Data Processing Agreement

This template is offered for customers who need a processor agreement. It should be read with the Privacy Policy and Subprocessors list. Legal review and signature (or click-wrap acceptance) may be required before it binds the parties.

1. Parties

Processor: the sole trader trading as VibePlan (also trading as ProcureLex and CommerceSans) operating VibePlan.

Controller: the customer organisation (or sole trader) that owns the workspace and determines the purposes of processing workspace content.

2. Subject matter and duration

Processing of personal data contained in workspace content and related service logs for the term of the customer's subscription and any residual deletion/export period.

3. Nature and purpose

Hosting, storage, retrieval, AI-assisted drafting, change-impact analysis, approvals, optional Connections under Controller instructions, support, and security monitoring as described in product documentation.

4. Categories of data subjects and data

• Controller personnel and invitees (account users)
• Individuals whose data the Controller chooses to include in Discovery, blueprints, uploads, or connected systems (customers, employees, prospects, etc.)
• Data types: identifiers, business contact details, and free-text business content; special-category data is not sought as a product purpose

5. Processor obligations

• Process only on documented instructions (including configuration in the product)
• Ensure confidentiality of persons authorised to process
• Implement appropriate technical and organisational measures (RLS, encryption in transit, access control, approval gates)
• Engage subprocessors listed at /legal/subprocessors; notify of material changes
• Assist with data-subject requests, DPIAs, and breach notification reasonably
• Delete or return workspace personal data on termination after export windows, subject to legal retention
• Make available information necessary to demonstrate compliance, subject to confidentiality

6. Controller obligations

• Ensure a lawful basis for personal data placed in the workspace
• Configure roles and Connections appropriately
• Not instruct processing that violates UK GDPR or the Acceptable Use Policy

7. International transfers

Where a subprocessor transfers personal data internationally, transfer tools in that subprocessor's terms (UK IDTA / UK addendum to SCCs or adequacy) apply as relevant.

8. Subprocessor annex (platform)

• Supabase — Authentication, PostgreSQL database, storage, and Row Level Security (EU (project region eu-west-2))
• Vercel — Application hosting, edge/serverless compute, and deploy infrastructure (Global edge/network; serverless/primary regions per Vercel project configuration)
• OpenRouter (LLM routing) — Primary platform LLM inference for blueprint generation and related AI features (OpenRouter (United States); upstream model provider locations vary by route)
• OpenAI — Labeled availability failover (e.g. gpt-5.4-mini) and optional embeddings paths (Per OpenAI data processing terms)
• Inngest — Durable workflow orchestration for generation and agent steps (United States (per Inngest security documentation))
• Resend — Transactional and support notification email (United States (per Resend GDPR documentation))
• Stripe — Subscription billing and payment processing (Stripe Payments Europe / global Stripe infrastructure per Stripe DPA)
• PostHog — Product analytics (funnels, activation) (EU Cloud when configured; host confirmation tracked in CIP-L-030)

9. Breach notification

Processor will notify Controller without undue delay after becoming aware of a personal data breach affecting Controller personal data, with information reasonably available to assist Controller's own notification duties. See our incident response plan for internal severity handling.

10. Governing law

England and Wales, unless the parties agree otherwise in writing.