Data processing agreement

1. What this is and who it applies to

This document is the data processing agreement under Article 28 of the General Data Protection Regulation (GDPR). It applies to any NapNodes service in which you store third parties' personal data: the users of your app in a Supabase project, or the players on your server.

For that data, you are the controller: you decide what is stored, what for and for how long. We, Marco Napierski (NapNodes), with tax ID X9497973P and registered at Calle Buganvillas 1, 38300 La Orotava, Santa Cruz de Tenerife, are the processor: we process it on your behalf to provide the service.

You accept it when you buy, along with the Terms of Service, and it lasts as long as you have the service and until the data is deleted as section 7 says. Your account and invoices aren't covered here: for those we are the controller, and the Privacy Policy applies.

2. What we process

What we do with that data is host it: store it, back it up, transmit it to whoever you configure, and delete it. The sole purpose is to provide the service you bought.

You decide what data and whose: usually identification and contact data, and whatever your app or server stores about its users. We don't look at what you store or classify it. If you store special categories of data or children's data, it is up to you to check that the service is suitable for that.

3. What we commit to

We process that data only on your instructions, which are what you configure in the panel, what this agreement says and what you ask of us in writing. We don't use it for anything of our own, or to train models, and we don't sell it.

If an instruction of yours seems to us contrary to data protection rules, we tell you. If a law requires us to process or hand over the data, we tell you first, unless that law forbids it.

Anyone working with us who could see that data is bound by confidentiality. We don't look at your content unless you give us permission in a support request, it is needed to keep the service safe and running, or a law requires it.

4. Security

The measures we apply are those described on our security page. For Supabase projects, also: each one runs on its own virtual machine, sharing no memory with other customers; connections to Postgres over the internet are always encrypted; there are daily backups for 7 days and a nightly encrypted copy on another machine.

What depends on your side is yours: your database's access policies, your keys, who has access to your project and your app's security.

5. Sub-processors

You authorise us to use these sub-processors for that data. OVHcloud (France): the servers it is hosted on, in the European Union. The encrypted copies outside the main machine are kept on another machine of ours in Spain: only encrypted files are there.

If we are going to add or change a sub-processor, we tell you by email thirty (30) days in advance. If you disagree, you can cancel at no cost before it takes effect. We require the same obligations of them by contract as this document and we answer for what they do.

Your content stays in the European Union. Other providers in the Privacy Policy, such as those for payments or email, don't process the content you store in your service. If your app sends emails, it uses your own mail server and you choose that provider.

6. How we help you

If someone exercises their rights (access, rectification, erasure, portability…) with you, the panel gives you what you need to handle it: the Studio, the console and the full download. If the request reaches us, we pass it to you without answering it.

If we learn of a security breach affecting that data, we tell you without undue delay by email, with what we know about what happened, and we help you meet your obligations to report it. We also give you the information we have if you need to carry out an impact assessment or consult the authority.

7. When the service ends

Before you leave you can take your data with “Download everything” or your usual tools.

When a Supabase project ends, it is stopped and kept for fourteen (14) days in case you change your mind; then it is deleted. Its encrypted copies outside the machine disappear within the following eight (8) days. For game servers, what the Terms of Service say applies. We don't keep that data beyond these periods, unless a law requires it.

8. How you can check

We give you the information needed to show that we comply with this agreement: write to rafi007napi@hotmail.com. If an audit is needed, we agree it in writing with reasonable notice, without access to other customers' data and at your expense.

9. Your obligations

As controller, it is up to you to have a legal basis for processing that data, inform the people affected, handle their rights and check that the service is suitable for what you do with it. We don't hold certifications such as SOC 2 or HIPAA.