Data Processing Addendum

Last updated: 2026-10-17

This Data Processing Addendum (“DPA”) is part of the Terms of Service between IdeasCol, LLC (“Groveback”, “Processor”) and the customer that accepted them (“Customer”, “Controller”). It applies when Groveback processes Customer Personal Data on Customer’s behalf. By accepting the Terms, Customer accepts this DPA; no separate signature is required. If you need a countersigned copy, write to jairof@ideascol.com.

This DPA is designed to meet article 28 of the EU General Data Protection Regulation (GDPR) and the UK GDPR, and serves as the data transmission contract (contrato de transmisión) required by article 2.2.2.25.5.2 of Colombian Decree 1074 of 2015 (formerly article 25 of Decree 1377 of 2013).

1. Definitions

Data Protection Laws: all laws on personal data that apply to the processing, including the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, Colombian Law 1581 of 2012 and its regulations, and U.S. state privacy laws.
Customer Personal Data: personal data within Customer Data (as defined in the Terms) that Groveback processes on Customer’s behalf to provide the Service.
Subprocessor: a third party engaged by Groveback that processes Customer Personal Data.
Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
“Controller”, “processor”, “data subject”, “personal data” and “processing” have the meaning given in the GDPR; for Colombian law, “controller” means responsable and “processor” means encargado.

2. Roles and scope

Customer is the controller of Customer Personal Data and Groveback is its processor. Where Customer is itself a processor for a third party, Groveback is its subprocessor, and Customer confirms that its controller has authorized this. The details of the processing (subject matter, duration, nature, purpose, types of data and categories of data subjects) are in Annex 1.

Groveback processes data about its own customers’ accounts, billing and use of the Service as a controller, under the Privacy Policy; that processing is outside this DPA.

3. Customer’s instructions

Groveback processes Customer Personal Data only on Customer’s documented instructions, which are: the Terms and this DPA, Customer’s configuration and use of the Service (including through the dashboard, API, CLI and MCP server), and any other written instruction that Groveback agrees to. Groveback will tell Customer if, in its opinion, an instruction infringes Data Protection Laws, and may suspend that processing until the instruction is confirmed or changed. If the law requires Groveback to process data otherwise, it will inform Customer first, unless the law forbids it.

4. Customer’s obligations

Customer is responsible for having a lawful basis and, where required, the prior, express and informed authorization of data subjects for the processing; for giving data subjects the notices the law requires, including its own privacy policy; for the accuracy of Customer Personal Data; and for the configuration it controls, including access policies, functions, API keys and integrations. Customer will not instruct Groveback to process special categories of personal data or data of children unless the law allows it and Customer has the safeguards required.

5. Confidentiality

Groveback ensures that everyone it authorizes to process Customer Personal Data is bound by confidentiality, and gives access only to those who need it to provide, support or secure the Service.

6. Security

Groveback implements and maintains the technical and organizational measures in Annex 2, taking into account the state of the art, the costs, and the nature, scope, context and purposes of the processing and its risks. Groveback may update these measures as long as the overall level of security does not decrease.

7. Subprocessors

Customer gives Groveback general authorization to engage Subprocessors. The current Subprocessors are listed in Annex 3.

Groveback imposes on each Subprocessor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, and remains responsible to Customer for its Subprocessors’ performance.
Groveback will announce any new or replacement Subprocessor by updating Annex 3 and notifying Customer by email or in the dashboard at least 15 days before it starts processing Customer Personal Data.
Customer may object on reasonable data protection grounds within that period by writing to jairof@ideascol.com. The parties will discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the remaining period.

Third-party services that Customer chooses to connect to a project (for example GitHub, Vercel, email or messaging providers, or an AI provider with Customer’s own key) are not Groveback’s Subprocessors; Customer engages them directly.

8. Data subject requests

Taking into account the nature of the processing, Groveback will help Customer respond to requests from data subjects to exercise their rights, mainly by providing tools in the Service to find, export, correct and delete data. If Groveback receives a request directly, it will redirect the data subject to Customer and will not answer it itself unless Customer authorizes it or the law requires.

9. Security Incidents

Groveback will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice will include, as far as known: the nature of the incident, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed. Groveback will take reasonable steps to contain and remedy the incident and will cooperate with Customer so it can meet its own obligations to notify authorities (including the SIC in Colombia) and data subjects. Notifying an incident is not an admission of fault.

10. Assistance

Groveback will provide reasonable assistance to Customer, using information available to it, with data protection impact assessments and prior consultations with supervisory authorities that relate to the Service.

11. Return and deletion

Customer can export and delete Customer Personal Data with the Service at any time. When the Terms end, Customer has 30 days to export it. After that, Groveback deletes Customer Personal Data from its active systems within 30 days, and from backups as they rotate out, unless the law requires Groveback to keep it, in which case Groveback will keep it confidential and process it only for that purpose.

12. Audits

Groveback will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, including written answers to security questionnaires. If that information is not enough to meet a requirement of Data Protection Laws or a supervisory authority, Customer may audit Groveback, at most once per year, with at least 30 days’ notice, during business hours, at Customer’s cost, through an independent auditor bound by confidentiality, and without access to other customers’ data.

13. International transfers

Groveback and its Subprocessors may process Customer Personal Data in the countries listed in Annex 3.

EEA: to the extent Customer transfers Customer Personal Data from the EEA to Groveback in a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 are incorporated into this DPA: Module Two (controller to processor) and, where Customer is a processor, Module Three (processor to processor). For their purposes: clause 7 (docking) applies; under clause 9, option 2 (general authorization) applies with the notice period in section 7 of this DPA; the optional wording in clause 11 does not apply; under clauses 17 and 18, the law and courts of Ireland apply; Annexes I, II and III of the clauses are completed by Annexes 1, 2 and 3 of this DPA.
UK: for transfers from the UK, the International Data Transfer Addendum issued by the UK Information Commissioner is incorporated, completed with the information in this DPA.
Switzerland: for transfers from Switzerland, the clauses above apply with the Swiss Federal Data Protection and Information Commissioner as the competent authority and the Swiss Federal Act on Data Protection in place of the GDPR where relevant.
Colombia: this DPA is the transmission contract required by Colombian law. Groveback, as encargado, undertakes to process Customer Personal Data only for the purposes in Annex 1 and according to Customer’s personal data processing policy, to keep it secure and confidential, and to comply with Law 1581 of 2012.

If these clauses conflict with this DPA, the clauses prevail.

14. Liability and order of precedence

Each party’s liability under this DPA is subject to the limitations in the Terms, to the extent Data Protection Laws allow. If this DPA conflicts with the Terms, this DPA prevails for matters of data protection. This DPA lasts as long as Groveback processes Customer Personal Data.

Annex 1: Details of the processing

Parties: Customer (data exporter, controller or processor), the account holder identified in the Service. Groveback (data importer, processor): IdeasCol, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, United States, contact jairof@ideascol.com.
Subject matter and nature: hosting, storage, retrieval, querying, indexing (including vector embeddings), transmission, backup and deletion of Customer Data, and the execution of Customer’s functions on it, to provide the Service.
Purpose: providing, securing and supporting the Service under the Terms and Customer’s instructions.
Duration: for the term of the Terms, plus the export and deletion periods in section 11.
Frequency: continuous.
Categories of data subjects: determined by Customer; typically the end users of Customer’s applications, and Customer’s own personnel and members of its workspace.
Types of personal data: determined by Customer; typically identification and contact data (name, email, user ID), authentication data (password hashes, OAuth identifiers, session data), files and content uploaded by end users, and usage data generated by Customer’s applications.
Special categories: none, unless Customer decides otherwise under section 4.
Retention: as configured by Customer, and as described in section 11.
Transfers to Subprocessors: as listed in Annex 3, for the purposes described there.

Annex 2: Technical and organizational measures

Encryption: data in transit between clients and the Service is encrypted with TLS. Secrets that Customer stores, such as integration credentials and AI provider keys, are encrypted at rest with AES-256-GCM and never returned to the dashboard, function code or exports.
Authentication: end-user and member passwords are hashed with argon2id. Sessions use signed, expiring tokens. API keys are scoped to a single project.
Authorization: access to project data is gated by explicit permissions. The data plane is fail-closed: a collection is unreachable by non-admin callers until Customer adds a policy, and policies are enforced on the server on every request.
Isolation: each project’s data is logically separated. Customer functions run in a sandboxed worker without database credentials or secrets, and reach data only through a host-mediated bridge that applies the caller’s permissions.
Logging and monitoring: administrative actions are recorded in a per-project audit log. Usage is metered and limited per plan to protect the platform.
Access control for personnel: access to production systems is limited to the people who need it, protected by strong authentication, and revoked when no longer needed.
Secure development: code changes go through automated tests, type checking and coverage gates before release; dependencies are pinned.
Incident response: Security Incidents are handled as described in section 9; vulnerabilities can be reported to jairof@ideascol.com.
Data minimization and deletion: Customer controls what it stores and can export and delete it at any time; deletion follows section 11.

Annex 3: Subprocessors

Groveback uses the following Subprocessors to provide the Service. Some are only involved when a feature is enabled or used.

Subprocessor	Purpose	Data	Location
Civo Ltd.	Cloud infrastructure: the Kubernetes cluster that runs the API, the databases (MongoDB and Redis), file storage, functions and realtime	All Customer Data stored on the platform	New York, United States (NYC1)
Civo Ltd. (object storage)	Nightly backups of the databases and files, kept outside the cluster	Copies of Customer Data	New York, United States (NYC1)
Stripe, Inc.	Payments, subscriptions and invoicing for paid plans	Account holder’s name, email and billing details; no Customer Data	United States
Resend	Transactional email: verification, password reset, invitations and notices	Recipient email address and message content	United States
Anthropic, PBC	AI model for the dashboard assistant and knowledge-base answers (when used)	Prompts and the project context needed to answer them	United States
OpenAI	AI model and text embeddings for the assistant, knowledge bases and vector search (when used)	Prompts, project context, text to embed	United States
Google LLC (Gemini API)	AI model for the dashboard assistant (when used)	Prompts and the project context needed to answer them	United States
Voyage AI (MongoDB, Inc.)	Text embeddings for knowledge bases and vector search (when used)	Text to embed	United States
Vercel Inc.	Hosting of groveback.com and docs.groveback.com	Website visitors’ IP addresses and request logs; no Customer Data	United States

Last updated: 2026-10-17. To be notified of changes, see section 7.