Skip to main content

📄 Sub-processor DPA Requests

Data Processing Agreements we need in place under GDPR Art. 28, LGPD Art. 39, and equivalent regimes. Templates + current status.

Status at a glance​

Sub-processorRoleDPA statusAction
Google (Firebase)Hosting, auth, database, functions, messaging🟡 Standard addendum available; acceptance has not been evidenced in this repositoryAccept at console.firebase.google.com → Project Settings → Integrations → Data Processing and Security Terms and archive evidence
RunPodGPU inference🔴 Not yet signedSend template below to legal@runpod.io
ResendTransactional email🔴 Not yet signedSend template below to legal@resend.com
Apple (App Store Connect, Sign in with Apple, IAP)Distribution + payments🟡 Agreement applicability and acceptance not reverified in this auditVerify the account agreement and archive the applicable terms before claiming coverage
StripeHosted test Checkout, billing portal, customer and subscription events🟡 Standard DPA available; test account only and production readiness not verifiedReview and record the applicable Stripe DPA, transfer terms, privacy disclosure, and PCI responsibilities before live mode

Template — RunPod DPA request​

To: legal@runpod.io
Cc: dpo@acesense.io
Subject: Data Processing Agreement request — AceSense (production account)

Hello,

AceSense Technologies operates an AI tennis coaching product. We use
RunPod's GPU serverless for inference on user-uploaded video. Under
GDPR Art. 28 (and equivalent US state / LGPD / UK-GDPR regimes), we
are required to have a written Data Processing Agreement with every
sub-processor that handles personal data on our behalf.

Details of the processing:

- Our RunPod account ID: <ACCOUNT_ID>
- Endpoint(s) used: <endpoint names>
- Categories of personal data: user-uploaded tennis video (which may
  include facial images of the user and incidental third parties),
  derived pose keypoints, ball trajectory, and shot metadata.
- Data subjects: our end users (≥16) globally.
- Processing locations used: EU preferred, US fallback.
- Retention: RunPod pods are stateless; no persistent storage beyond
  the lifetime of a single request.

Could you please:

1. Provide your standard DPA (or confirm our custom template is
   acceptable).
2. Confirm the Standard Contractual Clauses (EU Decision 2021/914,
   Module 2 — Controller to Processor) are incorporated by reference
   or attached.
3. Share your latest SOC 2 / ISO 27001 attestation under NDA if we
   don't already have it on file.
4. Confirm your list of further sub-processors (e.g. colocation DCs).

Happy to jump on a call if easier. Please treat this as time-
sensitive — we have a regulatory review cycle starting in 30 days.

Thanks,
— DPO, AceSense
dpo@acesense.io

Template — Resend DPA request​

To: legal@resend.com  (or support@resend.com if no legal email)
Cc: dpo@acesense.io
Subject: Data Processing Agreement request — AceSense (workspace <ID>)

Hello,

We use Resend for transactional email delivery from our production
Firebase "Trigger Email" extension. The categories of personal data
handled on our behalf include:

- Recipient email addresses (our users).
- Email content that references the user (name, session IDs, data-
  export download links).

Under GDPR Art. 28 and equivalent regimes, we need a signed Data
Processing Agreement in place. Please share:

1. Your standard DPA (SaaS DPA / Resend DPA).
2. Incorporation of EU SCCs (Module 2) for transfers of EU personal
   data to your US processing.
3. Your current list of sub-processors.
4. Confirmation of encryption-in-transit + at-rest for the mail queue.

Our sending domain is `acesense.io`.

Thanks,
— DPO, AceSense
dpo@acesense.io

Verification — Stripe​

Stripe publishes standard data-processing terms, so the next action is an account-specific legal and operational verification rather than sending the generic request templates above.

  • Confirm the AceSense contracting entity and account region.
  • Record which standard DPA and international-transfer terms apply, their version/date, and how they were accepted.
  • Inventory the exact identifiers and event fields sent to Stripe.
  • Obtain legal approval for the public landing and in-app notices and revalidate them against the completed field inventory before production processing.
  • For Stripe, document the merchant's PCI scope and any required self-assessment before enabling live mode. Stripe-hosted collection does not by itself prove AceSense compliance.
  • Archive evidence in approved private storage; do not commit agreements, account exports, or secrets to this public documentation repository.

What happens once signed​

  1. Accept or countersign, then store evidence in docs/compliance/dpas/<vendor>.pdf (private repo / secure storage, not this public docs repo).
  2. Update /compliance/overview.md Sub-processor status.
  3. If the DPA changes the retention terms or data locations, update privacy_policy_screen.dart + landing privacy.html accordingly.

If a sub-processor refuses​

  • Paid SaaS that refuses to sign a DPA is a hard blocker. Replace.
  • Typical replacements:
    • RunPod → Lambda Labs, Modal, Vast.ai, or direct cloud GPU (GCP / AWS).
    • Resend → Postmark, SendGrid, Mailgun (all have standard DPAs).
    • Stripe → another hosted payment service with acceptable processing and transfer terms.