Data processing agreement

1. Subject matter and duration

The Processor processes personal data on behalf of the Controller as far as necessary to provide the services agreed in the terms of use. Processing begins with the use of delishy and ends when the main contract ends, subject to the rules on deletion and return in clause 9.

Terms such as “personal data”, “processing” or “personal data breach” have the meaning given in Regulation (EU) 2016/679 (GDPR).

2. Nature and purpose of the processing

The nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

Processing takes place in the European Union, except for AI processing by Anthropic in the USA and the worldwide delivery named in the list of subprocessors. For transfers to third countries, the Processor ensures appropriate safeguards under Chapter V GDPR.

3. Instructions

The Processor processes the data only on documented instructions from the Controller, including with regard to transfers to third countries, unless required to process by Union or Member State law; in that case it informs the Controller beforehand, as far as legally permitted.

Instructions are the main contract, this DPA and the Controller’s settings in the product. The Controller gives further instructions in text form. If the Processor considers an instruction unlawful, it informs the Controller without delay and may suspend execution until the instruction is confirmed or changed.

4. Confidentiality

The Processor ensures that persons authorised to process the data are bound by confidentiality or subject to an appropriate statutory duty of confidentiality. Access to the Controller’s data is limited to persons who need it to perform the service.

5. Security of processing

The Processor takes appropriate technical and organisational measures under Art. 32 GDPR as described in Annex 2. It develops the measures in line with the state of the art and may change them, provided it does not fall below the agreed level of protection.

6. Subprocessors

The Controller gives the Processor general authorisation to use subprocessors. The subprocessors in use when the contract is concluded are listed in the privacy policy.

If the Processor intends to add or replace subprocessors, it informs the Controller at least [to check: 30] days in advance in text form or through the product. The Controller may object for good cause within that period. In case of objection the parties seek an amicable solution; if none is found, the Controller may terminate the main contract extraordinarily as of the date the change takes effect.

The Processor binds each subprocessor by contract to the same data protection obligations as set out in this DPA and is liable to the Controller for compliance.

7. Assistance with data subject rights

The Processor assists the Controller with appropriate technical and organisational measures in responding to requests from data subjects to exercise their rights. If a data subject contacts the Processor directly, it forwards the request to the Controller without delay and does not respond itself.

The Processor also assists the Controller with data protection impact assessments and prior consultations with the supervisory authority (Art. 35 and 36 GDPR) as far as necessary for the processing.

8. Notification of breaches

The Processor notifies the Controller of a personal data breach without undue delay and at the latest within [48 hours, to check] of becoming aware of it. The notification contains, as far as known, the nature of the breach, the data and persons affected, likely consequences and measures taken or proposed. The Processor assists the Controller with its obligations under Art. 33 and 34 GDPR.

9. Deletion and return

After the main contract ends, the Processor makes the data available to the Controller for export and then deletes it, at the Controller’s choice within [30 days, to check], unless Union or Member State law requires storage. Data in backups is deleted in the regular cycle [to check: backup period]. On request, the Processor confirms deletion in text form.

During the term, the Controller can delete data itself in the product. Snapshots of source code are deleted regardless, as set out in Annex 1.

10. Evidence and audits

On request, the Processor provides the Controller with the information necessary to demonstrate compliance with this DPA. The Controller may carry out audits, including inspections, or have them carried out by an auditor bound to confidentiality. Audits take place after reasonable notice (at least [to check: 30] days), during normal business hours and without disproportionate disruption of operations; the Processor’s effort is to be remunerated reasonably [to check]. The Processor primarily meets this obligation through up-to-date certificates, reports or information.

11. Liability

Liability is governed by the terms of use. Liability towards data subjects under Art. 82 GDPR remains unaffected.

12. Final provisions

In case of conflict between this DPA and the terms of use, the provisions of this DPA prevail for the processing of personal data. Amendments require text form. German law applies; the place of jurisdiction is, as far as permitted, the Processor’s registered seat. If a provision is invalid, the validity of the others remains unaffected.

If customers are established outside the European Union or data is transferred to third countries, the parties agree the relevant standard contractual clauses where needed [to check].

Contact: privacy@delishy.ai.

Description of the processing

This annex specifies the nature, purpose, types of data, data subjects and duration of the processing under Art. 28 (3) GDPR.

Categories of data subjects

• Users of the Controller (members of the organisation)
• People depicted or named in source code or screenshots
• End customers of the Controller, as far as they appear in test data in source code or in screenshots

Types of personal data

• Account data (email address, name, role)
• Source code and configuration after cleaning of secrets
• Screenshots
• Brand kit (logos, colours, fonts, texts)
• Generated assets (videos, still images)
• Usage data (jobs, credit consumption, timestamps)

Special categories of personal data (Art. 9 GDPR) are not subject of the processing. The Controller does not bring them into the platform.

Purposes of the processing

• Snapshot of the connected source and detection of the interface
• Rebuilding the interface as a UI kit using AI
• Rendering videos and still images in various formats and languages
• Storage and delivery of the results

Duration of the processing

Snapshots of source code are deleted by default 7 days after the UI kit is approved [adjustable; to check]. All other data is processed for the term of the main contract and then deleted or returned under clause 9.

Overview

The Processor takes at least the following measures. Measures of subprocessors additionally follow from their documentation.

Confidentiality and access

• Role and permission model in the application (owner, admin, member, viewer)
• Tenant separation through row-level security in the database
• Access by staff to customer data only as needed [to check]
• Secrets and credentials in Supabase Vault
• Cleaning of secrets (.env files, keys, tokens) before source code is analysed

Encryption and transmission

• Encryption in transit (TLS)
• Encryption of stored data (at rest)
• Signed, short-lived download URLs for files

Isolation of customer code

• Kit code runs only in an isolated preview domain (sandboxed iframe, Content Security Policy)
• Render workers run without secrets and with the network blocked
• One render job per isolated virtual machine

Availability and recovery

• Data centres in the EU (Frankfurt), except for AI processing by Anthropic
• Regular backups [interval to check]

Traceability and organisation

• Audit log for security-relevant actions
• Incident process for security incidents and data breaches, including reporting channels
• Staff bound to confidentiality [to check]
• Regular review and further development of the measures [to check]