Data Processing Agreement

This Data Processing Agreement (“DPA”) is between Flow-Forges (“Processor”) and the customer (“Controller”) who has subscribed to QualifAI services.

This DPA applies to all Processing of Personal Data carried out by Processor on behalf of Controller under the QualifAI Terms of Service. It remains in effect for the duration of the service subscription and for 90 days post-termination (data retention period).

Personal Data processed: names, email addresses, phone numbers, SMS conversation content, appointment details, budget information, and lead qualification scores. Data subjects: the Controller's leads, prospects, and customers who interact with QualifAI's SMS qualification service.

Processor engages the following sub-processors:

• Twilio Inc. (USA) — SMS messaging infrastructure
• Anthropic PBC (USA) — language model (Claude)
• DeepSeek (China) — language model (fallback)
• Supabase Inc. (USA) — Database and authentication infrastructure
• Hetzner Online GmbH (Germany) — Cloud hosting infrastructure
• Vercel Inc. (USA) — Frontend hosting and serverless functions
• Ollama (self-hosted) — Local model inference (on Hetzner, no data leaves EU)

Controller will be notified of any changes to sub-processors at least 14 days in advance.

Processor implements: encryption at rest (PostgreSQL), encryption in transit (TLS 1.3), JWT-based authentication with bcrypt password hashing, rate limiting, IP-based brute-force protection, automated database backups (daily, 30-day retention), container resource isolation, non-root execution, and structured JSON logging with Sentry error monitoring.

Processor assists Controller in fulfilling data subject access requests (DSARs), including: right of access (data export), right to erasure (account deletion), and right to object. Controller can initiate these via the Settings dashboard or by contacting privacy@flow-forges.com.

Processor will notify Controller without undue delay (within 72 hours) upon becoming aware of a personal data breach affecting Controller's data.

Certain sub-processors are based in the United States and China. Where personal data of EEA/UK data subjects is transferred to these jurisdictions, Processor relies on applicable safeguards including Standard Contractual Clauses (SCCs) as adopted by the European Commission. Ollama inference runs on Hetzner (Germany) — no personal data leaves the EU for processing.

This DPA is governed by the laws of India. Disputes are subject to the exclusive jurisdiction of courts in New Delhi. For any questions regarding this DPA, contact: privacy@flow-forges.com