Data Processing Agreement

Last updated: 7 November 2026

This Data Processing Agreement ("DPA") is part of the Terms of Service between the developer or organisation using the TweakLane hosted service ("Controller") and Peidus Products OÜ, Estonia ("Processor"). It applies to personal data of the Controller's end users that the Processor processes to provide the service, and implements Article 28 of Regulation (EU) 2016/679 ("GDPR").

1. Subject matter, duration, nature and purpose

2. Categories of data subjects and data

• Data subjects: end users of the Controller's apps.
• Personal data: user identifiers chosen by the Controller (or install-based anonymous identifiers), layout documents and their contents, audit rows, AI consent records, AI log rows including prompts when enabled.
• Special categories: none. The Controller must not send special categories of data (GDPR art. 9) through the service.

3. Instructions

The Processor processes personal data only on the Controller's documented instructions: these terms, the Controller's settings in the dashboard (for example AI on or off, prompt storage, retention) and API calls made with the Controller's keys. The Processor informs the Controller if it believes an instruction infringes the GDPR.

4. Confidentiality

Persons authorised to process the personal data are bound by confidentiality.

5. Security

The Processor implements appropriate technical and organisational measures under GDPR art. 32, including: per-app and per-user access control through signed tokens; database tables closed to direct access; encryption in transit; audit logging of writes and dashboard actions; data hosted in the EU; validation of every stored document; and rate limits.

6. Subprocessors

The Controller gives general authorisation for the subprocessors listed on the Subprocessors page. The Processor notifies the Controller at least 30 days before adding or replacing a subprocessor. The Controller may object on reasonable data protection grounds; if the parties cannot resolve the objection, the Controller may terminate the affected service. The Processor imposes data protection obligations on each subprocessor that are no less protective than this DPA and remains liable for its subprocessors.

7. International transfers

Personal data is stored in the EU. Transfers outside the EEA take place only under GDPR chapter V, for example the Standard Contractual Clauses or an adequacy decision.

8. Assistance

Taking into account the nature of the processing, the Processor assists the Controller with:

• data subject requests, through GET /users/:userId/export and DELETE /users/:userId and on request;
• security, breach notification, data protection impact assessments and prior consultation (GDPR art. 32–36).

9. Personal data breaches

The Processor notifies the Controller without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting the Controller's data, with the information available under GDPR art. 33(3).

10. Deletion and return

The Controller can export and delete end-user data at any time through the API. When the Controller deletes an app or its organisation, or the Terms of Service end, the Processor deletes the related personal data within 30 days, unless EU or member state law requires storage. Audit logs keep a sha256 hash of a deleted user's identifier, not the identifier.

11. Audits

The Processor makes available the information necessary to demonstrate compliance with this DPA and allows for and contributes to audits, including inspections, by the Controller or an auditor it mandates, on reasonable notice and at most once a year unless a breach or authority requires otherwise.

12. Liability and order of precedence

Liability under this DPA follows the Terms of Service. If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails.