Data Processing Agreement

Effective date: 11 November 2026 · Български

1. Who and what this covers

1.1. This Data Processing Agreement ("DPA") is between the business customer that accepted the ShipItFam Terms of Service ("you", the controller) and Avenara EOOD, UIC 208277161, 35V Kuklenski Pat Locality, 4107 Brestnik, Bulgaria ("we", the processor). It forms part of the Terms and applies for as long as we process personal data for you.

1.2. It meets Article 28 of the EU General Data Protection Regulation (GDPR). If this DPA and the Terms conflict on personal data, this DPA wins.

1.3. It covers personal data inside your projects that we process for you. It does not cover data for which we are the controller ourselves (your account, billing, support and the security of the Service), which our Privacy Policy covers.

2. The processing

3. Your instructions

3.1. We process the personal data only on your documented instructions. The Terms, this DPA, and your use and settings of the Service (such as approving a plan, approving Ship it, or connecting an app) are your instructions. We do not process it for our own purposes, and we do not use it to train AI models.

3.2. If we are required by EU or Member State law to process it otherwise, we tell you first, unless that law forbids it. We tell you at once if we believe an instruction breaks data protection law.

3.3. You are responsible for having a lawful basis for the personal data you put in the Service, and for informing the people concerned.

4. Confidentiality and security

4.1. Everyone at Avenara EOOD who can access the personal data is bound by confidentiality.

4.2. We keep the technical and organisational measures in Annex 1 in place, and may improve them, but never lower their overall level of protection.

5. Subprocessors

5.1. You give us general authorisation to use the subprocessors in Annex 2. We impose on each of them data protection duties that are at least as protective as this DPA, and we stay responsible for them.

5.2. We tell you at least 30 days before we add or replace a subprocessor, by email or in the app. You may object on reasonable data protection grounds within that time. If we cannot resolve it, you may end the affected plan before the change and we refund the unused part of what you paid.

5.3. Not our subprocessors. Services that you choose and sign in to with your own account act under your own agreement with them: Anthropic (Claude, through your own Claude login), OpenAI (ChatGPT, if you connect it), your git host, and the apps you connect through integrations. We send them data only on your instruction.

6. Helping you

6.1. Taking into account what we can reasonably do, we help you answer requests from people exercising their GDPR rights, and with security, breach notification, data protection impact assessments and prior consultation (GDPR Articles 32 to 36). If someone asks us directly, we pass the request to you and do not answer it ourselves unless you tell us to.

7. Personal data breaches

7.1. We tell you without undue delay, and in any case within 48 hours, after we become aware of a personal data breach affecting your data. We tell you what we know: what happened, the data and people likely affected, the likely consequences, and what we are doing about it, and we add details as we learn them.

8. International transfers

8.1. We host your projects in the European Union. We transfer personal data outside the EEA only as Annex 2 shows, and only with a safeguard under Chapter V of the GDPR: an adequacy decision (including the EU–US Data Privacy Framework for certified US providers) or the European Commission's standard contractual clauses.

9. Return and deletion

9.1. Your code is in your own git repository. At any time, and when the Terms end, you can export your other data as described in section 10.3 of the Terms.

9.2. When the Terms end and any export period is over, or when you delete a project, we delete the personal data we hold for you within 30 days, unless EU or Member State law requires us to keep it. Copies in backups are overwritten within 30 days after that.

10. Audits

10.1. We give you the information you reasonably need to show compliance with Article 28. You may audit us, or have an independent auditor bound by confidentiality do so, once a year or after a breach, with 30 days' notice, during business hours and without disrupting the Service. Each party bears its own costs. Where a written answer or a summary report reasonably answers your question, we provide that first.

11. Liability and term

11.1. The liability limits of the Terms apply to this DPA, except where the GDPR does not allow them.

11.2. This DPA ends when we no longer process personal data for you. Sections 9 and 10 apply until deletion is complete.

11.3. This DPA is governed by Bulgarian law, and the courts in section 14.3 of the Terms decide disputes.

Annex 1: Technical and organisational measures

• Isolation. On Builder and Fleet, the crew works inside a sealed container, per project. Each job works on its own copy of the project. Commands run in a sandbox that holds only that copy.
• Least access for the AI. The AI reads only the project it works on. Files that hold passwords and keys are off limits. Risky actions (deleting for good, admin rights, pushing code, publishing, connecting to other machines) stop and ask a person.
• Secrets. Git access keys and the Claude login are kept outside the database, in files only the service that needs them can read, never passed to the AI's commands, never shown back in the app and never written to logs. Integration tokens are encrypted by our self-hosted connection service (Nango).
• Access control. Sign-in through Supabase; roles per project; only a project lead can connect a Claude login or publish to production. Connected-app tokens are stored only as hashes and expire after 24 hours.
• Encryption in transit. All connections to the Service use TLS.
• Human approval. No code leaves for your repository and nothing is published without a person's approval.
• Security scanning. Every build step is scanned for leaked secrets, known vulnerabilities in added libraries and common weaknesses. Only package names and versions leave our servers for this.
• Hosting. Hetzner data centres in Germany and Finland, certified to ISO/IEC 27001; main database with Supabase in the EU (Ireland). Servers talk to each other over a private encrypted network.
• Backups and resilience. Managed daily database backups; your code also lives in your own repository.
• People. Access to production is limited to the people who run the Service, who are bound by confidentiality.
• Incidents. We log server events to detect abuse and errors, and we follow section 7 for breaches.

Annex 2: Subprocessors