Data Processing Addendum
Effective 8 October 2026 · Version 2026-10-08. This is a public template. It is not a signed contract until both sides agree in writing (email to yonahmartinez30@gmail.com is enough to start). It is not legal advice. Ask a lawyer licensed where you operate before relying on it.
The operator of Invince (contact: yonahmartinez30@gmail.com; site: invince.dev) has not listed a registered-company legal name here because none is on file for this product yet. These terms still describe how the Service processes personal data today. If a company is formed later, this DPA transfers to that company and this page will be updated.
1. Roles
For personal data in your application that you send through the SDK, GitHub connection, or public Check of a URL you own, you are the controller and the operator of Invince is the processor. For your own account, billing-status, and agreement records, the operator is an independent controller (see the Privacy Policy).
2. What we process on your instructions
- Public-check URLs, HTTP metadata, capped public HTML/JS, Watch history.
- GitHub metadata, file paths, and evidence snippets from repos you connect.
- Security findings, documentation, launch-gate results.
- Error, performance, traffic, login, bot, and agent-trace payloads from the SDK you install.
We do not want secret values. Ingest redacts high-confidence credential formats before storage. We do not store customer database rows from open-database probes; the probe records whether a list succeeded and discards the body.
3. Instructions
We process that data only to provide the Service you turned on, to keep it secure, and to comply with law. We do not sell it. We do not use repository or SDK content to train our own models. Shared platform AI sends only the snippet needed for the feature you invoked. Paid checkout is handled by Whop (Stripe under Whop); we receive membership status, not card numbers.
4. Your obligations
You must have a lawful basis to send us end-user data. You must not send special-category data, payment card PAN, government IDs, or data about children through the SDK. You must only submit systems you own or are allowed to test.
5. Subprocessors
Listed on the subprocessors page. We will post changes there. Current hosting is primarily in the United States.
6. Security measures we actually run
- HTTPS in transit.
- Row-Level Security on customer tables in Postgres.
- Encryption of stored AI-provider keys.
- Workspace membership checks on product actions.
- SSRF checks before fetching a customer URL.
We do not claim SOC 2, ISO 27001, cyber insurance, or a named DPO on this page because those are not in place.
7. Retention and deletion
See retention. You can export and delete from Profile. Deleting an account removes workspaces you solely own. Processor data is dropped with the workspace, subject to backup windows described on that page.
8. Assistance, audits, and SCCs
Email yonahmartinez30@gmail.com for access, deletion, or export help, or if you need Standard Contractual Clauses. We will answer with what the product can actually do. We cannot invent a completed audit letter.