This DPA governs Quovec's processing of personal data contained in Customer Data. Customer is the controller (or a processor acting for its own controller); Quovec is the processor. Categories of data subjects: Customer's employees, contractors, managers, vendors, and guests. Categories of data: identification and contact data of staff; scheduling, attendance, and labor records; transaction/point-of-sale records; vendor and lease records. No special categories of data are required by the Service, and Customer agrees not to submit them. Duration: the subscription term plus the deletion window.
Quovec will: (a) process personal data only on Customer's documented instructions (the Agreement, this DPA, and configuration choices made in the Service), unless required by law — in which case Quovec will inform Customer unless prohibited; (b) ensure persons authorized to process the data are bound by confidentiality; (c) implement the technical and organizational measures in Annex A; (d) assist Customer, taking into account the nature of processing, with data-subject requests and with security, breach-notification, and impact-assessment obligations; (e) delete or return personal data at termination as set out in Section 6; and (f) make available information reasonably necessary to demonstrate compliance, including the audit rights in Section 7.
Customer generally authorizes the subprocessors below. Quovec will provide at least [15] days' notice (email or in-product) before adding or replacing a subprocessor; Customer may object on reasonable data-protection grounds, and if the objection cannot be resolved, Customer may terminate the affected service with a pro-rata refund of prepaid fees. Quovec remains responsible for its subprocessors' performance and imposes data-protection terms no less protective than this DPA.
| Subprocessor | Purpose | Location |
|---|---|---|
| Supabase (on AWS) | Managed Postgres database; authentication | United States (us-east-1) |
| Fly.io | Application hosting (Hermes COO Engine™) | United States (iad) |
| Cloudflare | Content delivery, DNS, network security | Global edge; U.S. control |
| Anthropic | Plain-language narration of computed findings (no training on Customer Data) | United States |
| [Email provider] | Transactional email (briefs, auth mail) | United States |
Quovec maintains, at minimum, the measures in Annex A, and will not materially degrade them during the term.
Quovec will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Data, providing the information reasonably available: nature and scope, categories and approximate volumes affected, likely consequences, and measures taken or proposed. Quovec will cooperate with Customer's reasonable investigation and remediation. Notification is not an admission of fault.
For [30] days after termination, Customer may export Customer Data via the Service or by written request. Thereafter Quovec will delete Customer Data (including from backups on backup-expiry cycles not exceeding [35] days), except where retention is required by law, and will confirm deletion on request. De-identified, aggregated data that cannot reasonably identify any person or Customer is not personal data and may be retained.
No more than once per 12 months and on 30 days' notice, Customer may audit Quovec's compliance with this DPA by: (a) reviewing Quovec's then-current security documentation, penetration-test summaries, and (when available) third-party audit reports (e.g., SOC 2); and (b) if those are insufficient to meet a legal obligation, a remote or on-site review during business hours under confidentiality, at Customer's expense, without access to other customers' data. Regulator-mandated audits are accommodated as required by law.
Quovec will promptly forward to Customer any request received directly from a data subject relating to Customer Data and will not respond except to direct the individual to Customer, unless legally required. For U.S. state privacy laws (e.g., CCPA/CPRA and equivalents), Quovec acts as a "service provider"/"processor": it will not sell or share personal information; will not retain, use, or disclose it other than to perform the Services or as permitted by law; will not combine it with data from other sources except to perform the Services; and certifies it understands these restrictions.
Processing occurs in the United States. Where Customer Data is subject to GDPR/UK GDPR, the parties incorporate the EU Standard Contractual Clauses (Module 2 or 3, as applicable) and the UK Addendum by reference as Annex B [attach before signature for EU/UK customers], with Quovec as data importer.
Each party's liability under this DPA is subject to the limitations of liability in the Agreement. If this DPA conflicts with the Agreement regarding processing of personal data, this DPA controls.
| Domain | Measure (engineering-enforced where noted) |
|---|---|
| Tenant isolation | Per-tenant row-level security enforced at the database on every tenant table (FORCE RLS), verified by automated tests in CI; application connects via a least-privilege role that cannot bypass RLS; boot-time guard refuses unsafe roles. Region-level access scoping for manager roles. |
| Encryption | TLS 1.2+ in transit; AES-256 encryption at rest (managed database and backups). |
| Authentication | Asymmetric (ES256) signed tokens verified against a published key set; issuer and audience validation; MFA available and enforced for administrative roles; no anonymous access to tenant data. |
| Authorization | Deny-by-default action gating: every tool/agent action is registered with an explicit permission and role; sensitive actions (payments, communications, configuration) require human approval and are queued, never auto-executed. |
| AI safeguards | Language models generate narrative text only; all figures, scores, and decisions are computed deterministically in code; model output is schema-validated before persistence; no training on Customer Data. |
| Logging & audit | Tamper-evident audit log of dispatched actions (held / executed / approved), with actor and timestamp. |
| Resource protection | Per-tenant usage budgets; statement and connection limits; idempotent writes. |
| Secrets & access | Secrets stored in encrypted platform vaults (not in source control); least-privilege credentials; personnel access on a need-to-know basis. |
| Availability | Managed, replicated database with scheduled backups [+ point-in-time recovery on production plan]; health-checked application instances with automatic restart. |
| Personnel | Confidentiality obligations; security review of changes; background of vendor certifications reviewed (subprocessors: SOC 2 / ISO 27001 certified platforms). |