Data Processing Agreement

For customer-provided recipient data, the customer determines purpose and permitted contact basis. QuotixLab processes the data to host, validate, organise, secure, export and delete it as required to provide the configured service, using core providers including Supabase, Stripe and Vercel.

1. 01

   Subject matter

   This DPA covers customer-provided quote, recipient and workflow data processed to provide QuotixLab. The customer acts as controller for that data and OPENVOLTARIS LLC acts as processor only to the extent required by the configured service.

2. 02

   Documented instructions

   Processing follows the customer's documented configuration and authorised user actions: hosting, validation, organisation, draft preparation, export, security, support and deletion. QuotixLab does not independently decide to contact recipients or send commercial messages.

3. 03

   Security measures

   Controls include tenant-scoped access, RLS, server-side privileged operations, MFA for sensitive actions, hashed secrets or fingerprints where implemented, private storage and audit records. Customers remain responsible for account administration and lawful source data.

4. 04

   Subprocessors

   Core subprocessors may include Supabase for data/authentication, Vercel or Cloudflare for application hosting, Stripe for payment operations, and Resend for transactional email. Where cross-border transfers occur, applicable transfer safeguards and provider terms govern those transfers.

5. 05

   Deletion and return

   Customer export and deletion controls use the product's documented workflows, including grace periods and legal or financial holds. On termination or a valid request, data is returned, exported or deleted as applicable, subject to documented workflows and applicable law.