← Home

Data Processing Addendum

Last updated: 13 June 2026

Draft for review. This is a good-faith starting point prepared for the BuildPaza team. Have qualified legal counsel review and adapt it (and fill the [bracketed] placeholders) before launch.
This DPA applies when you use BuildPaza to process personal data of your own end-users (for example, an app you build that stores customer records). In that case you are the controller and BuildPaza is your processor. It forms part of the Terms of Service.

1. Roles

You (the "Customer") are the controller; [Legal entity name] ("BuildPaza") is the processor, processing personal data only on your documented instructions, which include your use of the service and these terms.

2. Subject matter & duration

BuildPaza processes personal data to provide the building, preview, hosting and export features, for as long as your account is active or as needed to provide the service.

3. Nature & purpose

Storing and processing the content you create, running AI generation on it, hosting published/exported apps, and related support.

4. Types of data & data subjects

Determined by you, depending on what you build — typically your end-users' identifiers and any content your app stores. Do not put special-category data into builds unless you have a lawful basis and have configured appropriate safeguards.

5. BuildPaza's obligations

  • Process personal data only on your instructions.
  • Ensure persons authorised to process it are bound by confidentiality.
  • Implement appropriate technical and organisational security measures (Art. 32) — see the Privacy Policy security section.
  • Assist you, taking into account the nature of processing, with data-subject requests and with your obligations under Art. 32–36.
  • Notify you without undue delay after becoming aware of a personal-data breach.
  • On termination, delete or return personal data at your choice, subject to legal retention.
  • Make available information necessary to demonstrate compliance and allow for reasonable audits.

6. Sub-processors

You authorise BuildPaza to engage the sub-processors listed at /subprocessors. We impose data-protection obligations on them equivalent to those in this DPA and remain responsible for their performance. We will inform you of intended changes and give you the opportunity to object.

7. International transfers

Where personal data is transferred outside the EEA, the transfer is governed by the EU Standard Contractual Clauses (which are incorporated by reference) together with appropriate supplementary measures.

8. Liability

Each party's liability under this DPA is subject to the limitations agreed in the Terms of Service.

9. How to execute

For a countersigned copy of this DPA (with the SCCs) for your records, contact privacy@buildpaza.com.

Questions about this document? privacy@buildpaza.com. See also Privacy · Terms · DPA · Sub-processors · Cookies · Imprint.

We use a single essential cookie to keep you signed in — no advertising or cross-site tracking. Details.