{"_meta":{"description":"ALETHEIA Data Processing Agreement & Compliance Tracking — Canonical source for per-subprocessor transfer-mechanism status. Aligns with HQ Data Policy v2.0.","version":"2.0.0","last_updated":"2026-10-18","review_schedule":"quarterly","next_review":"2026-10-20","supersedes":"1.0.0","alignment":{"hq_data_policy_version":"2.0","aletheia_privacy_version":"1.2"},"correction_note":"Corrected 29 September 2026 to match what the service does: API-key storage, retention after cancellation, backups, hosting-log contents and retention, Cloudflare’s DNS-only role, the identifier received from RapidAPI and the handling of email content. Unverified encryption statements were removed, a scheduling service that is no longer used was taken off, and the retention of watchlists, webhooks and the Stripe customer reference is now stated. Corrected 8 October 2026 to name an existing recipient: Google Workspace, which hosts our own mailbox and the form behind the site feedback widget, and to widen Resend's entry to the messages sent through our contact form and the email series for the guides. Corrected 18 October 2026: the transfer fields of Cloudflare, Stripe, Upstash and Vercel now state each one's condition as its own Data Processing Addendum gives it, quoted from the captured document, and an unsourced “DPF-certified” was removed from Vercel's entry."},"data_controller":{"entity":"Holistic Quality LLC","jurisdiction":"US (Ohio, USA)","contact":"privacy@holisticquality.io","security_contact":"security@holisticquality.io","legal_contact":"legal@holisticquality.io","dpo_contact":null},"independent_controllers":[{"name":"RapidAPI (R Software Inc.)","role":"Independent data controller for marketplace users' account, billing, and KYC data","relationship":"NOT a subprocessor of Holistic Quality; operates under its own privacy policy","data_received_by_hq":["RapidAPI username (X-RapidAPI-User header) and subscription tier","Request metadata (endpoint, timestamp, status, latency)"],"data_NOT_received_by_hq":["RapidAPI account email address","Passwords","Payment card details","Billing address"],"privacy_policy_url":"https://rapidapi.com/privacy"}],"processors":[{"name":"Cloudflare","service":"DNS only. No website traffic, logs or personal data pass through Cloudflare.","jurisdiction":"US (global edge network)","data_location":"Global edge network","dpa_status":"in_force","dpa_version":"6.4 (April 3, 2026)","dpa_url":"https://www.cloudflare.com/cloudflare-customer-dpa/","dpa_executed":"2026-04-03","dpa_execution_model":"Self-serve — DPA is Effective per §Preamble 'from the date on which Customer signed or the parties otherwise agreed to this DPA.' Continued use of the Cloudflare platform after the v6.4 publication date (April 3, 2026) constitutes acceptance; no countersignature required.","dpa_evidence":"ftp-dba/cloudflare_customer_dpa-v6.4_april_3_2026.pdf","dpa_acknowledged_by_hq":"2026-04-20","sccs_required":"Only for a Restricted Transfer (Cloudflare Customer DPA v6.4, clause 6.2). A transfer under the Data Privacy Framework is not one: “transfers of Customer Data to Cloudflare made under the Data Privacy Framework shall not be a Restricted Transfer”; if Cloudflare’s certification lapses or is invalidated, “any transfers of Personal Data from Customer to Cloudflare shall immediately be deemed a Restricted Transfer” (clause 6.4).","transfer_mechanism":"Where a transfer to Cloudflare is a Restricted Transfer: the EU SCCs, with Module Two where the Customer is a Controller and Module Three where the Customer is a Processor (clause 6.2(a)), and for UK transfers the UK Addendum (Version B1.0). A transfer made under the Data Privacy Framework is not a Restricted Transfer (clause 6.4). The DPA also says “Cloudflare has certified to the Global CBPR System and the Global PRP System” (clause 3.2).","privacy_policy_url":"https://www.cloudflare.com/privacypolicy/","data_categories":[],"retention":{},"encryption":"Not applicable (DNS only; no personal data)","subprocessor_list_url":"https://www.cloudflare.com/gdpr/subprocessors/","dpa_evidence_sha256":"7c778ab8510c5db073768b105805d88024e82ea4feb8ad19b559f236d51d0be3"},{"name":"Upstash","service":"Serverless Redis — API key storage, rate limiting, account records","jurisdiction":"EU (Ireland)","data_location":"eu-west-1 (AWS Ireland)","dpa_status":"in_force","dpa_version":"Last Updated April 2025","dpa_url":"https://upstash.com/trust/dpa.pdf","dpa_executed":"2025-04-01","dpa_execution_model":"Self-serve — Upstash DPA is incorporated by reference into the Upstash Terms of Service; acceptance of the TOS constitutes acceptance of the DPA. No countersignature required for initial execution (only DPA amendments require dual signature per §Customer Instructions).","dpa_evidence":"receipts/sources/2026-10-18-wf935-upstash-dpa.pdf","dpa_evidence_sha256":"6a85493f62d0c24e38baacea6b9c421273e73f206ec2bb797980410cfc6e90a1","dpa_acknowledged_by_hq":"2026-04-20","sccs_required":"Only if European Data Protection Laws require safeguards and the Data Privacy Framework does not cover the transfer to Upstash Inc. or is invalidated (DPA section 3.2(B)(2)): “If European Data Protection Laws require that appropriate safeguards are put in place (for example, if the Data Privacy Framework does not cover the transfer to Upstash Inc. and/or the Data Privacy Framework is invalidated), the Standard Contractual Clauses will be incorporated by reference and form part of the Agreement”.","transfer_mechanism":"The DPA says “Upstash Inc. is a recipient of European Data in the United States” (section 3.2(B)), and “Upstash Inc. will use the Data Privacy Framework to lawfully receive European Data in the United States” (section 3.2(B)(1)). The Standard Contractual Clauses (Modules Two and Three) are the fallback quoted in sccs_required.","privacy_policy_url":"https://upstash.com/trust/privacy.pdf","data_categories":["API key records (the key itself, used to authenticate requests)","Email addresses","Usage counters","Trial flags","Enterprise inquiry data","Watchlist compound IDs","Webhook configurations","Rate limit counters"],"retention":{"api_keys_active":"Up to 2 years after the key was last used (a paid key never used: 2 years after issue; an unused trial key: 14 days after issue)","api_keys_post_cancellation":"Remaining time kept (up to 2 years after last use); cancellation does not shorten it. The stripe_customer reference expires 90 days after cancellation","trial_flags":"30 days (auto-TTL)","usage_metadata":"90 days (auto-TTL)","rate_limits":"24 hours (auto-TTL)","inquiry_data":"30 days (auto-TTL)","backup_snapshots":"Weekly snapshot of key, Stripe-customer and webhook records, written to the same database; each snapshot expires 30 days after it is taken","stripe_customer_active":"The email, up to 5 years from checkout while the subscription is active","watchlists_and_webhooks":"Expire with the key record they belong to (up to 2 years after last use); if setting that expiry fails, a cleanup run at every deploy sets it, or deletes the record if its key record is already gone; a deleted webhook takes its delivery log; a verified erasure request deletes them","rapidapi_user_daily_counts":"Until the end of the UTC day; if setting that expiry fails, a cleanup run at every deploy sets it, or deletes the count if its day is already over","unsubscribe_records":"No expiry, so the unsubscribe is honoured; an erasure request keeps them","per_client_analytics":"30 days (auto-TTL); each client identified by a keyed hash of its IP address or API key; used to see which clients use the API heavily and may need an API key or a paid plan"},"encryption":"Not recorded","subprocessor_list_url":"https://upstash.com/trust/subprocessors"},{"name":"Vercel","service":"Serverless compute, website hosting, infrastructure logs","jurisdiction":"US","data_location":"iad1 (US-East) and global edge","dpa_status":"in_force","dpa_version":"Effective March 31, 2026 (Pro/Enterprise plans)","dpa_url":"https://vercel.com/legal/dpa","dpa_executed":"2026-03-31","dpa_execution_model":"Self-serve — DPA applies automatically to Pro and Enterprise plan customers; continued use of the Vercel platform after the effective date constitutes acceptance. No countersignature required.","dpa_evidence":"receipts/sources/2026-10-18-wf935-vercel-dpa.html","dpa_evidence_sha256":"f4ed979d28d0926b547a4f0de2d5aad5d5b42ad4c2d8347ccca5f97a9d39c56a","dpa_evidence_url":"https://assets.vercel.com/image/upload/q_auto/front/legal/dpa/Vercel_Inc_-_Data_Processing_Addendum.pdf","dpa_acknowledged_by_hq":"2026-04-20","sccs_required":"Only for a transfer that is subject to the Standard Contractual Clauses. Schedule 3 applies on the Addendum’s own condition: “To the extent that Customer's use of the Services requires an onward transfer mechanism to lawfully transfer personal data” (from the EEA, the UK, Switzerland or another listed jurisdiction to Vercel outside it); and Schedule 3 section 3 says “For data transfers from the EEA, the UK, and Switzerland that are subject to the Standard Contractual Clauses, the Standard Contractual Clauses will apply”.","transfer_mechanism":"Schedule 3 of the Vercel DPA defines its Standard Contractual Clauses as “the 2021 Standard Contractual Clauses approved by the European Commission in decision 2021/914” (section 1) and applies them as section 3 states; for transfers from the United Kingdom, “For data transfers from the United Kingdom, the UK IDTA will be deemed entered into” together with those clauses (section 2).","privacy_policy_url":"https://vercel.com/legal/privacy-policy","data_categories":["Request logs (request path with query parameters, full client IP address, User-Agent)","Function execution metadata","CDN cache keys","Vercel Analytics (anonymous, no cookies, no fingerprinting)"],"retention":{"function_logs":"30 days (Observability Plus)","cdn_cache":"Per Cache-Control headers"},"encryption":"TLS 1.2 or 1.3 in transit, encrypted at rest","subprocessor_list_url":"https://vercel.com/legal/subprocessors"},{"name":"Resend","service":"Transactional email delivery for direct-issued accounts (API key issuance, trial reminders, security advisories, rights-request verification), for the messages you send through our contact form (our notification to us and our reply to you) and for the email series for the guides you request.","jurisdiction":"US","data_location":"US","dpa_status":"in_force","dpa_version":"Updated 31 December 2025","dpa_url":"https://resend.com/legal/dpa","dpa_executed":"2025-12-31","dpa_execution_model":"Self-serve — Resend DPA becomes legally binding upon Customer's acceptance of the Agreement (Terms of Service). Signature blocks in the DPA document are explicitly 'for reference purposes only' per the preamble. No countersignature required.","dpa_evidence_url":"https://resend.com/static/documents/resend-dpa-signed.pdf","dpa_acknowledged_by_hq":"2026-04-20","sccs_required":true,"sccs_status":"in_force","transfer_mechanism":"2021 EU Commission SCCs incorporated in Resend DPA; EU-U.S. Data Privacy Framework (Resend DPF-certified)","privacy_policy_url":"https://resend.com/legal/privacy-policy","data_categories":["Email addresses","Email content","Delivery metadata"],"retention":{"email_logs":"28 days (Resend retention policy)"},"encryption":"TLS in transit","subprocessor_list_url":"https://resend.com/legal/subprocessors"},{"name":"Google Workspace","service":"Email and forms hosting. Hosts Holistic Quality's own mailbox and the form behind the site feedback widget: messages you send through our contact form, replies to our emails, and reports you send through the feedback widget reach it. Google Forms is one of the Google Workspace services that Google's Workspace terms list. Not a sub-processor of Customer Personal Data under our DPA.","jurisdiction":"Not checked: the captured pages name no contracting entity, so no country is stated for one.","data_location":"Any country where Google or its subprocessors maintain facilities, subject to its data location commitments (Cloud Data Processing Addendum, section 10.1)","dpa_status":"in_force","dpa_version":"Cloud Data Processing Addendum; the page header reads \"Last modified June 8, 2026\" (no version number)","dpa_url":"https://cloud.google.com/terms/data-processing-addendum/","dpa_executed":"Per the Google Workspace agreement (the Addendum is incorporated into it by reference; Google's page gives no date)","dpa_execution_model":"Incorporated by reference: the Addendum \"is incorporated into the Agreement(s) (as defined below) between Google and Customer\" and was formerly the \"Data Processing Amendment\" under an Agreement for Google Workspace. No separate signature; acceptance in our Admin console is not recorded here.","dpa_evidence":"receipts/sources/2026-10-08-d990-google-cloud-dpa.html","dpa_evidence_sha256":"ed4b048e33be85f567a9e4c4cf350c65904f4937169e763500c06f41d4490c6a","services_evidence":"receipts/sources/2026-10-08-d990-google-workspace-user-features.html","services_evidence_sha256":"62ef551d338c36e24de8aa5a0d2d34f3b3f5d7521ca772794e8e5a3af4aa4aec","subprocessor_list_evidence":"receipts/sources/2026-10-08-d990-google-workspace-subprocessors.html","subprocessor_list_evidence_sha256":"6528742c244e421b857d45e8b327ba48f7b9152e340566226911039a2005cc8a","sccs_required":"Only where Google has not adopted an Alternative Transfer Solution for the transfer (Cloud Data Processing Addendum, Appendix 3, European Data Protection Law, section 4.1)","transfer_mechanism":"Where European data protection law applies to a restricted transfer: an Alternative Transfer Solution, if Google has adopted one (published at https://cloud.google.com/terms/alternative-transfer-solution); if it has not, the SCCs that Google's terms define (https://cloud.google.com/terms/sccs/eu-c2p and the other SCCs listed there) apply (Cloud Data Processing Addendum, Appendix 3, European Data Protection Law, section 4.1)","data_categories":["Contact-form fields (name, work email, company, role, intent, volume, message, how you heard of us), with the client IP address and User-Agent","Replies to our emails","Feedback-widget reports (site, compound, category, details, optional email, page URL)"],"retention":{"retention":"Not checked: retention of our own mailbox and of the feedback form's responses has not been looked up for this entry. Google's deletion terms are in section 6 (Data Deletion) of its Cloud Data Processing Addendum."},"encryption":"Google-managed; Appendix 2 (Security Measures) of its Cloud Data Processing Addendum includes measures to encrypt Customer Data (not independently assessed by us)","subprocessor_list_url":"https://workspace.google.com/intl/en/terms/subprocessors.html"},{"name":"Stripe","service":"Payment processing and subscription management (direct-issued customers only)","jurisdiction":"US","data_location":"US","dpa_status":"in_force","dpa_version":"Incorporated into current Stripe Services Agreement (SSA)","dpa_url":"https://stripe.com/legal/dpa","dpa_executed":"Per active SSA","dpa_execution_model":"Self-serve — the Stripe DPA “is subject to and incorporated by reference into the Agreement” (DPA section 1), and “This Data Transfers Addendum is incorporated by reference into the data processing agreement between User and Stripe” (Data Transfers Addendum, section 1). No separate countersignature required.","dpa_evidence":"receipts/sources/2026-10-18-wf935-stripe-dpa.html","dpa_evidence_sha256":"9df1e12467a51f36488298a84d8163cdfddc9966384ce67b1d873d62ef9a554e","transfers_addendum_evidence":"receipts/sources/2026-10-18-wf935-stripe-dta.html","transfers_addendum_evidence_sha256":"f46197f894825afab7f182ce6168ce9fd724103061fb1f89b6ab12ffd092ecf0","dpa_acknowledged_by_hq":"2026-04-20","sccs_required":"Only if the Data Privacy Framework does not apply to the transfer. Stripe’s Data Transfers Addendum puts the Data Privacy Framework first: “the transfer will be subject to one Data Transfer Mechanism only, according to the following order of precedence: (a) the Data Privacy Framework; (b) the EEA SCCs or the UK International Data Transfer Addendum, as applicable” (Data Transfers Addendum, section 2).","transfer_mechanism":"For a transfer that requires a Data Transfer Mechanism, the DPA says “the Data Transfers Addendum, which is incorporated into this DPA, will apply” (DPA section 6.1). In the Addendum the Data Privacy Framework comes first (“Stripe, LLC is self-certified under the Data Privacy Framework”, section 3); if that certification is withdrawn, “an alternative Data Transfer Mechanism will apply” (section 3): the EEA SCCs (Modules 1, 2 and 3, section 4) or the UK International Data Transfer Addendum (section 2). PCI-DSS Level 1 certified processor","privacy_policy_url":"https://stripe.com/privacy","data_categories":["Email address","Payment information (card data never touches ALETHEIA servers — PCI SAQ-A per COMP-7)"],"retention":{"billing_data":"Per Stripe retention policy"},"encryption":"TLS 1.2+ in transit, AES-256 at rest (Stripe managed)","subprocessor_list_url":"https://stripe.com/legal/service-providers"}]}