Data processing agreement

1. What it covers

When you use nuvols.app, we process personal data on your behalf: the data about the stores you add to your workspace, described in annex I. For your own store, you are the controller and we are your processor. For your clients' stores, the store owner is the controller, you are the processor and we are your sub-processor; you confirm that your agreement with the store owner allows you to use nuvols.app. This agreement doesn't cover the data about you and your team members that we need to run your account; we handle that as controller, as described in the privacy policy.

2. Your instructions

We process the personal data only to provide nuvols.app as described in the terms, this agreement and the settings you choose in the app; together these are your instructions. We tell you if we think an instruction breaks data protection law. If the law requires us to process data in another way, we tell you first, unless the law forbids that.

3. Confidentiality

Only people who need it to run the service have access to the personal data, and they are bound to confidentiality. Today that is one person, the owner of nuvols.app.

4. Security

We protect the personal data with the technical and organisational measures in annex II. We may improve them; we won't lower the overall protection.

5. Subprocessors

You allow us to use the subprocessors listed on the subprocessors page. Each is bound by a written agreement with data protection obligations at least as protective as these, and we remain responsible for them. We tell the owners of each workspace by email at least 30 days before a new subprocessor starts processing the data. If you object on reasonable data protection grounds within that time and we can't resolve it, you may end the affected subscriptions; we refund the unused part of what you have paid in advance.

6. Where the data is

We store the personal data in the European Union (Cloudflare's EU jurisdiction). Requests are handled on Cloudflare's global network, and some subprocessors are established outside the European Economic Area; each such transfer is covered by an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework) or by the Commission's standard contractual clauses, as listed on the subprocessors page.

7. Requests from people

If someone asks us to exercise their data protection rights about data we process for you, we pass the request on to you and don't answer it ourselves unless you ask us to. We help you answer such requests, as far as the nature of the service allows.

8. Helping you meet your obligations

We give you the information you need, as far as we have it, for your security measures, data protection impact assessments and consultations with a supervisory authority.

9. Personal data breaches

If a breach of security affects the personal data, we tell you without undue delay after we become aware of it. We aim to tell you within 48 hours; this is a target, not a binding deadline. We tell you what happened, which data and how many people are likely affected, the likely consequences, what we have done and will do about it, and who to contact; what we don't know yet, we send as soon as we know it. We document every breach.

10. At the end

When you close your workspace, we delete the personal data we process for you within 30 days, unless the law requires us to keep it. Within those 30 days you can ask for a copy of your stores' data in a machine-readable form. Cloudflare's point-in-time recovery of our database keeps earlier versions for up to 30 more days, after which they are gone too. When you remove a store, its data is deleted 30 days after removal, in the same way.

11. Proof and audits

We make available the information needed to show that we meet this agreement, and answer your written questions about it. If that isn't enough, you or an auditor bound to confidentiality may audit us once a year, with 30 days' notice, at your cost and during working hours, without access to other customers' data. Our subprocessors' own certifications and audit reports may serve as part of the answer.

12. Changes

We change this agreement as we change the terms, with 30 days' notice by email; new subprocessors follow section 5. Before nuvols.app starts a new kind of processing (for example backups or AI code review), we update annex I and tell you; such features process data only for stores where you turn them on.

13. Liability

Each party's liability under this agreement follows the terms of service, including their limits, except where the law doesn't allow a limit.

14. Order of precedence

If this agreement and the terms differ on the protection of personal data, this agreement prevails. If standard contractual clauses apply, they prevail over both.

15. Law

This agreement is governed by Spanish law, and the courts named in the terms have jurisdiction.

Annex I: the processing

Subject and nature: monitoring of the PrestaShop stores you add to your workspace: outside checks of uptime and version, the inventory the nuvols.app connector reports, the store safety status, alerts by email and the activity log of your workspace.

Purpose: to provide nuvols.app under the terms.

Duration: as long as the store is in your workspace, then section 10.

People concerned: store owners and their staff, where a store's address, shop name or domain identifies them (for example a sole trader's name); developers named as authors in a store's module list; your team members, as they appear in the activity log and as recipients of alerts.

Personal data: store addresses, shop names and domains; module and theme names, versions and authors; the paths of override files; uptime results and incidents; which alerts were sent to whom and when; activity log entries (who did what in the workspace, and when).

Not processed: the customer, order, address and employee records of your stores, configuration values, file contents and store passwords. The connector doesn't send them, and the outside checks store no page content. No special categories of personal data.

How often: continuously: uptime every 5 minutes, the version check once a day, the inventory when the connector reports a change.

How long: inventory history 90 days, the current inventory while the store is in your workspace; uptime results 3 months in detail, the current status and past incidents while the store is in your workspace; records of sent alerts 30 days; activity log 1 year; a removed store 30 days after removal; a closed workspace 30 days after closing (section 10).

Where: stored in Cloudflare's EU jurisdiction; error reports in Sentry's EU region (Frankfurt), with personal data removed before they are sent; emails sent through Brevo in the EU.

Annex II: technical and organisational measures

Encryption in transit: HTTPS only, with HSTS. Messages between the connector and nuvols.app are signed (Ed25519) and refused if their timestamp is more than 5 minutes off.

Encryption at rest: Cloudflare encrypts the database and file storage at rest. Two-step verification secrets are encrypted again by us (AES-256-GCM, per user, with rotatable keys).

Sign-in: one-time sign-in links by email, limited per address and network; optional two-step verification (authenticator app) with recovery codes. Sessions use secure, HttpOnly cookies; we store only a hash of the session token; sessions end after 7 days without use and at the latest after 30 days. Requests that change data are protected against cross-site request forgery.

Separation of customers: every query is limited to one workspace, and automated tests check every data access path against access from another workspace.

Data minimisation: the connector reports only versions, modules, themes, shop names and domains, and answers only a fixed list of read requests. It runs no code sent by us and downloads nothing after installation. Outside checks read only what they need and store no page content.

Access by us: only the owner of nuvols.app has access to production systems. Changes reach production only through signed releases, after automated tests and code and security reviews.

Logging: an append-only activity log per workspace, kept for 1 year. Error reports are stripped of personal data before they are sent to Sentry; request logs are switched off.

Availability and recovery: the database can be restored to any point in the last 30 days (Cloudflare D1 point-in-time recovery), and a restore point is recorded before every database change in a release. Our own service is monitored from outside, with a public status page.

Deletion: retention periods (annex I) are applied automatically every day.

Secure development: every change is tested and reviewed for security before release; the connector and the safety rules follow written security requirements; an external security review comes before any feature that changes stores.

Incidents: breaches are handled and reported as in section 9.