Dit document is een concept en wordt juridisch getoetst. Gemarkeerde delen worden nog aangevuld.
Qodea Subprocessors
Version: 0.1 (draft) · Last updated: publication date
These are the providers Qualic LLC uses to deliver Qodea that may process personal data. This list is part of the Privacy Policy and of the Data Processing Agreement.
Changes: before adding or replacing a provider, we update this page and notify customers by email at least notice days, suggested 30 days in advance. You can object as described in the Data Processing Agreement.
Providers
| Provider | Entity | What for | What data | Where | Transfer safeguard |
|---|---|---|---|---|---|
| Amazon Web Services | Amazon Web Services, Inc. | Infrastructure for Qodea and for projects: accounts (Cognito), Qodea's database (DynamoDB), files (S3), site delivery (CloudFront), compute and backends (Lambda), builds (CodeBuild), logs (CloudWatch), key encryption (KMS) and verification emails | All of it: account data, customers' content and projects, End Users' data and technical logs | U.S. (us-east-1 region). CloudFront delivers sites from servers in several countries. | Certification under the EU-U.S. Data Privacy Framework (DPF) and the AWS data processing addendum with Standard Contractual Clauses (SCCs). confirm the AWS DPA is accepted for Qualic LLC's account |
| Anthropic | Anthropic, PBC | AI for designs and plans | What the customer writes in the chat and the steps, and project context (plan, code, variable names; never their values). End Users' data only if the customer copies it into the chat. | U.S. | Anthropic's data processing addendum with SCCs (Modules 2 and 3) and the UK Addendum. Not certified under the DPF. Does not train models on this data and deletes it within 30 days. |
| DeepSeek | Hangzhou DeepSeek Artificial Intelligence Co., Ltd. confirm the entity the API is contracted with | AI for writing code | Same as Anthropic | China | no safeguard is signed today. DeepSeek publishes no data processing agreement or SCCs, and its policy allows using the data to train its models |
| Neon | Neon, LLC (Databricks group) confirm the contracting entity | Postgres databases of generated projects (one per project) | End Users' data and any other data each project stores | U.S. (us-east-1 region) | DPF certification, according to its policy. sign Neon's data processing agreement and confirm it includes SCCs |
| Stripe (once payments are enabled) | Stripe, Inc. | Charging subscriptions and overage | Customer billing data: name, email, card details, amounts | U.S. | DPF certification, according to its policy, and Stripe's data processing agreement. confirm when payments are enabled |
| Google (only if the user signs in with Google) | Google LLC | Sign in with Google | Email, name and whether Google verified the email | U.S. | Google acts as an independent controller of its own processing. DPF certified. |
Notes
- End Users' data. The data of people who use customers' sites is processed only by AWS and Neon. It reaches the AI providers only if the customer copies it into the chat or the steps.
- Planned migration to Amazon Bedrock. We plan to use AI models through Amazon Bedrock (AWS, U.S.). With Bedrock, AWS does not share the text with the model's developer or use it to train models. When we do it, we will update this list and give the notice stated above. estimated date and whether it replaces DeepSeek, Anthropic or both
- Qualic's team. Qualic's team accesses data from Argentina, a country with an adequate level of protection recognized by the European Union. confirm from which countries the team has access