Data Processing Agreement (Article 28 GDPR)

This Data Processing Agreement ("DPA") applies between you (the Controller) and CodifyAI SRL trading as AppUnblock (the Processor) where, in providing the service, we process personal data of your end-users contained in files, repositories or accounts you provide. It forms part of, and is governed by, our Terms.

1. Subject-matter and roles

You are the controller of your end-users' personal data; we are your processor. We process that data only to provide the rejection-rescue service you purchased.

2. Duration

For the duration of the engagement. On completion we delete the data within 7 days (see clause 8).

3. Our obligations (Art. 28(3))

We will: - (a) process the personal data only on your documented instructions (including for transfers), unless required by EU/Member-State law, in which case we inform you unless legally prohibited; - (b) ensure persons authorised to process the data are bound by confidentiality; - (c) implement appropriate technical and organisational measures (Art. 32) — encryption at rest, least-privilege time-boxed access, access logging; - (d) engage sub-processors only with your general authorisation and on equivalent data-protection obligations, remaining liable for their performance (current sub-processors below); - (e) assist you by appropriate measures with responding to data-subject requests (Art. 12–23); - (f) assist you with security, breach-notification, DPIA and prior-consultation obligations (Art. 32–36); - (g) at your choice, delete or return all the personal data after the end of the engagement (we delete within 7 days); - (h) make available the information needed to demonstrate compliance and allow and contribute to audits.

4. Sub-processors

Hetzner Online GmbH (Germany) — EU hosting / infrastructure.
Our EU-based mail server — transactional email.
Cloudflare, Inc. — CDN, TLS and DDoS protection (processes IP addresses and request metadata in transit).
CodAI AI gateway (ai.codai.ro), and through it the model provider Anthropic, PBC (Claude) — engaged only to generate an automated fix kit, and only from your store-rejection text and our playbook (never your source code). The gateway does not retain full message content for standard use (a truncated extract of up to 500 characters is encrypted and kept for at most 7 days for routing and abuse-prevention, then deleted; technical metadata for at most 30 days). Anthropic processes under its API/commercial terms, which do not use API traffic to train its models by default.

Stripe, Inc. processes payment data as an independent controller, not as our sub-processor (see the Privacy policy).

5. International transfers

We keep end-user data within the EU (see the Privacy policy). Any transfer outside the EEA is made only under an adequacy decision or appropriate Art. 46 safeguards.

6. Your warranties

You warrant that you have a lawful basis for the end-user personal data you provide and have given the notices required under Articles 13–14 GDPR.

7. Breach

We notify you without undue delay after becoming aware of a personal-data breach affecting your end-users' data.

A counter-signed copy is available on request to [email protected].