Vibelets
Vibelets

Data processing agreement

Version 2026-10-28.2 · Effective 28 October 2026

This Data Processing Agreement (“DPA”), including its annexes, forms part of the Vibelets Terms of Service where Locoda processes personal data on the Customer's behalf. The Customer must provide the identity and authority information described below before using the service on behalf of an organisation or another controller. This DPA does not turn Locoda's separate controller activities into processing on the Customer's behalf.

This Vibelets-specific text has been reviewed against the controller–processor model in Commission Implementing Decision (EU) 2021/915. It adapts that model to the service and is not represented as the Commission's unmodified standard contractual clauses. The separate international-transfer clauses under Decision (EU) 2021/914 are addressed in section 6 and Annex 4.

1. Parties and scope

This agreement governs processing by Locoda Oy, Finnish Business ID 3493423-1, c/o A-Grid, Otakaari 5 A, 02150 Espoo, Finland (“Processor”), on behalf of the customer under the Vibelets service agreement (“Customer”). The address was checked against the PRH/YTJ company record on 28 October 2026. The Customer may be an individual or an organisation represented by an authorised account holder. An employee is not automatically the controller personally merely because they build the application.

It applies where Locoda processes personal data on the Customer's behalf to provide Vibelets. The Customer acts as controller, or as a processor authorised by its controller to engage Locoda as a sub-processor. The parties' actual activities determine their roles. Locoda's separate processing for its own account administration, billing, proportionate security and support purposes is described in the privacy statement and is not converted into processor activity by this agreement.

Where the Customer is itself a processor, it must identify the upstream controller, have the required authority to engage Locoda and its onward sub-processors, and communicate only instructions within that authority. Locoda's obligations under this agreement apply as sub-processor with the equivalent protection required by Article 28(4). The Customer's controller agreement and relevant restrictions must be reflected in the documented instructions. Merely signing this agreement does not create upstream authorisation or change the Customer into a controller.

Customer information by email: before processing personal data on behalf of an organisation or another controller, the account holder must send support@vibelets.app the legal name, address, business/registration number where applicable, account email, representative's name and position, and privacy/incident contact. State whether the Customer acts as controller or processor; in the latter case identify the upstream controller and confirm the required subcontracting authority. The Customer must ensure these details are correct, keep them current and provide evidence of authority on reasonable request. Do not send app records, identity-document copies or other unnecessary personal data with this notification. Supplying these details by email does not require a separate organisation-management interface and does not remove Locoda's own obligations.

2. Processing and documented instructions

The subject matter, purposes, data subjects, data categories, operations and duration are specified in Annex 1. The Processor will process Customer personal data only on documented instructions, including instructions concerning international transfers, unless applicable Union or Member State law requires otherwise. In that case the Processor will inform the Customer of that legal requirement before processing unless prohibited on important grounds of public interest.

Instructions include the agreed service configuration and authorised requests to create, store, edit, share, analyse, export or delete information. A prompt, integration request or sharing selection does not waive data-subject rights or authorise unlawful processing. The Processor will inform the Customer immediately if, in its opinion, an instruction infringes applicable data-protection law and will seek clarification rather than knowingly carry out the unlawful instruction.

3. Customer responsibilities

The Customer determines the lawful purposes, appropriate legal basis, collection notices, data accuracy and permitted recipients for its processing. Its contract with Locoda does not by itself provide a legal basis for collecting another person's personal data. The Customer is responsible for instructions given by authorised users, reviewing generated applications and configuring access, retention and integrations appropriately. Special-category or similarly sensitive data requires the separate agreement and safeguards specified in the service terms.

4. Confidentiality and security

The Processor will ensure that persons authorised to process personal data have committed to confidentiality or are under an appropriate statutory obligation. Access will be limited to what is necessary for their duties. The Processor will implement appropriate technical and organisational measures under Article 32 GDPR, taking account of the risk, state of the art, implementation costs and the nature and context of processing. Proposed measures are described in Annex 2 and must be verified before this version is incorporated into a contract.

The Processor will regularly assess the effectiveness of safeguards. Changes must not materially reduce the agreed protection. The Customer remains responsible for controls within its own environment and its choice of recipients; this does not remove the Processor's own obligations.

5. Sub-processors

The Customer gives general written authorisation for the sub-processors and activities listed in Annex 3. Before engaging an additional or replacement sub-processor, the Processor will specifically inform the Customer in writing of the identity, activity, processing locations, safeguards and intended start date at least 30 calendar days before engagement, giving the Customer an opportunity to object on substantiated data-protection grounds before processing begins. An earlier start requires the Customer's specific prior written authorisation. The 30-day period is this agreement's contractual notice period, not a statutory deadline or a promise that every supplier gives Locoda the same notice.

The Processor will impose substantively equivalent data-protection obligations by binding contract, assess appropriate guarantees and remain responsible to the Customer for its sub-processors' performance of those obligations. A service the Customer independently connects, a payment provider acting for its own purposes or an external MCP client is not automatically a Locoda sub-processor.

The Processor will notify the Customer of a sub-processor's failure to fulfil those obligations and provide the relevant sub-processing agreement and amendments on request, with necessary redactions for protected confidential information. Locoda will maintain the controller identity and instructions needed to assist lawful return or deletion if the service ends or Locoda can no longer provide it. Applicable mandatory rights and third-party rights under binding transfer clauses remain unaffected; this agreement does not represent an additional negotiated right to terminate another provider's account as already obtained.

Locoda must assess a substantiated data-protection objection and arrange a lawful alternative or suspend/end the affected processing if the objection cannot be resolved. If a supplier announces an onward change too late to allow the full notice period, Locoda must inform the Customer without undue delay and obtain specific prior written authorisation for an earlier start, arrange an alternative, or restrict/suspend the affected processing. A shorter supplier notice or a webpage update does not silently shorten the Customer's rights.

6. International transfers

Transfers outside the EEA, including relevant onward processing or remote access, will take place only on documented instructions or a specific requirement of applicable Union or Member State law and in accordance with Chapter V GDPR. Where relevant, the parties will use an applicable adequacy decision or appropriate safeguards, including the correct international-transfer standard contractual clauses and necessary supplementary measures. An Azure region or an identity directory's country does not establish that all processing remains in the EEA. Annexes 3–4 describe the service routes and contractual safeguards; an unverified account-specific setting is not presented as an additional safeguard.

7. Data-subject requests and assistance

Taking into account the nature of processing, the Processor will assist the Customer through appropriate technical and organisational measures with requests under Chapter III GDPR. Requests concerning Customer-controlled processing received directly by Locoda will be directed to the appropriate Customer, unless law requires another response. The Processor will not disclose another person's information merely because a user requests it.

The Processor will also assist, taking into account the nature of processing and information available to it, with the Customer's obligations under Articles 32–36 GDPR, including security, breach handling, impact assessments and prior consultation. Contact: support@vibelets.app.

Locoda's privacy and incident operations owner is Hanna Outo; the deputy is Terho Antila. Enquiries should use the service contact above so they can be routed to the responsible person. These operational assignments do not by themselves state that a statutory Data Protection Officer has been appointed.

8. Personal-data breaches

The Processor will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer personal data. Available information will include the nature and likely consequences, categories and approximate numbers of affected individuals and records where known, contact details and measures taken or proposed. Information may be supplied in phases without undue further delay. The Processor will cooperate with the Customer's investigation and remediation. The Customer determines its own notifications to supervisory authorities and individuals, without limiting Locoda's independent legal duties.

9. Return, deletion and retention

At the Customer's choice, the Processor will return or delete Customer personal data after the relevant processing services end and delete existing copies, unless applicable Union or Member State law requires storage. The service's export and deletion controls and support channel implement instructions; the Customer should arrange any required export before requesting deletion.

Deletion closes active access and is retried if a purge is interrupted. Active work may need to stop or settle before content can be removed. Provider systems, separately controlled support and financial records, recipient copies and external source documents require the treatment appropriate to their actual role and legal basis. They are not all erased by deleting a single Vibelets account. Documented recovery retention and deletion obligations still apply; a recovery copy may not be used as an ordinary active copy.

Annex 2 must specify the actual recovery periods and how deletion is replayed after a restore. The currently observed Blob soft-delete period is 14 days; deleting the active object does not promise immediate physical removal of every recovery copy. Minimal deletion barriers and independently required financial records must have a documented, proportionate purpose. Retention cannot be justified solely by calling data a backup or a log.

10. Accountability and audits

The Processor will make available information necessary to demonstrate compliance with this agreement and Article 28 GDPR and allow for and contribute to audits, including inspections, by the Customer or an auditor mandated by it. Practical arrangements will protect other customers' confidentiality and service security and will not nullify statutory audit rights. The parties will cooperate with competent supervisory authorities.

Audits may take place at reasonable intervals or where there are indications of non-compliance, with reasonable notice where appropriate. Relevant evidence and audit results will be made available to competent supervisory authorities on request. Where the Customer is a processor, the arrangements must also enable the upstream controller's lawful audit and assistance requirements without disclosing another customer's data.

11. Duration, order of precedence and changes

This agreement is incorporated by reference into the Vibelets Terms of Service and applies for as long as the Processor processes personal data on the Customer's behalf. It prevails over conflicting service terms for that processing; mandatory rights and duties remain unaffected. Acceptance of the applicable Terms of Service includes this DPA where it applies. Customer-specific amendments require written agreement.

The applicable version is the DPA included in the service agreement when it is made or subsequently validly amended. This version is 2026-10-28.2; the linked dated copy records its text. The service/account record and the Customer's email notification identify the contracting Customer, authority and processing role. Locoda retains the applicable agreed text and relevant correspondence. Material changes follow the Terms of Service change procedure and section 5's specific supplier-notice requirements. Replacing a webpage alone does not retrospectively replace the agreed version.

If the Processor breaches these obligations, the Customer may require suspension until compliance is restored or terminate the affected processing for substantial/persistent breach, failure to comply with a binding court/authority decision, or failure to restore compliance within a reasonable period not exceeding one month after suspension. The Processor will promptly inform the Customer if it cannot comply. If the Customer insists on an unlawful instruction after being informed of the problem, the Processor may end the affected processing. Return/deletion and protection duties continue until fulfilled; completed deletion must be certified to the Customer.

Annex 1 — Description of processing

Annex 2 — Security, lifecycle and assistance measures

Application controls below are based on the repository reviewed on 28 October 2026. Production cloud settings were read again on 28 October 2026; source implementation is distinguished from observed deployment settings. Locoda operates and reviews the measures under the responsibility described in section 7. No certification, customer-exclusive encryption, zero retention or guaranteed recovery time is asserted.

Retention periods: app records, saved drafts, conversations and files are retained for the requested service lifecycle and handled under the return and deletion rules in section 9. Temporary build-status information is normally retained for seven days after the work is completed; unused temporary previews and related request context are normally retained for seven days. Information needed to complete ongoing work or resolve outstanding credit charges is retained until those matters are resolved. This automatic cleanup does not delete saved drafts, conversations or app records. Copies held by external providers follow the separate retention rules described in Annex 3.

The production customer-data storage account has Blob/container soft-delete retention of 14 days, with versioning enabled, observed on 28 October 2026. This is not a universal policy for every storage account: hosting, web and browser-support storage do not have that same soft-delete policy. Purging includes active versions and snapshots but does not promise immediate physical erasure of recovery copies. Application Insights retention was confirmed as 90 days; the relevant App* diagnostic tables were also observed with 90-day retention on 27 October. Locoda's own operational diagnostics, legally required financial records and separately controlled support/moderation records require their own justified retention. A proposed 365-day support target is not an implemented universal expiry.

The restricted erasure ledger retains the state and pseudonymous references needed to complete cleanup and prevent stale work from recreating data; completion removes its raw owner field. No fixed final expiry for all deletion barriers has yet been established. Its continuing necessity and recovery role require periodic review. After a restore, outstanding deletions must be replayed before ordinary access resumes. Blob soft delete is not proof of an independently tested full backup, a Table point-in-time restore or a completed recovery test.

Assistance: support@vibelets.app receives rights, security and incident enquiries. Locoda must verify authority, locate the relevant records and assist with readable return/export, correction, restriction and erasure while protecting other individuals' rights. An export can require scoped support work; not every generated app has an automatic export button. Locoda must provide the processing/supplier inventory, measures and known limitations needed for impact assessments and prior consultation.

Breach information must include the incident contact, known scope, categories and approximate numbers where known, likely consequences, containment/mitigation and subsequent updates. Initial notice must not wait for a complete investigation. Hanna Outo is responsible for privacy/incident operations, with Terho Antila as deputy. Locoda must maintain confidentiality and least-privilege access, review supplier notices and test deletion/recovery procedures. Naming the responsible persons does not itself establish that every operational test has already been completed.

Annex 3 — Supplier register and public contractual evidence

Locoda uses the services below under their applicable public business/API terms and associated data-processing addenda. Locoda is the contracting customer; this contractual basis was confirmed on 28 October 2026. The listed suppliers and activities form the authorised list for section 5. Public terms and production settings were checked separately: an applicable contract does not itself prove a particular project setting, zero retention or EEA-only processing.

Microsoft — Azure and selected online services

Activity/data: hosting, API/MCP infrastructure, app records/files, collaboration and selected identity, speech and email operations; the content, identifiers and credentials necessary for each enabled service. Production application infrastructure/storage, SignalR, browser infrastructure, Monitor and the configured Speech region were observed in Sweden Central on 28 October 2026; marketing Static Web Apps is in West Europe and Front Door is global. The applicable EU Data Boundary scope and exceptions cover additional service/support routes; a resource region is not a blanket EEA-only promise.

Public evidence: Microsoft Products and Services DPA, May 2026 and EU Data Boundary scope/exceptions. The DPA describes processor-to-processor transfer SCCs between Microsoft Ireland Operations Limited and Microsoft Corporation. Its subscription-end default can include a 90-day extraction period followed by up to 90 days for deletion; this is separate from individual blob deletion.

EEA entity/contact: Microsoft Ireland Operations Limited, Attn: Data Protection Officer, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; Microsoft privacy contacts. Microsoft Corporation and relevant affiliates provide onward processing under the applicable Microsoft agreement/DPA. Service-specific processor lists, exceptions and notices remain part of ongoing supplier monitoring.

Speech and email: Vibelets' prebuilt text-to-speech requests use the Sweden Central endpoint; Microsoft states that input text/output audio for prebuilt neural voices is not stored in Microsoft logs (Speech data handling). The configured ACS email resource's Data Location was confirmed as Europe on 28 October 2026, including the linked vibelets.app and auth.vibelets.app sending domains. ACS processes content for delivery in that Data Location; delivery logs follow the selected Monitor retention, sender-domain records remain until deleted and hard-bounce addresses may be retained temporarily for abuse prevention (ACS data handling). Recipient mailboxes and delivery beyond the service have their own handling; no fixed universal email-retention period is asserted.

OpenAI — API model services

Activity/data: requested AI operations using relevant prompts, context/data and attachments, including runtime and automation requests. The production model endpoint is api.openai.com; image requests also use the global API. This agreement does not rely on an EU-only API project or an account-specific Zero Data Retention arrangement.

Public evidence: the DPA effective 1 January 2026 identifies OpenAI Ireland Ltd. for EEA/Swiss customers and describes Ireland processing and onward safeguards for EEA data. See the sub-processor register and service-specific retention controls. Application state and abuse monitoring differ; store=false alone is not zero retention.

OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland; contact privacy@openai.com (company/contact details). The supplier DPA covers EEA/Ireland processing and lawful onward transfers. The public objection period is not a guarantee of the same lead time before every change.

Retention: Vibelets sets store=false in its Responses API requests. Builder requests can still use background mode, for which the current data-controls documentation describes temporary polling storage of roughly ten minutes. Default abuse-monitoring logs may retain customer content for up to 30 days, with the provider's stated legal/safety exceptions. Model-dependent prompt caching is another separate processing category. The inspected attachment path supplies inline file data rather than creating persistent Files API objects. No shorter account-specific retention is assumed; retention rules are service-specific rather than one universal deletion time.

TypeSafe AI, Inc. — AI request analysis

Activity/data: analysis of user requests to support the requested AI-assisted operations, using the request text, app titles, limited conversation excerpts and attachment metadata described in Annex 1. These inputs may contain personal data.

Public evidence: DPA updated 24 April 2026, Master Customer Agreement updated 23 September 2026, and sub-processor register. DPA section 6.2 covers transfer SCC Modules 2 and 3. The register lists US hosting/inference and worldwide infrastructure, not an EEA-only route. The supplier's reasonable advance notice and 15-day objection window are handled under section 5's late-notice procedure where needed.

TypeSafe AI, Inc., published contact address: 255 California St, Suite 1300, San Francisco, CA 94117, USA (company contact details); privacy@typesafe.ai. The API relationship is governed by the MCA/DPA, rather than the website terms used here for contact evidence.

Retention and locations: the provider's retention explanation and DPA Schedule I section 8 use purpose/legal-need criteria and do not publish a fixed standard number of days. TypeSafe states that the service used by Vibelets is not trained on customer requests or responses, but service, billing, abuse-prevention and telemetry processing can still occur. ZDR is separately available for eligible enterprise arrangements; none is relied on here. The public register identifies US and worldwide processors but not the exact location of each request.

Role-specific integrations and recipients

Customer-selected Google Sheets/Microsoft 365 services and independent MCP clients require activity- and contract-specific classification; they are not automatically Locoda's sub-processors. Locoda's processing of connector credentials and retrieved data remains in scope. Stripe's payment/statutory processing and Locoda's own support/moderation systems must likewise be classified by purpose. Any additional supplier processing Customer content for Locoda must be added to the verified register before use.

Annex 4 — International-transfer record

Decision 2021/915 concerns Article 28. The separate transfer SCCs are in Decision (EU) 2021/914. Using the first does not execute or satisfy the second. Any adequacy decision must actually cover the recipient and processing at the relevant time.

For each route, record the exporter/importer identities and roles, data/purpose, frequency, countries including remote access, onward recipients, retention/deletion, applicable safeguard and evidence. If transfer SCCs apply, select the correct module: typically Module 3 where Locoda exports as processor to a sub-processor, or Module 2 for its separate controller processing. Complete the applicable annexes and, where required, the destination-law/practice and supplementary-measures assessment. These roles are not interchangeable.

TLS, storage encryption and prompt minimisation reduce some risks but do not stop an AI provider accessing plaintext necessary for inference. No completed transfer impact assessment, current adequacy certification or customer-exclusive encryption is asserted here. If evidence does not support a lawful route, affected processing must not be enabled under this agreement until a lawful arrangement, restriction or alternative is in place.

Annex 5 — Administration and operational responsibilities

  1. Responsible persons: privacy/incident owner Hanna Outo; deputy Terho Antila. Shared contact: support@vibelets.app.
  2. Customer declarations: the Customer supplies and updates identity, contact, role and authority information by email under section 1. Locoda records relevant correspondence with the service/account relationship and requests clarification where needed.
  3. Supplier arrangements: Locoda uses the applicable public business/API terms and associated DPAs identified in Annex 3, monitors changes and maintains the relevant contractual records.
  4. Change notices: section 5's 30-calendar-day period applies. The responsible persons handle written notices and objections, including late upstream notices.
  5. Operational reviews: Locoda reviews least privilege/confidentiality, necessary retention, deletion/recovery handling and material service or transfer changes. Dated inventory observations are evidence of the observed settings, not a claim that every restore test or transfer assessment has been completed.
  6. Contractual basis: the DPA is incorporated through the Terms of Service. Versioned contractual text and relevant correspondence support the record.