Data Processing Addendum
Version 1.1.0 · Last updated August 4, 2026
This Data Processing Addendum (“DPA”) forms part of the Terms of Service and applies where Moche-AI processes personal data on a customer’s behalf (GDPR Art. 28). By accepting during signup or checkout, the customer (“Controller”) and Moche-AI (“Processor”) agree to these terms.
1. Roles & scope
The Controller determines the purposes and means of processing property and guest data. The Processor processes such data only on documented instructions from the Controller, including for international transfers, unless required by law.
2. Processor obligations
- Process only on the Controller’s documented instructions.
- Ensure personnel are bound by confidentiality.
- Implement the technical & organizational measures in Schedule 2.
- Assist the Controller with data-subject requests and security/DPIA obligations.
- Delete or return personal data at the end of the engagement, subject to legal retention.
- Make available information necessary to demonstrate compliance.
3. Breach notification
The Processor will notify the Controller without undue delay and in any event within 72 hours of becoming aware of a personal-data breach affecting the Controller’s data, with the information reasonably available. See our Security Overview and internal security-incident runbook.
4. Subprocessors
The Controller authorizes the use of the subprocessors listed in Schedule 3. We impose data-protection obligations on each subprocessor no less protective than this DPA and remain liable for their performance. We will give notice of intended changes and allow a reasonable objection right.
5. International transfers
For transfers outside the EEA/UK, the parties incorporate the EU Standard Contractual Clauses and the UK IDTA/Addendum, with the Processor as “data importer” where applicable.
6. CCPA service-provider terms
To the extent the CCPA/CPRA applies, Moche-AI acts as a service provider: we do not sell or share personal information and do not retain, use, or disclose it except to provide the Service or as permitted by the CCPA.
Schedule 1 — Processing details
| Subject matter | Provision of the AI guest-concierge and Property Brain. |
| Duration | For the term of the subscription. |
| Nature & purpose | Storage, retrieval, embedding, and AI-based answering of property/guest content. |
| Data subjects | The Controller’s guests and staff. |
| Data categories | Property content, guest questions/answers, hashed guest contact identifiers. |
Schedule 2 — Technical & organizational measures
The measures in our Security Overview (access control, encryption in transit and at rest, logging & monitoring, vulnerability management, incident response, vendor management, and data protection including PII redaction before external AI routing) are incorporated here by reference.
Schedule 3 — Authorized subprocessors
| Vendor | Purpose | Data processed | Region | Transfer | Retention | Status |
|---|---|---|---|---|---|---|
| Supabase | Primary application database (Postgres + pgvector), authentication, file storage | Host account & profile data, property/brain content, guest identities (hashed contacts), embeddings | EU (Frankfurt) / US — project-dependent | SCCs | For the life of the account; deleted on erasure request (billing/legal records retained) | Active |
| Vercel | Application hosting, edge network, serverless compute | Request metadata, IP addresses, logs | US / global edge | SCCs | Transient; logs per Vercel retention policy | Active |
| Stripe | Payment processing and subscription billing | Host billing contact, payment card data (held by Stripe, never by us), invoices | US / EU | SCCs | Per Stripe policy and tax/accounting law (typically 7+ years for financial records) | Active |
| OpenAI | AI subprocessor — text embeddings (text-embedding-3-small), guest-intent classification, and the fallback path for all chat completions if model routing is unavailable | Guest questions and property knowledge context (PII redacted before external routing where applicable) | US | SCCs | API inputs/outputs retained up to 30 days for abuse monitoring, then deleted (no training on API data) | Active |
| OpenRouter | AI model router — directs completion requests to a task-appropriate model (currently Google Gemini 2.5 Flash for guest answers, OpenAI GPT-4o-mini and Meta Llama 3.1 for background extraction/classification) with automatic failover between models | Prompt content only, with personal data programmatically redacted before the request leaves our infrastructure: guest questions and the relevant property knowledge context. A post-redaction check blocks the external request entirely if personal data is still detected. No guest identity, contact details, or account data are sent. | US (routes to model providers in the US/EU) | SCCs | Zero-Data-Retention enforced on every request: prompts and responses are not logged or retained by OpenRouter, and any downstream model provider that would collect or train on the data is refused (the request fails closed and falls back to our primary provider instead) | Active |
| Resend | Transactional email delivery (host notifications, escalations) | Host email address, notification content | US | SCCs | Delivery logs per Resend policy | Active |
| Twilio | SMS delivery for guest verification one-time codes | Guest phone number, one-time verification code | US / global | SCCs | Message logs per Twilio policy | Active |
| Firecrawl | Host-initiated URL ingestion (fetch & extract public listing/content pages) | URLs submitted by the host and the fetched page content | US | SCCs | Transient; extracted content stored in the host’s Property Brain | Active |
| Sentry | Application error monitoring and performance tracing | Error events, stack traces, request metadata (PII scrubbed where feasible) | US / EU | SCCs | Per Sentry retention settings (typically 90 days) | Active |
| Cloudflare | Bot mitigation (Turnstile) on guest verification and edge protection | IP address, challenge token, request metadata | Global edge | SCCs | Transient challenge data | Active |
| Mapbox | Address autocomplete/geocoding, nearby place discovery, and static map images on the host dashboard | Property address strings and coordinates entered by the host, plus the host browser’s request metadata (IP, referrer) when a static map image loads. No guest identity or guest message content is sent. | US | SCCs | Query logs per Mapbox policy; results cached in the host’s own property records | Active |
| PostHog | Product analytics (host-side usage; no guest PII sent) | Pseudonymous host user id, product events, page views | US / EU (cloud region dependent) | SCCs | Per PostHog project retention settings | Active |
| Trigger.dev | Background job orchestration (async task execution and retries outside the request/response cycle) | Task payloads we choose to send. Jobs are designed to carry row/record ids only, never guest PII directly — the job re-reads any needed data from Supabase using the service role at execution time. | US | SCCs | Run logs and payloads retained per Trigger.dev account settings | Active |
| Amazon Web Services (S3) | Private object storage for host-uploaded files and images, accessed only via short-lived presigned URLs so bytes never transit our app servers | Property-related images and documents the host uploads. Objects are stored under a per-property key prefix; no object is publicly accessible (all public access blocked, TLS-only bucket policy, server-side encryption at rest). | US (us-east-2) | SCCs | Objects retained until deleted by the host or removed per bucket lifecycle policy (noncurrent versions expire after 90 days) | Active |