---
title: "Data Processing Agreement | Tulvo"
description: "How Tulvo processes personal data in Customer Data on your behalf, covering security measures, subprocessors, breach notification, deletion and international transfers."
url: "https://www.tulvo.io/dpa"
---

Legal

# Data Processing Agreement

Operated by Studio Dev Hub LLC · Effective date: Nov 14, 2026

This DPA forms part of the [Terms of Service](https://www.tulvo.io/terms) between Studio Dev Hub LLC ("**Processor** ", "**Tulvo** ") and the Customer ("**Controller** ") and applies to Tulvo's processing of personal data on the Controller's behalf. Capitalized terms not defined here have the meaning given in GDPR.

## 1. Roles

For Customer Data containing personal data, the **Customer is the Controller** and **Tulvo is the Processor** . For Tulvo's own account/billing/website data, Tulvo is the Controller.

## 2. Scope and instructions

Tulvo processes personal data only (a) to provide the Service, (b) per the Customer's documented instructions (including AI features the Customer invokes), and (c) as required by law (with notice unless prohibited).

## 3. Confidentiality

People authorized to process personal data are required to keep it confidential.

## 4. Security

Tulvo implements the measures described in Schedule 2 and will not materially decrease overall security during the term.

## 5. Subprocessors

The Customer authorizes the subprocessors in **Schedule 3** (and on our [Subprocessors page](https://www.tulvo.io/subprocessors)). Tulvo imposes data-protection terms on each no less protective than this DPA and remains liable for them. We give at least **30 days' notice** of changes via the Subprocessors page, during which the Customer may object on reasonable grounds by emailing [support@tulvo.io](mailto:support@tulvo.io). Tulvo will review the objection.

## 6. Data-subject requests

Tulvo assists the Controller, through appropriate measures and insofar as possible, in responding to requests from data subjects. If a data subject contacts us directly, we refer them back to the Controller.

## 7. Personal data breaches

Tulvo notifies the Controller **without undue delay** (and within **72 hours** of becoming aware) of a breach affecting Customer Data, with information needed for the Controller's own obligations.

## 8. Assistance

Tulvo provides reasonable assistance with DPIAs and prior consultations, considering the nature of processing and information available.

## 9. Deletion or return

After termination, Customer Data stays in the Customer's account (on the Free plan) until the Customer deletes it or asks us to. Customers can export individual views (CSV, PDF, Markdown or JSON) at any time. On written request, Tulvo deletes Customer Data from its production systems within 30 days, except where retention is required by law. Residual copies in backups and logs are deleted on their normal cycle.

## 10. Audits

Tulvo makes available information to demonstrate compliance and allows audits, which may be satisfied by third-party reports/certifications or a questionnaire; on-site audits by reasonable prior notice under confidentiality.

## 11. International transfers

Tulvo processes Customer Data in the **United States (AWS us-west-2, Oregon)** . For personal data subject to GDPR/UK GDPR, the **EU Standard Contractual Clauses (Module Two: Controller-to-Processor)** and the **UK IDTA/Addendum** are incorporated by reference and completed in **Schedule 4** .

## Schedule 1 - Processing details

**Subject matter:** provision of the Tulvo Service.

**Duration:** the term of the [Terms of Service](https://www.tulvo.io/terms).

**Nature & purpose:** hosting, storage, processing, and AI-assisted generation on the Customer's instructions. **Types of personal data:** as determined by the Customer (names, contact details, application/employment data, customer records, and any personal data the Customer stores).

**Data subjects:** as determined by the Customer (e.g., the Customer's staff, customers, contacts, applicants).

## Schedule 2 - Technical & organizational measures (TOMs)

Encryption in transit (TLS). At-rest encryption of RDS/S3. Role-based access controls in the product; production access limited to a small number of authorized personnel; secure credential storage (hashing); AWS Cognito authentication. Hosted on AWS, primarily in us-west-2 (ECS Fargate, EC2, Amplify, RDS PostgreSQL, ElastiCache, DynamoDB, S3, SQS, Lambda), delivered through Amazon CloudFront's global network, with real-time sync on Google Cloud Firestore (US).

Network and application security controls; logging and monitoring (application/firewall logs retained ~90 days). Automated database backups (7-day rolling restore). A controlled release process for production changes.

Monitoring and alerting for production incidents, with breach notification as described in Section 7.

## Schedule 3 - Subprocessors

Current subprocessors include AWS (incl. Cognito, SES), Google (Firebase, Tag Manager, Workspace, YouTube), OpenAI, Stripe, Google Analytics, Meta, Microsoft Clarity, Sentry, Partnero, Cal.com, Iframely; optional integrations Slack, Google, Notion, GitHub. We may add subprocessors and will continue to update this list.

## Schedule 4 - Transfer mechanisms

EU SCCs (Module Two) with docking clause, Annexes populated from Schedules 1–3; UK IDTA/Addendum; Swiss amendments where applicable.