Data Processing Agreement

Agreement

This DPA supplements the following agreement: bluefairy.app/terms

Approved Subprocessors

Provider Security Contact

jakegordon53@gmail.com

Security Policy

As defined in the Agreement.

Service Provider Relationship (CCPA)

To the extent California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq ("CCPA") applies, the parties acknowledge and agree that Provider is a service provider and is receiving Personal Data from Customer to provide the Service as agreed in the Agreement and detailed below (see Nature and Purpose of Processing), which constitutes a limited and specified business purpose. Provider will not sell or share any Personal Data provided by Customer under the Agreement. In addition, Provider will not retain, use, or disclose any Personal Data provided by Customer under the Agreement except as necessary for providing the Service for Customer, as stated in the Agreement, or as permitted by Applicable Data Protection Laws. Provider certifies that it understands the restrictions of this paragraph and will comply with all Applicable Data Protection Laws. Provider will notify Customer if it can no longer meet its obligations under the CCPA.

Restricted Transfers

Data Exporter

Data Importer

Categories of Personal Data

• Name
• Contact information such as email, phone number, or address
• User activity and analysis such as device information or IP address

Nature and Purpose of Processing

• Receiving data, including collection, accessing, retrieval, recording, and data entry
• Holding data, including storage, organisation, and structuring
• Using data, including analysis, consultation, testing, automated decision making, and profiling
• Protecting data, including restricting, encrypting, and security testing
• Sharing data, including disclosure, dissemination, allowing access, or otherwise making available
• Returning data to the data exporter or data subject

Duration of Processing

Provider will process Customer Personal Data as long as required (i) to conduct the Processing activities instructed in Section 2.2(a)–(d) of the Standard Terms; or (ii) by Applicable Laws.

Competent Supervisory Authority

The supervisory authority will be the supervisory authority of the data exporter, as determined in accordance with Clause 13 of the EEA SCCs or the relevant provision of the UK Addendum.

Pseudonymisation and encryption of personal data

All personal data is encrypted in transit via TLS/HTTPS across all services. Data at rest is encrypted by Supabase (database) and the hosting infrastructure provided by Railway and Vercel. BlueFairy does not currently implement pseudonymisation.

Ongoing confidentiality, integrity, availability, and resilience

BlueFairy maintains confidentiality, integrity, availability, and resilience of processing systems through the following measures: all data is encrypted in transit (TLS/HTTPS) and at rest (Supabase); authentication is handled via GitHub OAuth with session management by Supabase; all API routes require authentication; server activity is logged on Railway; Supabase provides automated backups and point-in-time recovery; physical infrastructure security is delegated to SOC 2-compliant cloud providers (AWS via Supabase, Railway, Vercel); access to production systems is restricted to the sole operator. As a single-operator service, all access control and security decisions are centralised and reviewed directly by the Provider.

Ability to restore availability following an incident

Customer personal data is hosted on Supabase, which provides automated daily backups and point-in-time recovery. In the event of a physical or technical incident, data availability can be restored from these backups. Application infrastructure is distributed across managed cloud providers (Railway, Vercel, Supabase), reducing single points of failure.

Regular testing, assessment, and evaluation

The Provider conducts periodic manual reviews of access controls, dependency updates, and server logs. Security-relevant dependencies are monitored for vulnerabilities via package manager tooling. As a solo-operated early-stage service, formal third-party audits and certifications (e.g. SOC 2, ISO 27001) have not yet been obtained but are planned as the service scales.

User identification and authorisation

Users authenticate via GitHub OAuth, managed by Supabase. No passwords are stored by BlueFairy — authentication is delegated entirely to GitHub, which enforces its own credential security and supports multi-factor authentication. Session tokens are issued by Supabase and transmitted only over HTTPS. Access to the BlueFairy application requires a valid session token on all protected routes.

Protecting personal data during transmission (in transit)

All data transmitted between clients and BlueFairy services is encrypted using TLS via HTTPS, enforced across all endpoints on Vercel (frontend) and Railway (backend). No personal data is transmitted over unencrypted connections.

Protecting personal data during storage (at rest)

Customer personal data is stored in Supabase, which encrypts all data at rest using AES-256. Access to the database is restricted to the BlueFairy application server via authenticated connections. No personal data is stored in client-side storage beyond session tokens required for authentication. Physical storage security is managed by Supabase's underlying infrastructure provider (AWS).

Physical security

BlueFairy does not operate physical infrastructure. All personal data is processed and stored within the facilities of SOC 2-compliant cloud providers (Supabase/AWS, Railway, Vercel), which maintain physical security controls including access-controlled facilities, surveillance, and environmental protections. The Provider's own working environment is a private location with no shared or public access to devices used to administer production systems.

Events logging

Railway logs all server-side requests including timestamps, request paths, and IP addresses. These logs are retained by Railway and are accessible to the Provider for debugging and incident response purposes. Supabase maintains its own audit logging for database access and authentication events.

Systems configuration, including default configuration

All production systems use secure default configurations provided by managed cloud platforms (Supabase, Railway, Vercel). Environment variables and secrets are stored in platform-level secret managers and are not committed to source control. Application dependencies are managed via package managers and kept up to date. All API endpoints require authentication by default; no unauthenticated access to personal data is permitted.

Internal IT and IT security governance and management

BlueFairy is operated by a single individual who holds sole responsibility for all IT and security decisions, including access control, incident response, dependency management, and system configuration. In the event of a security incident, the Provider will investigate, contain, and remediate the issue directly, and will notify affected Customers without undue delay in accordance with applicable data protection law.

Data minimisation

BlueFairy collects only the data necessary to provide the service. GitHub access is limited to read-only repository metadata (commits, pull requests, repository names) via a GitHub App installation — no source code content or file contents are stored. Figma access is limited to design file names and structure. Authentication relies on GitHub OAuth, meaning no passwords or additional personal identifiers are collected beyond email address and GitHub username. Data is retained only for as long as the Customer's account is active and is deleted upon account or workspace removal.

Data quality

Repository and design data is fetched directly from GitHub and Figma via their respective APIs, ensuring that data processed by BlueFairy reflects the current state of the source systems. User account information is sourced from GitHub OAuth and updated on each authentication. Customers may request correction or deletion of their personal data at any time by contacting the Provider.

Limited data retention

Personal data is retained only for the duration of the Customer's active account. Upon account deletion, all associated personal data — including messages, repository activity, and user account information — is deleted from BlueFairy's systems within 30 days. Server logs are retained for a limited period as determined by the hosting provider (Railway) before automatic expiry. No personal data is archived or retained beyond the purposes described in this agreement.

Accountability

The Provider maintains accountability through direct oversight of all systems as sole operator. This includes periodic review of access logs, dependency audits, and review of subprocessor security practices. The Provider maintains records of processing activities as required by GDPR Article 30. Customers may request information about data processing practices by contacting the Provider directly.

Data portability and erasure

Upon request, the Provider will supply Customer with a copy of their personal data in a commonly used, machine-readable format within 30 days. Upon account deletion or written request, all personal data is deleted from BlueFairy's systems within 30 days. Deletion requests can be submitted by emailing jakegordon53@gmail.com. As BlueFairy does not operate physical hardware, no hardware disposal procedures are required — all data deletion is handled at the software and database level through Supabase and the relevant hosting platforms.