DRAFT / PLACEHOLDER — final text follows Datatilsynet's standard template (GDPR art. 28) and has not yet been legally reviewed. Do not onboard a paying customer against this version.
Data Processing Agreement
Version 2026-08-17-draft.2 · Fixed annex to the Terms of Service
Subprocessors
Recortex uses the following subprocessors. All customer data resides in the EU (Supabase, Frankfurt); Claude API calls carry business data under this agreement — personal data is stripped or hashed at signal ingestion and never reaches the Claude API (data minimization by design, GDPR art. 5).
| Subprocessor | Role |
|---|---|
| Supabase | Database and Edge Functions hosting (EU Frankfurt) |
| Anthropic | Claude API — recommendation generation |
| Vercel | Frontend hosting |
Processing terms
[TODO: full Datatilsynet standard-template clauses — subject matter and duration, nature and purpose, categories of data subjects and personal data (note: Recortex operates on order value, product, timestamp and channel only — never names, emails, addresses or customer identifiers), instructions, confidentiality, security measures, sub-processing, transfers, assistance, breach notification without undue delay, deletion within 30 days of termination, audit rights — per RECORTEX-POLICIES.md v2 §1-§2, §6.]