Data Processing Agreement

This Data Processing Agreement (DPA) describes how Quotla processes personal data on behalf of its users when providing business management services.

We process the following categories of personal data:

• Account data: Name, email address, password (hashed)
• Business data: Company name, address, logo, tax identification numbers
• Client data: Customer names, contact information, transaction history
• Financial data: Invoice amounts, payment records, expense records

We process personal data solely to provide and improve the Quotla service as described in our Terms of Service.

We use the following sub-processors to provide our service:

• Convex: Database hosting and authentication (USA)
• Vercel: Application hosting and CDN (USA)
• Resend: Email delivery for verification and transactional emails (USA)
• Google OAuth: Authentication via Google Sign-In (USA)
• ipapi.co: IP-based geolocation for currency detection (USA)
• fxratesapi.com: Live exchange rate data (USA)

We will notify users of any changes to our sub-processor list.

We implement the following technical and organizational measures:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Regular security audits and vulnerability assessments
• Access controls and authentication requirements
• Regular data backups and disaster recovery procedures

In the event of a personal data breach, we will notify affected users within 72 hours of becoming aware of the breach, in accordance with applicable data protection laws.

For questions about this Data Processing Agreement, contact our Data Protection Officer at [email protected].