Data processing agreement

This agreement is between the customer company that uses StockAI ("the customer") and [LEGAL COMPANY NAME], [COMPANY ID / TAX ID] ("StockAI"). It is part of the terms of service and applies from the moment the customer creates an account and uploads data.

If the customer needs a signed version of this agreement, it can ask for one at contacto@stockai.es. [SIGNED VERSION — confirm whether it is offered and who signs it]

Where this agreement contradicts the terms on personal data, this agreement prevails.

The customer is the controller of the personal data contained in the business data it uploads or connects: it decides which data is loaded and why. StockAI is the processor: it processes that data on the customer's behalf, only to provide the service.

For user-account data (name, email, WhatsApp number) that we use to run the service — for example, for sign-in and service emails — StockAI acts as controller, as the privacy policy explains.

The customer should not upload personal data it does not need to manage its inventory, and in particular special-category data (health, ethnic origin, biometric data and the like).

StockAI processes the data only on the customer's documented instructions. The instructions are: the terms, this agreement, and what the customer configures and does in the app or through the API (for example, uploading a file, turning on a WhatsApp alert or requesting an export).

If an instruction seems unlawful to us, we will tell the customer before following it. If a law requires us to process data differently, we will tell the customer first, unless that same law forbids it.

Only the StockAI staff who need it to run, maintain or support the service have access to the customer's data, and they are bound to confidentiality. [STAFF CONFIDENTIALITY COMMITMENTS — confirm how they are documented]

We do not look at an account's data except to solve a problem the customer raises, to maintain the service or when the law requires it.

StockAI applies, at least, these measures:

• Isolation per account: every database query is filtered by the account of whoever makes it; one company cannot see another's data.
• Role permissions: admin, analyst and viewer. Only an analyst or an admin can change data, and only an admin can export or delete the whole account.
• Passwords hashed with bcrypt and API keys stored only as a hash: nobody can read them.
• Credentials encrypted with Fernet: the passwords of databases and services the customer connects are stored encrypted.
• Short sessions: access expires after 15 minutes and renews while the tab is open; changing the password closes earlier sessions.
• Encrypted connection (TLS): traffic with the app and the API goes over HTTPS, with certificates managed by the web server (Caddy).
• Nightly database backups, kept for 14 days.
• Trial accounts erased entirely after 24 hours.

StockAI holds no certifications today (such as ISO 27001 or SOC 2). We may change these measures as long as the level of protection does not drop.

The customer authorises StockAI to use these sub-processors, each only for its task:

We require each sub-processor to meet data-protection obligations equivalent to those in this agreement, as far as its terms allow. [CONTRACTS WITH SUBPROCESSORS — confirm they exist and where they are recorded]

Before adding or changing a sub-processor, we update this list and notify the customer by email [NOTICE PERIOD — confirm] in advance. If the customer objects on reasonable grounds and we cannot find a solution, it may end the service without penalty.

Because of the sub-processors above, data may be processed outside the customer's country: in Boston, United States, in China (DeepSeek, only if the AI features are used with the default provider), in the country of the AI provider the customer chooses and in the United States (Twilio, only if WhatsApp or SMS is turned on).

For customers in the European Union or Spain: China has no adequacy decision from the European Commission. [TRANSFER MECHANISM — standard contractual clauses or other, confirm with a lawyer for DeepSeek and Twilio]. If the customer cannot accept the transfer to China, it can ask us for its account not to use the AI features by writing to contacto@stockai.es.

If StockAI becomes aware of a security breach affecting the customer's personal data, it will notify the customer without undue delay and within [NOTIFICATION PERIOD — confirm] of becoming aware, at the account administrator's email.

The notice will say, as far as is known at the time: what happened, which data and how many people may be affected, the likely consequences, what we have done and what we recommend doing. Whatever is not known at first we will send as soon as we know it.

The customer, as controller, decides whether to notify the authority and the people affected; we will give it the information it needs to do so.

If a person asks us to access, correct or delete their data held in the customer's account, we will pass the request to the customer and not answer it ourselves, unless the law requires us to.

The customer can correct most data from the app. To answer a request, an admin can download a complete copy of the account, and we will help with whatever it cannot do itself. We will also help, within reason, with impact assessments and consultations with the authority.

When the service ends, the customer can ask for a complete copy of its data: a ZIP file with every table of its company (without passwords, key hashes or secrets). An admin can download it directly through the API, or ask us at contacto@stockai.es.

Then we delete the account: all its tables and files are removed at once. Backups that still contain them disappear on their own within 14 days. We will only keep something if a law requires it, and only what that law requires.

On the customer's reasonable request, we will provide the information needed to show that we comply with this agreement: for example, the description of the security measures and the list of sub-processors.

If that is not enough, the customer may carry out an audit, itself or through an auditor bound to confidentiality, with [ADVANCE NOTICE — confirm] notice, during business hours, without affecting the service or other customers' data, and at its own cost. [AUDIT FREQUENCY AND CONDITIONS — confirm]

Each party's liability under this agreement is governed by the limitation of liability section of the terms, except where applicable law does not allow it to be limited.

This agreement is based on Costa Rica's Law 8968 (Protection of Persons with regard to the Processing of their Personal Data). For customers in the European Union or Spain, it also serves as the processor contract required by Article 28 of the General Data Protection Regulation (GDPR) and is interpreted in accordance with it and with Organic Law 3/2018 (LOPDGDD).