU SCC Annex III applies to specific authorization under Clause 9(a), Option 1 and is therefore not used here.

UK Addendum Table 1, Parties

Exporter: Customer. Importer: CodeConda LLC. By executing the Main Agreement, each party signs this UK Addendum on the same date and in the same manner.

UK Addendum Table 2, Selected SCCs, Modules, and Clauses

Approved EU SCCs: the EU SCCs identified in Section 2, with clause selections in Section 9.2 and appendix information in Schedule 4. Module Two applies to Controller-to-Processor transfers and Module Three applies to Processor-to-Processor transfers, based on Customer’s role. Clause 7 applies. Clause 9 uses Option 2. Clause 11 optional redress language does not apply. Clause 17 uses Option 1 and Irish law. Clause 18 selects the courts of Ireland.

UK Addendum Table 3, Appendix Information

Annex 1A, list of parties: EU SCC Annex I.A above. Annex 1B, description of transfer: EU SCC Annex I.B and Schedule 1. Annex II, technical and organizational measures: Schedule 2. Annex III is not used because the parties selected general authorization under Clause 9(a), Option 2. Schedule 3 separately provides the authorized Subprocessor list. These materials are incorporated into the UK Addendum.

UK Addendum Table 4, Ending the Addendum on Approved Changes

Either party may end the UK Addendum under Section 19 of its Mandatory Clauses when that section’s conditions are met.

Incorporation. Part 2, Mandatory Clauses of the UK Addendum are incorporated into this DPA and apply without amendment. Defined terms in those Mandatory Clauses retain their prescribed meanings. If the information in a UK Addendum Table conflicts with a Mandatory Clause, the Mandatory Clause controls.