Data processing agreement (DPA)

This agreement (the “Agreement”) supplements the terms of service and applies as soon as an organization (the “Customer”, controller) entrusts personal data to Releo Cloud. WYATT GROUP (the “Publisher”) acts as a processor under article 28 of Regulation (EU) 2016/679 (GDPR). In case of conflict, the Agreement prevails over the terms of service for personal data.

1. Purpose and duration

The Publisher processes the Customer’s data to provide the Service: uploading builds to the stores, promotion, release notes, public pages, member management. The Agreement lasts as long as the Customer uses the Service, then until its data is deleted.

2. Description of the processing

• Data subjects: members of the organization, invited people, testers who register a device on a public page, commit authors.
• Data: name, email, role; IP address and browser of sessions; UDID, name, model and iOS version of test devices; commit authors and messages; audit log.
• Operations: storage, consultation, transmission to Apple, Google, and the git and LLM providers configured by the Customer, deletion.
• The Service is not meant to process special categories of data under article 9 of the GDPR. The Customer does not put any in notes or metadata.

3. Obligations of the Publisher

The Publisher undertakes to:

1. process the data only on documented instructions from the Customer: the Terms, the configuration of the organization and the actions of its members are instructions. It informs the Customer if an instruction seems to breach the GDPR;
2. ensure the confidentiality of the data: the people authorized to access it are bound by confidentiality;
3. implement the security measures described in the appendix;
4. engage another processor only under the conditions of section 4;
5. help the Customer, as far as possible, answer requests from data subjects exercising their rights;
6. help the Customer ensure the security of the processing, notify data breaches and carry out an impact assessment when one is required;
7. notify the Customer of any personal data breach without undue delay, and at the latest 48 hours after becoming aware of it, with the information available;
8. at the end of the Service, delete the Customer’s data within 30 days, unless the law requires keeping it; backups are erased as they rotate (14 days);
9. make available to the Customer the information needed to demonstrate compliance with the Agreement, and allow an audit, at the Customer’s expense, with reasonable notice and respecting the confidentiality of other customers.

4. Subprocessors

The Customer authorizes the Publisher to use the following subprocessors:

Subprocessor	Purpose	Location
OVH SAS	Hosting of the application, its database and the uploaded builds	France
Stripe Payments Europe, Ltd.	Payment of subscriptions and invoicing	Ireland (transfers to the United States under the EU-US Data Privacy Framework)
Resend, Inc.	Transactional emails (confirmation, password reset, invitations)	United States

The Publisher informs the Customer by email at least 30 days before adding or replacing a subprocessor. The Customer may object on legitimate grounds by terminating the Service before the date of the change. The Publisher imposes on each subprocessor obligations equivalent to those of the Agreement.

Apple, Google, the git provider and the LLM provider are not subprocessors of the Publisher: the Customer chooses them, configures them with its own accounts and contracts with them directly.

5. Transfers

The data is hosted in the country shown for the hosting provider above. Any transfer outside the European Union relies on an adequacy decision or on the standard contractual clauses of the European Commission.

6. Obligations of the Customer

The Customer:

• has a legal basis for the processing it entrusts to the Service and informs the data subjects, in particular the testers who register a device;
• chooses the third-party services it connects (Apple, Google, git, LLM) and checks that they suit the data sent;
• manages the access of its members and the confidentiality of its credentials.

Appendix: security measures

• Encrypted connections (HTTPS) between browsers, CI and the Service, and between the Service and the store APIs.
• Hashed passwords; revocable sessions; single sign-on (OIDC, SAML) available depending on the plan.
• Secrets (.p8 keys, certificates, service accounts, git tokens, LLM keys, keystores) encrypted at rest with AES-256-GCM, never returned by the API.
• Store calls run with a temporary directory of their own, whose credential files are readable only by the Service’s process, deleted at the end of the call.
• Isolation per organization; roles per organization and per app; API keys with scopes and per-app restriction, never with more rights than their owner.
• Rate limiting of sign-in attempts and emails; audit log of actions and sign-ins.
• Regular database backups, kept 14 days.
• Public pages reachable only through a secret, revocable link, with an optional expiration date.