Data Processing Agreement

Version of 5 November 2026 · under Article 28 of the General Data Protection Regulation (GDPR)

This agreement is between the builder who uses Scava for apps ("you", the controller) and Scava, Vienna, Austria ("Scava", "we", the processor). It is part of the Terms of Service and applies to personal data that we process on your behalf in your apps.

1. Subject, duration, nature and purpose

We host and run your apps: we store, show and send their data and files, sign in the people you share them with, run their server code, deliver change requests to you, and send the mails of your apps (invitations, notifications, mails your server code sends). We do this as long as your account exists, and only to provide Scava to you.

2. Personal data and people concerned

Data: whatever you and the people using your apps store in them (entries, files), email addresses and names of people who open your apps, when they signed in and opened an app, change requests they write, and what server code of your apps logs.
People: your colleagues, partners and customers who open your apps, and people the data in your apps is about.

3. Your instructions

We process the data only on your documented instructions: these terms, and what you set in Scava (who can open an app, data rules, house rules, the place where new apps keep their data). If an instruction breaks data protection law in our view, we tell you. If the law makes us process data otherwise, we tell you before, unless the law forbids it.

4. Our obligations

Confidentiality: everyone who works on Scava for us is bound to confidentiality.
Security: we keep the measures in Annex 1 and adapt them to the state of the art.
Help with requests: we help you answer people who use their rights. In Scava you can download everything an app holds and delete entries, files, apps and people.
Help with your duties: we help you with security, data breaches, data protection impact assessments and consulting the authority (Articles 32 to 36 GDPR), as far as it concerns Scava.
Breaches: we tell you without undue delay when we become aware of a breach of the security of your data.
Deleting: when you delete an app or your account, we delete its data, its files and its server code. Backups expire within 30 days.
Proof: we give you the information you need to show that this agreement is kept, and allow audits by you or an auditor you appoint, announced in good time and at your cost.

5. Subprocessors

You agree to the subprocessors in Annex 2. We tell you at least 30 days before we add or replace one; you can object, and if we cannot agree, cancel. We bind each subprocessor to the same data protection obligations.

6. Where data is kept

The data and files of your apps are kept in the European Union, unless you choose the US for new apps in your house rules; then they are kept in North America for those apps. Accounts, sharing and logs stay in the European Union. Our host Cloudflare is a US company; transfers are covered by the EU-US Data Privacy Framework and standard contractual clauses.

Annex 1: Technical and organisational measures

Encrypted connections (TLS) everywhere; data encrypted at rest by Cloudflare.
Every app on its own address with its own sign-in; code of apps runs only in the browser or isolated in its own worker, never in Scava's own.
Who reads and changes what is checked on the server for every request; sign-in without passwords; sessions end after 7 days without use.
Keys of apps encrypted; they only reach the service they are bound to.
Access to the operation only for named admins, with a recent sign-in; admins do not see what apps store.
Limits against misuse, reports, blocking of apps and accounts, an activity log kept for a year.
Backups of the central database for 30 days; tested code changes; a security description kept up to date.

Annex 2: Subprocessors

Cloudflare, Inc., USA: hosting, database, file storage, network, and the AI gateway for apps that use AI. Data kept in the EU (or North America for apps you place there).
Lettermint B.V., Netherlands: delivery of emails.