Data Processing Agreement (DPA)

Last updated: 2026-09-18

This Data Processing Agreement ("DPA") forms part of the agreement between Hennadii Shvedko ("Processor") and the customer ("Controller") and governs the processing of personal data by the Processor on behalf of the Controller under Article 28 of the GDPR.

1. Subject matter and duration

The Processor processes personal data only to provide the Service for the duration of the customer's subscription and as instructed by the Controller through normal use of the Service.

2. Nature and purpose

Processing consists of fetching, scoring, storing (for up to 24 hours for marketplace data), generating content from, and notifying the Controller about freelance job postings and related data.

3. Categories of data and data subjects

Personal data may include the Controller's account and configuration data, and marketplace-sourced data (including client information sourced from Upwork). Data subjects include the Controller and individuals named in marketplace data.

4. Obligations of the Processor

• Process personal data only on documented instructions from the Controller.
• Ensure persons authorised to process data are bound by confidentiality.
• Implement appropriate technical and organisational security measures (encryption at rest of secrets, access controls, monitoring).
• Assist the Controller in responding to data-subject requests and in meeting security, breach-notification, and impact-assessment obligations.
• Delete or return personal data at the end of the engagement (account deletion erases the full data graph).
• Make available information necessary to demonstrate compliance and allow for audits.

5. Sub-processors

The Controller authorises the Processor to engage the sub-processors listed on the Sub-processors page. The Processor imposes data-protection obligations on each sub-processor and remains liable for their performance. The current sub-processors are:

• Hetzner Online GmbH — Application hosting, database and backups (Germany (EU))
• OpenAI, L.L.C. — AI job analysis, scoring and cover-letter generation (United States)
• Google LLC (Gmail SMTP) — Transactional and notification email delivery (United States)
• Upwork Global Inc. — Marketplace job data source; proposal, contract and earnings sync (United States)
• Stripe, Inc. — Payment processing and subscription billing (only when you subscribe to a paid plan) (United States / Ireland)

6. International transfers

Where personal data is transferred outside the EEA, the Processor relies on EU Standard Contractual Clauses or another valid transfer mechanism.

7. Breach notification

The Processor will notify the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller's data.

8. Contact

Data-protection enquiries under this DPA may be sent to hennadii.shvedko@shvedko.dev.

Hennadii Shvedko
Hennadii Shvedko Max-Born-Ring 59 37077 Göttingen Germany