Data Processing Agreement

1. Parties and roles

This Agreement is between you (the Customer, acting as the data controller) and Lova, operator of the Lova Plus platform at https://plus.lova.dev (the Processor). It governs the Processor's handling of personal data on the Customer's behalf and supplements our Terms and Privacy Policy.

2. Definitions

“Personal data,” “processing,” “controller,” “processor,” “data subject,” and “personal data breach” have the meanings given in the EU General Data Protection Regulation (GDPR) and equivalent applicable data protection laws. “Subprocessor” means a third party engaged by the Processor to process personal data.

3. Details of the processing

• Subject matter & purpose. Providing the Lova Plus website-generation and hosting service to the Customer.
• Duration. For the term of the Customer's account, plus the retention periods in our Privacy Policy.
• Nature of processing. Storage, generation, transmission, and display of Customer content; account and billing operations.
• Types of personal data. Account identifiers (name, email), authentication data, billing references, content the Customer submits, and technical data (IP, device, logs).
• Categories of data subjects. The Customer's own users, contacts, and the Customer's authorized account holders.

4. Processor obligations

• Process personal data only on the Customer's documented instructions, including this Agreement.
• Ensure personnel authorized to process personal data are bound by confidentiality.
• Implement appropriate technical and organizational measures (Section 6).
• Not use Customer content to train AI models, and never sell Customer data.
• Assist the Customer, taking into account the nature of processing, with its own compliance obligations.

5. Subprocessors

The Customer authorizes the Processor to engage the subprocessors listed on our Security page (currently Cloudflare, Supabase, OpenRouter, Anthropic, Stripe, Resend, and Sentry). Each subprocessor is bound by data-protection terms no less protective than this Agreement. We will give the Customer reasonable prior notice of any new subprocessor and an opportunity to object.

6. Security measures

The Processor maintains, at minimum, the controls described on our Security page, including:

• Encryption in transit (TLS 1.3) and at rest (AES-256).
• Row-level data isolation, deny-by-default, scoped to the owning account.
• Secrets and privileged credentials held server-side only.
• Per-IP rate limiting on public, cost-bearing endpoints.
• Error monitoring and security logging without storing prompts, emails, or secrets.

7. Data subject requests

Taking into account the nature of the processing, the Processor will assist the Customer by appropriate technical and organizational measures, insofar as possible, in responding to requests from data subjects to exercise their rights (access, rectification, erasure, restriction, portability, and objection).

8. Personal data breach

The Processor will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data, and will provide information reasonably available to help the Customer meet its own notification obligations. Report suspected issues to securityplus@lova.dev.

9. International data transfers

Customer data is currently stored in the United States. Where personal data is transferred out of the EEA, UK, or Switzerland, such transfers will rely on a lawful transfer mechanism (for example, the EU Standard Contractual Clauses) where required. EU data residency is on our roadmap.

10. Return and deletion

On termination, and at the Customer's choice, the Processor will delete or return Customer personal data, and delete existing copies unless retention is required by law. Deletion requests are honored within 30 days, consistent with our Privacy Policy.

11. Audits and information

The Processor will make available information reasonably necessary to demonstrate compliance with this Agreement. As formal attestations (such as SOC 2 and ISO 27001) are completed, they will be offered in place of on-site audits where appropriate. Those certifications are in progress and not yet achieved.

12. Term and order of precedence

This Agreement takes effect when both parties accept it and remains in force for as long as the Processor processes personal data on the Customer's behalf. In the event of a conflict on data-protection matters, this Agreement prevails over the Terms. All other terms remain in full effect.

Contact

Questions about this draft, or to request an executed DPA: hello@lova.dev