Client-facing standard terms. Apply only when incorporated into an accepted private Order Form identifying the parties and required schedules. Mandatory law and signed negotiated provisions prevail; this page is not a certification or an executed contract.
Version 2026-10-31-b2b-v2 · Previous version
Business processing instructions, confidentiality, safeguards and US/EU privacy schedules.
1. Incorporation, roles and execution
This DPA applies when incorporated into a private business agreement identifying the supplier as processor and the customer as controller, or identifying the appropriate controller/processor chain. Account administration, invoicing and legally required fraud prevention may involve separate controller activities described in the Privacy Policy. The signed processing schedule must identify the parties and contacts, actual processing locations/providers and any transfer mechanism. This public standard does not itself execute EU Standard Contractual Clauses or certify regulatory compliance.
2. Instructions and purpose limitation
The processor shall process covered personal data only on documented lawful customer instructions to deliver the selected service, unless law requires otherwise; where lawful, notify the customer of that requirement. Inform the customer if an instruction appears to infringe applicable data-protection law. Do not sell or share covered customer personal data for advertising, use it for unrelated profiling, or combine it with unrelated customer data except where permitted by the governing law and agreement. No training on customer content is authorized by these terms; any external AI processing must have verified corresponding provider terms.
3. Processing schedule: operations and duration
The service may involve local calculation, authorized server AI inference, record storage, encryption/ciphertext storage, access management, report export, notifications and deletion. Processing lasts for the service term and the lawful return/deletion period. The customer must specify selected operations and data paths in the private schedule before sending regulated data. Browser-local computation does not itself transmit those files to the supplier; customer exports or uploads to separate server features create a different processing path.
4. Processing schedule: subjects and categories
Ordinary service categories can include business-user names/emails, organization membership and identifiers, user-supplied trading records, business research/transcripts containing personal data, technical usage metadata and encrypted report payloads. Data subjects may include authorized staff, customer traders and persons lawfully included in submitted evidence. The customer must confirm actual categories, source rights and lawful basis. Do not submit special-category data, biometric identification data, children’s data or sensitive financial credentials unless expressly scoped with necessary safeguards. Audio stress metrics are decision-support estimates, not a verified diagnosis or identity determination.
5. Confidentiality and access
The processor shall bind authorized personnel to confidentiality and restrict access to those with a service need. Organization-scoped authorization and verified-account checks apply to business records. Optional private reports use browser-side AES-GCM with company-held keys and fresh nonces; keys and decrypted reports must not be sent to service servers, logs or analytics. Operational identifiers, membership, timestamps, size and billing metadata remain readable. Server AI and legacy records are not automatically ciphertext-only.
6. Technical and organizational measures
For the scoped service the parties shall document access authorization, transport protection, credential handling, tenant isolation, client-key custody, incident response, availability/recovery responsibilities and periodic testing appropriate to risk. Customer devices, key backups and partner proxies are customer responsibilities. These measures are risk-based obligations and described implementation boundaries, not evidence of a completed independent audit, guaranteed recovery time, certified encryption of every provider backup or universal zero retention.
7. Subprocessors and provider register
Use only authorized subprocessors subject to written obligations no less protective for their processing. Relevant service candidates are Lovable Cloud for hosting/auth/data services, AI providers reached through Lovable AI Gateway and Groq where selected, and Resend for application email. Dodo payment handling may be an independent-controller activity rather than processor activity and must be classified in the schedule. The exact legal provider names, model providers, functions, countries and contractual safeguards must be verified and recorded before covered server processing; this is not a complete verified register. No US-only or EU-only residency is promised.
8. Changes to subprocessors
Under general authorization, the processor shall provide at least 30 days’ advance notice of a proposed material subprocessor addition/replacement where practicable, with an opportunity for reasonable data-protection objections. Parties shall work toward a protective alternative; if no reasonable solution is available, the customer may discontinue the affected processing/service under agreed exit terms. An urgent security/legal replacement must be communicated promptly with its reason and safeguards. This is a contractual notice obligation, not a claim that automated notice infrastructure is deployed.
9. International transfers
For EU/EEA personal data transferred outside an adequate jurisdiction, establish a valid applicable transfer mechanism and necessary supplementary measures before transfer. Where required, execute the appropriate EU Standard Contractual Clauses with completed modules, parties and annexes and assess actual transfer risks. Do not infer compliance from encryption, a hosting brand or a country label. US state privacy processing terms apply where relevant; EU data-subject complaint and judicial rights cannot be displaced by a contract forum. If safeguards cannot be verified, restrict the affected server path instead of assuming it is compliant.
10. Requests and cooperation
The processor shall promptly forward covered data-subject requests to the customer and not respond substantively except on instructions or as legally required. Assist reasonably with access, correction, export, restriction/deletion, impact assessments and regulator inquiries, considering the service and information available. The customer determines responses, verifies identity and statutory deadlines. Use partnership@tradeeyes.tech for secure coordination; do not include raw client files or keys in initial email. Costs for exceptional assistance require advance written agreement and do not excuse mandatory obligations.
11. Personal-data incidents
After becoming aware of a covered personal-data breach, the processor shall notify the customer without undue delay and, where feasible, within 48 hours, using the private notice contacts. Provide known nature, affected categories/approximate scope, likely consequences, mitigation and contact details in phases as facts become available. This contractual target does not replace shorter legal duties or the controller’s GDPR assessment/notification duties, including the applicable 72-hour authority deadline. Notification is not an admission of liability; no current monitoring performance is represented.
12. Return, deletion and retention
At service end, follow the customer’s documented choice to return or delete covered personal data, unless law requires retention. Retain lawful exceptions only for the required purpose with access restriction. Local files/exports remain under customer control; service reports remain until authorized deletion or documented closure instructions. The private schedule must settle practical export timing, active-store deletion and backup expiry for actual providers before execution. No universal numeric backup-erasure guarantee is made. Company key destruction can render private ciphertext unreadable but does not delete readable operational or billing metadata or prove backup erasure.
13. Evidence, reviews and responsibility
Make reasonably necessary compliance information available and cooperate with proportionate reviews required by applicable law, protecting other customers and service security. Agree confidential evidence access and any independent review arrangements; never disclose another customer’s records, private keys or exploitable internal details. A manifest hash proves consistency, not correctness or certification. Each party remains responsible for its legal obligations; the SaaS allocation cannot remove data-subject compensation rights or processor obligations under mandatory law.
14. Required private annex and restricted use
Before reliance on this DPA, complete the contracting parties and roles; notices; products/data paths; subjects/categories; operations/duration; actual provider register and locations; instructions; retention/backup schedule; technical measures; transfer mechanism and any required SCC annexes. Until the relevant schedule and provider safeguards are settled, do not submit regulated personal data to an unverified server-processing path. Local workbenches and ciphertext storage still require customer data rights and appropriate device/key protection. A public standard cannot substitute for these execution facts.
Contact
Questions and contract requests: partnership@tradeeyes.tech.