Data Processing Addendum
Last updated: May 13, 2026
This Data Processing Addendum ("DPA") forms part of the agreement between ValueColony ("Processor") and you ("Controller") and applies where ValueColony processes Personal Data on the Controller's behalf in the course of providing the Service.
1. Subject matter & duration
Subject matter: provision of the ValueColony platform. Duration: term of the Terms of Service.
2. Nature & purpose of processing
Hosting marketplace data (listings, applications, messages), processing revenue events via Stripe, sending transactional notifications.
3. Categories of data subjects
Controller's authorized end users (builders and operators) and counterparties on the platform.
4. Categories of personal data
Identifiers (email, display name, user ID), profile content, partnership communications, transaction metadata.
5. Sub-processors
- Lovable Cloud / Supabase — hosting, database, auth.
- Stripe — payments and Connect payouts.
- Email infrastructure providers — transactional email delivery.
- Cloud infrastructure providers — compute and storage.
Controller authorizes the use of the above sub-processors. ValueColony will provide notice of new sub-processors.
6. Security
ValueColony implements appropriate technical and organizational measures including TLS in transit, encryption at rest, role-based access, RLS at the database level, and audit logging.
7. International transfers
Where data is transferred outside the EEA/UK, ValueColony relies on Standard Contractual Clauses or other lawful transfer mechanisms.
8. Data subject rights & assistance
ValueColony will assist Controller in responding to data subject requests and in fulfilling Controller's obligations under applicable data protection law.
9. Breach notification
ValueColony will notify Controller without undue delay after becoming aware of a personal data breach affecting Controller's data.
10. Deletion
Upon termination, ValueColony will delete or return Controller's personal data, subject to legal retention requirements.