_Last updated: September 13, 2026_
This Data Processing Agreement ("DPA") is an Art. 28 GDPR contract between the detailing studio that uses DetailingManager ("Company", "Controller") and Radoslav Moshev, Sofia, ul. Pirin, Bulgaria, admin@detailingmanager.com ("Processor").
It applies when the Company stores personal data of its own clients, employees, or other natural persons in the platform. It does not replace the Privacy Policy or the Terms. This text is a working draft, not a lawyer-certified instrument.
1. Subject matter and purpose
The Processor provides the DetailingManager SaaS (client and vehicle records, jobs, documents, reminders, email campaigns, statistics, VIN lookup) so the Company can run its studio. Processing is only for that purpose, on documented instructions from the Company (use of the product and written requests to admin@detailingmanager.com).
2. Duration
The DPA lasts for as long as the Company has an active account. After confirmed closure, live data and storage files are deleted immediately. Backup copies on the same Hetzner server in Nuremberg are kept for up to 7 days, then overwritten. If a backup is restored in that window, the deletion is applied again.
3. Categories of data and data subjects
Data subjects: the Company's clients and their contacts; studio staff who have accounts; recipients of emails the Company sends.
Typical data: names, phone, email, address, date of birth, marketing consent, vehicles (including VIN and plate), job notes and photos, PDF documents, campaign recipient snapshots.
The Company decides what it enters. The Processor does not collect studio-client data from other sources.
If the Company switches on the AI assistant, the questions its staff type and the records the assistant reads to answer them are also processed as described in Sections 5 and 6.
4. Processor obligations
The Processor shall:
- process personal data only on the Company's instructions, unless EU or Bulgarian law requires otherwise
- ensure persons authorised to process the data are bound by confidentiality
- implement the security measures in Section 7
- engage further processors only as described in Section 5
- help the Company respond to data-subject requests (access, rectification, erasure, portability), including the CSV client export in the product
- help the Company with security, breach, and DPIA obligations, taking into account the nature of processing
- delete or return personal data at the end of the service, as in Section 2
- make available information reasonably needed to demonstrate compliance and allow audits as in Section 9
5. Sub-processors
The Company authorises the following sub-processors. Material changes will be reflected in this DPA and the Privacy Policy.
| Provider | Role | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | Ireland (AWS eu-west-1) |
| Hetzner / Coolify | Application hosting and backup copies (up to 7 days) | Nuremberg, Germany |
| Resend | Transactional and campaign email | Ireland (eu-west-1) |
| Upstash Redis | Rate limiting (IP / request counters) | Belgium (GCP europe-west1) |
| OpenAI Ireland Limited | AI assistant (only when the Company enables it) | Ireland; model processing may occur outside the EU |
| db.vin | Primary VIN decode | VIN only |
| NHTSA vPIC | Fallback VIN decode | United States (VIN only) |
The AI assistant is off by default. A Company admin must switch it on and confirm a notice naming the provider; until then nothing reaches OpenAI. Chat history is stored in the platform and deleted automatically after up to 14 days.
Google Analytics 4 and Meta Pixel run only if the visitor grants marketing consent. They are not used to process the Company's client database.
6. International transfers
Core hosting, database, files, application, Redis, and email sending are in the EU (Ireland, Germany, Belgium).
The VIN may be sent to NHTSA vPIC in the United States when the EU decoder does not return a result. No name, phone, or email is sent with that request.
If the AI assistant is enabled, the questions and the records needed to answer them go to OpenAI Ireland Limited, which processes EEA data under OpenAI's Data Processing Addendum and transfers it outside the EEA only under Standard Contractual Clauses. API inputs and outputs are not used to train OpenAI's models. Abuse-monitoring logs may contain them and are kept for up to 30 days, unless longer retention is required by law.
Marketing pixels (if consented) may transfer data outside the EU under those providers' terms.
7. Security
- Encryption in transit (TLS 1.3) and at rest (AES-256)
- Row-Level Security so each tenant sees only its own rows
- Optional two-factor authentication
- Session timeout configurable by the Company
- Least-privilege roles (admin / manager / employee)
8. Personal-data breach
If the Processor becomes aware of a personal-data breach affecting the Company's data, it will notify the Company without undue delay, with a target of 72 hours, at the Company admin email on file, including known facts, likely consequences, and measures taken. The Company remains responsible for notifying its supervisory authority and affected individuals where GDPR requires it.
9. Audits
The Company may request, no more than once per year except after a breach, written information or a summary of relevant security measures. On-site or intrusive audits require reasonable notice and must not compromise other tenants. The Processor may satisfy the request with current certifications or reports from sub-processors (for example Supabase SOC 2).
10. Erasure and export
The Company can delete individual clients in the product. That wipes name, phone, email, and similar contact data; the vehicle and completed jobs remain without that contact data (VIN and plate stay as service history). Unfinished jobs are removed.
A machine-readable CSV export of the client list (and of firms) is available to Company admins.
To delete the whole Company account, write to admin@detailingmanager.com. Live data is removed after we confirm the request; backup copies on the same Hetzner server in Nuremberg are kept for up to 7 days, then overwritten.
11. Governing law
This DPA is governed by the laws of the Republic of Bulgaria. Disputes shall be resolved by the competent Bulgarian court.
12. Contact
- Email: admin@detailingmanager.com
- Subject: DPA / Data processing