Qodea Data Processing Agreement

Version: 0.1 (draft) · Last updated: publication date

The short version

• If the sites you publish with Qodea have users (accounts, forms, orders), you are the controller of their data and Qualic processes it on your behalf as a processor.
• We use that data only to host and run your projects, following your instructions.
• We tell you which providers we use, we notify you before adding one, and you can object.
• If a security incident affects that data, we tell you without delay and within 48 hours at most.
• When you leave, we delete the data.

1. Parties and scope

1.1. This Agreement is between you, the Qodea customer ("Customer"), and Qualic LLC, a Delaware limited liability company ("Qualic"). It is part of the Terms of Service and you accept it together with them.

1.2. It applies when Qualic processes Customer Data: personal data of your projects' End Users (or of anyone else) that is stored in or flows through the projects you publish with Qodea.

1.3. It does not apply to the data of your own Qodea account (your email, your chat requests, your use of the service). For that data Qualic is the controller, and the Privacy Policy governs it.

1.4. If this Agreement and the Terms differ on personal data, this Agreement prevails. If this Agreement and the transfer clauses in section 11 differ, those clauses prevail.

2. Definitions

• Data Protection Laws: the laws that apply to the processing of Customer Data, including the EU General Data Protection Regulation (GDPR), the UK GDPR, Argentina's Law 25,326, Brazil's LGPD, Mexico's LFPDPPP and U.S. state privacy laws (such as California's CCPA).
• Data Subject: the person the data relates to.
• Subprocessor: a provider Qualic engages to carry out part of the processing of Customer Data.
• Security Incident: unauthorized access to, or loss, destruction, alteration or disclosure of, Customer Data under the control of Qualic or its Subprocessors.

Other terms ("controller", "processor", "processing", "personal data") have the meaning given by the Data Protection Laws.

3. Roles

3.1. The Customer is the controller of Customer Data. If the Customer itself acts as a processor for someone else, Qualic acts as its sub-processor and this Agreement still applies.

3.2. Qualic is the processor. It processes Customer Data only on the Customer's behalf.

3.3. The details of the processing (what data, whose, why and for how long) are in Annex 1.

4. Customer obligations

The Customer:

• decides what data its projects collect and why, and has a legal basis to do so;
• informs its End Users through its own privacy policy and asks for consent where needed;
• answers its End Users' requests (access, correction, deletion, etc.);
• does not use Qodea to process sensitive data or children's data, unless agreed in writing with Qualic;
• checks that the AI-generated code handles data properly before publishing it;
• makes sure its instructions comply with the Data Protection Laws.

5. Instructions

5.1. Qualic processes Customer Data only on the Customer's documented instructions. These are: the Terms, this Agreement, each project's settings, and the Customer's use of Qodea features (for example, publishing a project, connecting a domain, downloading code or deleting a project). Any other instruction must be agreed in writing.

5.2. If Qualic believes an instruction breaches the Data Protection Laws, it tells the Customer and may hold off on it until it is clarified.

5.3. Qualic may process Customer Data without an instruction if a law requires it. In that case it tells the Customer first, unless that law forbids it.

5.4. AI. Qodea does not send data stored in projects' databases to AI providers. If the Customer copies Customer Data into the chat or the steps, that data is sent to the AI providers listed in the Privacy Policy, and this counts as the Customer's instruction. We recommend not doing so. confirm that no Qodea flow sends data from the project database or the backend logs to the AI

5.5. United States. Where the CCPA or a similar state law applies, Qualic acts as a "service provider" or "processor" and: does not sell or share Customer Data; does not retain, use or disclose it outside the direct business relationship with the Customer or for any purpose other than providing the service; does not combine it with data from other sources except as the law allows; and notifies the Customer if it can no longer meet these obligations.

6. Confidentiality

Only Qualic personnel who need it to run the service, provide support, investigate abuse or comply with the law access Customer Data. All of them are bound by confidentiality by contract or by law.

7. Security

7.1. Qualic applies the technical and organizational measures in Annex 2, appropriate to the risk of the processing.

7.2. Qualic may change those measures as long as the level of protection does not decrease.

7.3. The security of each project's code (what the AI generates and what the Customer changes) and of the keys the Customer adds is the Customer's responsibility.

8. Subprocessors

8.1. The Customer authorizes Qualic to use the Subprocessors in the list of subprocessors.

8.2. Qualic imposes on them by contract data protection obligations equivalent to those in this Agreement, and is responsible to the Customer for their acts, under the terms of this Agreement.

8.3. Changes. Before adding or replacing a Subprocessor, Qualic updates the list and notifies Customers by email at least notice days, suggested 30 days in advance. This includes the planned migration of AI to Amazon Bedrock.

8.4. Objection. The Customer may object within that period, on reasonable data protection grounds, by writing to contacto@qualic.dev. The parties will look for a solution in good faith. If they don't find one, the Customer may cancel the affected part of the service and Qualic refunds any prepaid fees for the period it won't use.

8.5. If a Subprocessor must be replaced urgently (for example, because of a security problem), Qualic may do so first and give notice as soon as possible; the right to object still applies.

9. Help with Data Subject requests and other obligations

9.1. If an End User writes to Qualic to exercise their rights, Qualic forwards the request to the Customer and tells the person to contact the Customer. Qualic does not answer the request itself unless the Customer authorizes it or the law requires it.

9.2. Qualic helps the Customer answer those requests with reasonable technical and organizational measures, taking into account the nature of the processing. which tools the Customer has to view, export and delete data in its project's database

9.3. Qualic also helps the Customer, with the information it has, carry out impact assessments and prior consultations with authorities where the Data Protection Laws require them.

10. Security Incidents

10.1. If Qualic confirms a Security Incident, it notifies the Customer without undue delay and within 48 hours at most after confirming it, so the Customer can meet the GDPR's 72-hour deadline and the deadlines of other laws.

10.2. The notice goes to the Customer's account email and includes, as far as known: what happened, what data and approximately how many Data Subjects were affected, the likely consequences, the measures Qualic has taken or proposes, and a contact. If not everything is known, Qualic reports in stages.

10.3. Qualic takes reasonable steps to contain the incident and reduce its effects.

10.4. The Customer decides whether to notify authorities and Data Subjects. Qualic does not do so for the Customer, unless agreed or required by law.

10.5. Notifying an incident is not an admission of fault or liability by Qualic.

11. International transfers

11.1. Qualic is a U.S. company. Customer Data is stored in the U.S. (AWS and Neon us-east-1 region). Qualic's team accesses it from Argentina. confirm from which countries the team has access Subprocessors and their locations are in the list of subprocessors.

11.2. European Union and European Economic Area. Where the Customer transfers Customer Data from the EU or EEA to Qualic, the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914 ("SCCs") apply and are incorporated into this Agreement as follows:

• Module 2 (controller to processor) if the Customer is a controller, and Module 3 (processor to processor) if the Customer is a processor.
• The Customer is the data exporter and Qualic the data importer.
• Clause 7 (docking clause): does not apply.
• Clause 9: option 2 (general authorization), with the notice period in section 8.3.
• Clause 11: the independent dispute resolution body option does not apply.
• Clauses 17 and 18: the law and courts of Member State, e.g. Ireland.
• Clause 13: the supervisory authority determined under that clause.
• Annex I of the SCCs: Annex 1 of this Agreement. Annex II: Annex 2. Annex III: the list of subprocessors.

11.3. United Kingdom. For transfers from the UK, the International Data Transfer Addendum to the SCCs issued by the ICO applies, completed with the information in section 11.2 and the Annexes of this Agreement. Either party may end the UK Addendum as provided in its section 19.

11.4. Switzerland. For transfers from Switzerland, the SCCs in section 11.2 apply, with references to the GDPR read as including the Swiss data protection law and the competent authority being the Federal Data Protection and Information Commissioner (FDPIC).

11.5. Argentina. For transfers from Argentina, the model contractual clauses of the Agency for Access to Public Information (AAIP) for controller-to-processor transfers approved by AAIP Resolution 198/2023 apply, without changes, with the Customer as exporter and Qualic as importer. confirm with counsel whether incorporation by reference is enough or they must be signed as an annex

11.6. Brazil. For transfers from Brazil, the standard contractual clauses of ANPD Resolution CD/ANPD 19/2024 apply, without changes. confirm with counsel how to incorporate them

11.7. Transfers to Subprocessors. Qualic transfers Customer Data to its Subprocessors only with a safeguard valid under the Data Protection Laws (for example, the SCCs with Module 3). safeguard signed with each Subprocessor; there is none with DeepSeek today

11.8. On request, Qualic gives the Customer the reasonable information it has to assess the laws of the destination country.

12. Requests from authorities

If an authority asks Qualic for access to Customer Data, Qualic: tells the Customer, unless the law forbids it; checks that the request is lawful and challenges it where there are reasonable grounds; and discloses only the minimum required.

13. Return and deletion

13.1. While using Qodea, the Customer can download the code of every version of its projects. how the Customer can export the data in a project's database

13.2. When the Customer deletes a project or its account, or when the Terms end, Qualic deletes Customer Data within period, e.g. 30 days, unless a law requires it to keep it. Anything kept remains protected by this Agreement.

13.3. On request, Qualic confirms the deletion in writing.

14. Audits

14.1. Qualic gives the Customer the information needed to show that it complies with this Agreement, for example by answering reasonable security questionnaires.

14.2. If that information is not enough, or if an authority or the law requires it, the Customer may audit compliance with this Agreement:

• with at least 30 days' notice, except after a Security Incident;
• no more than once a year, unless an authority requires it;
• at its own cost, during business hours and without disrupting the service;
• itself or through an independent auditor bound by confidentiality;
• without access to other customers' data or to information that would compromise the security of the service.

14.3. Where the SCCs apply, they are read in line with this section.

15. Liability

Each party's liability under this Agreement is subject to the limits in the Terms, except where the Data Protection Laws or the SCCs do not allow it to be limited.

16. Term and changes

16.1. This Agreement applies for as long as Qualic processes Customer Data.

16.2. Qualic may update it to reflect changes in the law or the service, with notice as provided in the Terms. A change may not materially reduce the protection of Customer Data without the Customer's agreement.

16.3. Governing law and jurisdiction: those of the Terms, except as provided by the clauses in section 11.

16.4. Language: if the Spanish and English versions differ, the English version prevails, unless a rule that applies to you requires otherwise.

Annex 1. Details of the processing

Exporter / controller	The Customer, identified by its Qodea account details
Importer / processor	Qualic LLC, domicilio de Qualic LLC, contacto@qualic.dev
Subject matter and nature	Hosting, storing, delivering and running the Customer's projects: database and file storage, page delivery through the content delivery network, backend execution, technical logs, deletion.
Purpose	Providing the Customer with hosting and execution of its projects.
Data Subjects	End Users and visitors of the Customer's projects, and anyone else whose data the Customer puts into its projects.
Categories of data	Whatever the Customer decides. With the platform's accounts module: email, password hashed with scrypt (never in plain text) and sessions (only a hash of the token). Plus the data the project's code stores (for example, forms or orders), what the backend writes to its logs, and access logs (date and time, requested page, bytes sent, response code and domain).
Sensitive data	Not expected. Only with written agreement.
Frequency	Continuous, while the project is published.
Duration and retention	For as long as the service lasts, plus the deletion period in section 13. Build logs: 14 days. Access logs: period. Backend logs: period; currently no expiry is configured.
Subprocessors	See the list of subprocessors.

Annex 2. Security measures

Encryption and keys

• Qodea and published sites are served over HTTPS, including custom domains, with certificates that AWS manages and renews.
• Environment variable values and database connection strings are stored encrypted with AWS KMS, with automatic key rotation. Each value is bound to its project: it cannot be decrypted in another project.
• Sensitive values are not shown again after they are saved, are not sent to the AI and are not written to logs. A filter hides secrets in text sent to the AI.

Isolation

• Each project with a backend has its own Postgres database on Neon (us-east-1) and its own AWS Lambda function, with minimal permissions.
• Generated code is built in an isolated environment (AWS CodeBuild) whose role can only read that build's sources and write its output; it has no access to Qodea's database or to other projects.
• Project files are kept in private storage that only the content delivery network can read.
• A site's calls to its backend go through the network edge and are signed.

End Users' accounts (the platform's accounts module, in TypeScript and Python)

• Passwords stored with scrypt, with OWASP-recommended parameters and a random salt.
• Sessions use a random token in a secure, HttpOnly, SameSite=Lax __Host- cookie; only its hash is stored in the database.
• After 5 wrong passwords in 15 minutes, the email is locked for the rest of that window.

Qodea accounts and internal access

• Qodea accounts use Amazon Cognito. Sessions last 1 hour and are renewed with a revocable 30-day token, in secure, HttpOnly cookies.
• The team accesses AWS only through single sign-on (SSO), without long-lived access keys. Provider keys are kept as infrastructure secrets, not in the code.

Other

• Daily AI usage limits per account and spending caps per project.
• add only if they exist: backups, security monitoring and alerts, access reviews, incident response plan, team training