Data processing agreement

Last updated: 29 October 2026

This agreement (the “DPA”) is part of the terms of service between you, the customer, and Onda Dev, which operates Trovaso. It applies automatically to every Trovaso account from the moment the account is created: there is nothing to sign. If your company needs a signed copy, write to team@trovaso.com and we will send one. It is written to meet Article 28 of the GDPR and the UK GDPR, in plain language, because you should be able to read it without a lawyer.

1. Definitions

• GDPR means Regulation (EU) 2016/679, and the UK GDPR where it applies. “Personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” mean what the GDPR says they mean.
• Customer data means the personal data you put into Trovaso or that Trovaso collects for your workspace: your roster, your conversations with creators, contracts, payment confirmations, files, team members and sales data (“your data” in the terms).
• Subprocessor means a company Onda Dev uses to process customer data on your behalf.
• The Terms means the terms of service; the privacy policy and the subprocessor list are the pages this DPA refers to.

2. Scope and roles

• For customer data, you are the controller and Onda Dev is your processor. This DPA governs that processing.
• For your account and billing details, and for the public creator profiles Trovaso gathers itself before you add a creator to your workspace, Onda Dev is the controller: the privacy policy covers that, and this DPA does not.
• If you use Trovaso for someone else — an agency working for its clients — you may be a processor yourself and Onda Dev a subprocessor. You confirm that you have the authority to engage us and give us instructions on that controller's behalf, and this DPA applies in the same way.

3. Subject matter, duration, nature and purpose

• Subject matter: running Trovaso for you.
• Duration: as long as your account exists, plus the deletion period in section 5.
• Nature: storing and organising your data, reading it with AI models to vet, draft and translate, sending and receiving email, generating contract and payment documents, and computing results.
• Purpose: finding creators, contacting them, agreeing and documenting collaborations and payments, and measuring what the videos bring.

4. Data subjects and categories of data

The people whose data Trovaso processes for you, and what it holds about them:

• Your team members: name, email address, role, and what they do in the workspace.
• Creators you find and work with, and their representatives: public profile data (handle, name, bio, picture, followers, posts and their numbers, estimated audience); contact details; the emails and messages exchanged; deal terms, fees and discount codes; typed or drawn signatures with the time, IP address and browser that made them; and, for payment documents, payout details such as an IBAN or PayPal address, tax ids, addresses and tax residence certificates.
• People in conversations you import: whatever the imported messages contain.
• Sales data: daily totals per country and per discount code from the sources you connect. Trovaso does not store your own customers' identities from them.

Trovaso is not built for special categories of data (health, religion, political opinions and the like) or for data about children. Do not put them in.

5. Our obligations as your processor

• Instructions. We process customer data only on your documented instructions. The Terms, this DPA and your use of Trovaso's features — starting a search, sending an email, asking for a draft, connecting an assistant — are those instructions. If an instruction would, in our view, break the law, we tell you before following it. We never process customer data for our own purposes, except as the law requires.
• Confidentiality. Everyone at Onda Dev with access to customer data is bound by confidentiality, and access is limited to what support and running the service need.
• Security. We keep the technical and organisational measures in the annex below, and improve them over time without lowering the level of protection.
• Help with people's requests. If a creator or anyone else asks us about data in your workspace, we pass the request to you within 5 business days and do not answer for you, unless the law obliges us to. Trovaso lets you find, correct, export and delete what you hold about a person; where that is not enough, we help on request.
• Help with your obligations. Taking into account what we know, we help you with data protection impact assessments, consultations with a supervisory authority, and the security of processing.
• Deletion or return. When you close your account, or ask us to, we delete all customer data within 30 days, unless the law requires us to keep part of it (billing records, for example), in which case we keep only that part, isolated, for as long as required. Before then you can export your data from the app or ask us for a copy.
• Showing compliance. On request we give you the information needed to show we meet Article 28: answers to your questions, this DPA, the subprocessor list and the reports our providers publish. If that is not enough, you or an independent auditor you appoint and we accept may audit our processing: once a year at most, with 30 days' notice, during business hours, at your cost, without disrupting the service — more often only after a breach or when a supervisory authority requires it. Findings are confidential.

6. Subprocessors

• You give us general permission to use subprocessors. The current ones, what each does and receives, and where it is, are listed at trovaso.com/subprocessors.
• We announce a new subprocessor on that page, with the date, before it starts receiving customer data. You may object within 30 days by writing to us with your reason; we will look for a way to keep serving you without it, and if there is none, you may close your account before the change applies and we refund any part of a subscription you paid for and did not use.
• Every subprocessor is bound by a written contract with data protection obligations at least as protective as this DPA, and we remain fully responsible to you for what it does.

7. International transfers

Some processing happens outside the European Economic Area, the United Kingdom and Switzerland, including in the United States. Where customer data from those places is transferred there, the following applies:

• The EU Standard Contractual Clauses (Commission Decision 2021/914) are part of this DPA: Module Two (controller to processor) between you and Onda Dev where we process your data outside the EEA, and Module Three (processor to processor) between Onda Dev and its subprocessors. For these clauses: the optional docking clause 7 is included; under clause 9 we use option 2, general authorisation with the 30-day notice in section 6; the optional wording in clause 11 is not included; the governing law and courts under clauses 17 and 18 are those of Ireland, unless the law of the EU member state where you are established must apply; and the annexes are sections 3, 4 and 6 and the security annex of this DPA.
• For data from the United Kingdom, the UK International Data Transfer Addendum to those clauses applies; for data from Switzerland, the clauses apply with the adjustments the Federal Data Protection and Information Commissioner requires.
• Where a provider in the United States is certified under the EU–US Data Privacy Framework (and its UK and Swiss extensions), we rely on that certification as well.
• If a transfer safeguard stops being valid, we will put another lawful one in place or stop the transfer.

8. Personal data breach

If we become aware of a personal data breach affecting customer data, we tell you without undue delay, and in any case within 72 hours of becoming aware, by email to your account address. We tell you what happened, which data and people are affected as far as we know, what we have done and what we recommend, and we keep you updated as we learn more. We help you with any notification you must make to a supervisory authority or to the people affected; we do not notify them on your behalf unless you ask us to or the law requires it.

9. Liability

The liability section of the Terms applies to this DPA, for both of us, as if it were written here. Nothing in this DPA limits liability that the law does not allow to be limited.

10. Law, term and precedence

• This DPA is governed by the law named in the Terms, except where the GDPR or the Standard Contractual Clauses require the law of an EU member state or of the UK.
• It lasts as long as the Terms, plus the deletion period in section 5. We may update it the same way as the Terms, telling you at least 15 days before a significant change applies.
• If this DPA and the Terms say different things about personal data, this DPA wins. If this DPA and the Standard Contractual Clauses conflict, the clauses win.

Annex: security measures

What we do to protect customer data, in place as of the date at the top of this page:

• Encryption in transit: every connection to Trovaso and from Trovaso to its providers uses HTTPS (TLS). Email is sent over TLS where the receiving server supports it.
• Encryption at rest: the database and file storage (Google Cloud) encrypt everything at rest. Keys for the sales sources you connect get a second layer, AES-256-GCM, with a key that never sits in the database.
• Access control: each workspace is isolated and visible only to its team, under the roles the owner sets. Onda Dev staff access customer data only for support and operations, under named accounts. Sign-ins and assistant connections can be revoked; access tokens for AI assistants are stored only as hashes.
• Secrets: API keys and credentials live in the deployment's configuration, not in code or in the database, and are rotated when someone with access leaves or on any suspicion.
• Redaction before AI: before any text reaches an AI model, payment details (IBANs, card numbers, PayPal addresses), phone numbers and tax ids are replaced with placeholders, which our server puts back into the answer; the values never reach the AI provider. A check at build time makes sure every model call goes through this layer. Our AI providers do not use the data to train models, under their API terms.
• Abuse protection: bot checks on sign-up and sensitive actions, per-account and per-IP rate limits and quotas, and Cloudflare in front of the servers.
• Logging and monitoring: server logs, error capture and rate-limit records, kept for days to 30 days; alerts when providers fail, limits are reached or errors spike.
• Resilience: the database and file storage are managed services that Google Cloud replicates across several zones; the application is rebuilt from source and configuration on every deploy and can be brought up on a fresh server.
• Development: changes are type-checked and reviewed before deployment, dependencies are kept current, and security reviews of the product are run regularly and before major releases.
• People: everyone with access is bound by confidentiality and works under an individual account, so access can be traced and withdrawn per person.

Contact

Onda Dev · team@trovaso.com