Data Processing Agreement

1. Roles

For Customer Data containing personal data, the Customer is the Controller and Tulvo is the Processor. For Tulvo's own account/billing/website data, Tulvo is the Controller.

2. Scope and instructions

Tulvo processes personal data only (a) to provide the Service, (b) per the Customer's documented instructions (including AI features the Customer invokes), and (c) as required by law (with notice unless prohibited).

3. Confidentiality

People authorized to process personal data are required to keep it confidential.

4. Security

Tulvo implements the measures described in Schedule 2 and will not materially decrease overall security during the term.

5. Subprocessors

The Customer authorizes the subprocessors in Schedule 3 (and on our Subprocessors page). Tulvo imposes data-protection terms on each no less protective than this DPA and remains liable for them. We give at least 30 days' notice of changes via the Subprocessors page, during which the Customer may object on reasonable grounds by emailing support@tulvo.io. Tulvo will review the objection.

6. Data-subject requests

Tulvo assists the Controller, through appropriate measures and insofar as possible, in responding to requests from data subjects. If a data subject contacts us directly, we refer them back to the Controller.

7. Personal data breaches

Tulvo notifies the Controller without undue delay (and within 72 hours of becoming aware) of a breach affecting Customer Data, with information needed for the Controller's own obligations.

8. Assistance

Tulvo provides reasonable assistance with DPIAs and prior consultations, considering the nature of processing and information available.

9. Deletion or return

After termination, Customer Data stays in the Customer's account (on the Free plan) until the Customer deletes it or asks us to. Customers can export individual views (CSV, PDF, Markdown or JSON) at any time. On written request, Tulvo deletes Customer Data from its production systems within 30 days, except where retention is required by law. Residual copies in backups and logs are deleted on their normal cycle.

10. Audits

Tulvo makes available information to demonstrate compliance and allows audits, which may be satisfied by third-party reports/certifications or a questionnaire; on-site audits by reasonable prior notice under confidentiality.

11. International transfers

Tulvo processes Customer Data in the United States (AWS us-west-2, Oregon). For personal data subject to GDPR/UK GDPR, the EU Standard Contractual Clauses (Module Two: Controller-to-Processor) and the UK IDTA/Addendum are incorporated by reference and completed in Schedule 4.

Schedule 1 - Processing details

Subject matter: provision of the Tulvo Service.

Duration: the term of the Terms of Service.

Nature & purpose: hosting, storage, processing, and AI-assisted generation on the Customer's instructions. Types of personal data: as determined by the Customer (names, contact details, application/employment data, customer records, and any personal data the Customer stores).

Data subjects: as determined by the Customer (e.g., the Customer's staff, customers, contacts, applicants).

Schedule 2 - Technical & organizational measures (TOMs)

Encryption in transit (TLS). At-rest encryption of RDS/S3. Role-based access controls in the product; production access limited to a small number of authorized personnel; secure credential storage (hashing); AWS Cognito authentication. Hosted on AWS, primarily in us-west-2 (ECS Fargate, EC2, Amplify, RDS PostgreSQL, ElastiCache, DynamoDB, S3, SQS, Lambda), delivered through Amazon CloudFront's global network, with real-time sync on Google Cloud Firestore (US).

Network and application security controls; logging and monitoring (application/firewall logs retained ~90 days). Automated database backups (7-day rolling restore). A controlled release process for production changes.

Monitoring and alerting for production incidents, with breach notification as described in Section 7.

Schedule 3 - Subprocessors

Current subprocessors include AWS (incl. Cognito, SES), Google (Firebase, Tag Manager, Workspace, YouTube), OpenAI, Stripe, Google Analytics, Meta, Microsoft Clarity, Sentry, Partnero, Cal.com, Iframely; optional integrations Slack, Google, Notion, GitHub. We may add subprocessors and will continue to update this list.

Schedule 4 - Transfer mechanisms

EU SCCs (Module Two) with docking clause, Annexes populated from Schedules 1–3; UK IDTA/Addendum; Swiss amendments where applicable.