Legal

Data Processing Agreement

Last updated October 14, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between LockedVibe, 9200 NW 39th Ave, Ste 130-3177, Gainesville, FL 32606, USA ("LockedVibe", "processor") and the customer who orders a service ("Customer", "controller"). It applies automatically to every order and is accepted at intake. It meets the requirements of Article 28 of the EU GDPR and the UK GDPR.

1. Roles and scope

Customer is the controller, and LockedVibe the processor, of any personal data about Customer's end users that LockedVibe accesses while reviewing Customer's app, repository or configuration ("Customer Personal Data"). LockedVibe processes it only to perform the purchased security review and fixes. Data about Customer itself (contact, order and payment details) is covered by our Privacy Policy, where LockedVibe is controller.

2. Details of processing

  • Subject matter and purpose: security review of Customer's app and delivery of findings and fixes.
  • Duration: the service period, until delivery (for Monitor, until cancellation).
  • Nature: read access, automated and AI-assisted analysis, minimal viewing needed to confirm an exposure.
  • Data subjects: Customer's end users and staff.
  • Categories of data: whatever is stored in or reachable from the app, typically names, email addresses, account identifiers and user-generated content.
  • Excluded data: LockedVibe does not accept apps that process protected health information (PHI) under HIPAA or other special-category health data. Customer confirms its app contains none.

3. LockedVibe's obligations

  • Process Customer Personal Data only on Customer's documented instructions (the order, intake and these terms), unless law requires otherwise, in which case we will tell Customer first where the law allows.
  • Look only as far as needed to confirm a finding, never copy Customer Personal Data into reports, and never use it to train AI models.
  • Confidentiality: ensure everyone authorized to process Customer Personal Data is bound by confidentiality.
  • Security: apply the measures in section 6 and on our Security page, as required by Article 32.
  • Assist Customer, taking into account the nature of the processing, with data subject requests, security, breach notification, impact assessments and prior consultation (Articles 32 to 36).
  • Make available the information needed to demonstrate compliance with this DPA and allow reasonable audits, including by written questionnaire, at Customer's cost and on reasonable notice.
  • Tell Customer immediately if an instruction, in our opinion, infringes data protection law.

4. Subprocessors

Customer gives general authorization for the following subprocessors:

  • Cloudflare, Inc.: hosting, intake processing, email routing.
  • Stripe, Inc.: payments (no Customer Personal Data).
  • Kit (ConvertKit LLC): email to Customer (no Customer Personal Data).
  • Resend (Plus Five Five, Inc.): transactional email (no Customer Personal Data).
  • GitHub, Inc.: repository access and pull requests.

We impose data protection obligations on each subprocessor equivalent to this DPA and remain responsible for them. We will update this list and give notice by email at least 14 days before adding or replacing a subprocessor that may process Customer Personal Data; Customer may object on reasonable grounds and, if we cannot resolve it, cancel the affected order for a refund of unperformed work.

5. Personal data breaches

We will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information reasonably available to help Customer meet its own notification duties, and we will take reasonable steps to contain and remedy it.

6. Security measures

  • Read-only access by default; access removed at delivery.
  • Isolated working environment per job; encryption in transit.
  • Secrets found are masked and never reused or stored.
  • Non-destructive checks only.

7. Deletion and return

We keep a temporary clone of Customer's code only until delivery, then delete it and remove our access. Customer Personal Data is not retained after delivery (for Monitor, after cancellation), except where law requires retention. Customer may ask for return of any data instead before delivery.

8. International transfers

LockedVibe is based in the United States. Transfers of Customer Personal Data from the EU/EEA, UK or Switzerland are made under the European Commission's Standard Contractual Clauses (Module 2 or 3 as applicable, with the UK Addendum where relevant), which are incorporated by reference into this DPA, or under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where the recipient is certified.

9. General

This DPA lasts as long as LockedVibe processes Customer Personal Data. If it conflicts with the Terms, this DPA prevails for data protection matters. Liability is subject to the limits in the Terms, except where law does not allow them. Questions: support@lockedvibe.com.