Data processing agreement (DPA)

Conclusion

The agreement is concluded in text form (Art. 28(9) GDPR). To conclude it, the customer sends an email to info@meteor-ai.com with

company name and address,
the email addresses of the accounts used on its behalf,
a contact person for data protection matters, and
the declaration that it concludes this agreement in the version of 13 October 2026.

The provider confirms the conclusion in text form. A signed PDF version is available on request.

Parties

Controller (“customer”): the company that concludes this agreement as set out under Conclusion.

Processor (“provider”): zuber-management, sole proprietorship, owner Patrick Zuber, Eschelbacher Str. 46, 69242 Mühlhausen, Germany, email info@meteor-ai.com.

Preamble

The customer uses Meteor-AI, a web application at app.meteor-ai.com through which users send requests to third-party language and image models and manage the answers in chats, assistants, flows, HTML apps and a library. It is based on the provider's terms and conditions (“main contract”).

Where the customer's users enter personal data, the provider processes it on behalf of the customer. This agreement sets out the parties' rights and obligations for this under Art. 28(3) GDPR.

§ 1 Subject matter, duration and scope

(1) The subject matter, nature and purpose of the processing, the types of data and the categories of data subjects are set out in Annex 1.

(2) This agreement applies for as long as the provider processes personal data for the customer under the main contract. It ends with the main contract without separate notice; § 10 continues to apply.

(3) This agreement does not cover processing for which the provider is itself the controller: conclusion, performance and billing of the main contract, payment processing, cancellations and withdrawals, limiting sign-up to the EEA and Switzerland, operational security, and retention under commercial and tax law. The provider's privacy policy applies to these.

(4) Processing takes place exclusively in a member state of the European Union or in another state party to the Agreement on the European Economic Area. Exceptions are governed by § 7.

§ 2 Responsibility and instructions

(1) The customer is responsible for the lawfulness of the processing, in particular for ensuring that users only enter personal data for which there is a legal basis. Special categories of personal data (Art. 9 GDPR) and data relating to criminal convictions (Art. 10 GDPR) are not intended for processing; if the customer enters them nonetheless, it first checks itself whether the measures described in this agreement are sufficient.

(2) The provider processes the data only on documented instructions from the customer, unless required to do so by Union or member state law; in that case it informs the customer of that legal requirement before processing, unless the law prohibits this.

(3) The customer's instructions are set out conclusively in the main contract, in this agreement and in the use of Meteor-AI's functions by the customer and its users – for example by choosing a model, uploading a file or deleting data. The customer gives further instructions in text form to info@meteor-ai.com.

(4) If the provider considers that an instruction infringes data protection law, it informs the customer without delay. It may suspend execution until the customer confirms or changes the instruction.

(5) The provider treats instructions that go beyond the agreed scope of services as a request to change the services.

§ 3 Confidentiality

(1) The provider ensures that all persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR). The obligation continues after their work ends.

(2) At present the owner runs Meteor-AI alone. If he involves further persons, paragraph 1 applies to them before they are given access to the data.

§ 4 Security of processing

(1) The provider takes the technical and organisational measures under Art. 32 GDPR described in Annex 2.

(2) The measures are subject to technical progress. The provider may replace them with equivalent or better ones; the level of protection must not fall. It documents significant changes.

§ 5 Sub-processors

(1) The customer gives general authorisation to engage further processors (“sub-processors”). Those engaged when this agreement is concluded are listed in Annex 3; they are deemed approved.

(2) The provider informs the customer in text form at least four weeks in advance of any intended addition or replacement. Within this period the customer may object for an important reason relating to data protection. If the parties cannot agree, the customer may terminate the main contract as of the date of the change.

(3) If notice under paragraph 2 cannot be awaited because a sub-processor discontinues its service or a security problem requires an immediate change, the provider informs the customer without delay; the right to object and terminate under paragraph 2 remains.

(4) The provider contractually binds every sub-processor to data protection obligations that essentially correspond to those of this agreement (Art. 28(4) GDPR). It is liable to the customer for their compliance.

(5) Ancillary services without access to the customer's data, such as telecommunications, postal services or retrieving public exchange rates, are not sub-processing within the meaning of this clause.

§ 6 Assistance to the customer

(1) Data subject rights. The provider assists the customer with appropriate technical and organisational measures in responding to requests from data subjects under Chapter III GDPR. Users can do much of this themselves in the application: view, change and delete data, delete individual content or all data, and delete the account. If a data subject contacts the provider directly, the provider forwards the request to the customer without delay, where it can identify the customer.

(2) Obligations under Art. 32 to 36 GDPR. Taking into account the nature of processing and the information available to it, the provider assists the customer with the security of processing, with notifications and communications after personal data breaches, with a data protection impact assessment and with prior consultation of the supervisory authority.

(3) Personal data breaches. If the provider becomes aware of a breach affecting the customer's personal data, it notifies the customer without undue delay, where possible within 48 hours, in text form. The notification contains, as far as known, the information under Art. 33(3) GDPR; what is not yet known follows later. The provider takes the necessary measures without delay to secure the data and mitigate possible adverse effects.

(4) For assistance that goes beyond the functions of the application and is not due to a breach by the provider, the provider may charge reasonable remuneration.

§ 7 Transfers to third countries

(1) The customer's data is stored and processed in the European Union. A transfer to a third country or an international organisation takes place only on documented instructions from the customer or under the conditions of Art. 44 et seq. GDPR.

(2) Where sub-processors with their seat or parent company outside the EU can access data, this is stated in Annex 3 and safeguarded by an adequacy decision (Art. 45 GDPR) or the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

§ 8 Evidence and audits

(1) On request, the provider makes available to the customer all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR, in particular a current version of Annexes 2 and 3 and the sub-processors' evidence (such as their certifications and data processing agreements).

(2) The customer or an auditor appointed by it who is bound to confidentiality and is not a competitor of the provider may carry out audits, including inspections (Art. 28(3)(h) GDPR). They must be announced with reasonable notice, as a rule four weeks, take place during normal business hours and must not disrupt operations more than necessary. Sub-processors' data centres are evidenced by their audit reports and certificates, not by on-site inspection.

(3) Each party bears its own costs of an audit, unless the audit reveals a significant breach by the provider.

§ 9 Rights and obligations of the customer

(1) The customer informs the provider without delay if, when reviewing the results, it finds errors or irregularities relating to data protection law.

(2) On conclusion, the customer names a contact person for data protection matters and notifies changes in text form.

§ 10 Deletion and return

(1) The customer and its users can export their data themselves at any time, where the application provides for this, and delete it themselves: individual content, all data (chats, image conversations, library, settings and files) or the entire account.

(2) After the end of the main contract, the provider deletes the customer's personal data, to the extent users have not already deleted it, no later than 30 days after the end of the contract, unless Union or member state law requires its storage. At the customer's request it confirms deletion in text form.

(3) Backups of the database service provider are not cleaned individually but overwritten on rotation (Annex 2, item 3); until then they are protected against access and not used for other purposes.

(4) Not deleted under paragraph 2 are billing rows and ledger entries that the provider retains as a controller in its own right (§ 1(3)). They contain no content, no name and no email address, only an identifier.

§ 11 Liability

Liability is governed by Art. 82 GDPR. Otherwise the liability provisions of the main contract apply, to the extent they are compatible with the GDPR.

§ 12 Final provisions

(1) In the event of conflict between this agreement and the main contract, this agreement prevails on data protection matters.

(2) The agreement is concluded when the customer accepts it in text form as set out under Conclusion and the provider confirms the acceptance.

(3) Amendments and additions require text form (Art. 28(9) GDPR). This also applies to waiving this form requirement. Changes to Annexes 2 and 3 are governed by § 4(2) and § 5.

(4) If a provision is invalid, the remainder of the agreement remains valid. The invalid provision is replaced by a valid one that comes closest to its purpose.

(5) The law of the Federal Republic of Germany applies. Place of jurisdiction is, to the extent legally permissible, the provider's registered office.

Annex 1 – Subject matter and scope of processing

1. Subject matter and purpose

Provision of Meteor-AI as software as a service: receiving, storing and displaying users' input and content, forwarding requests to the language or image model chosen by the user and returning the answer, web search where the user switches it on, sending the application's emails to users, and support.

2. Nature of processing

Collection, recording, storage, organisation, retrieval, consultation, use, transmission to sub-processors (Annex 3), alignment, restriction, erasure.

3. Types of personal data

Users' account data: name, email address, account identifier, settings.
Content: input (prompts) and answers in chats, attachments and uploaded documents, generated images, library content (prompts, skills, knowledge items including documents, assistants, flows, HTML apps). This may contain personal data of any kind that users enter – for example names, contact details or information about the customer's customers, business partners or employees.
Search terms: with web search switched on, the beginning of the last input (at most 400 characters) as the search query.
Usage data: time, model, tools used, tokens and cost of each request, without content.
Technical data: IP address, time, requested file and browser identifier when the application is loaded; server logs; error messages of the application.
Support requests: topic, subject, description, processing status, on request details of the environment (app version, page, window size, language, browser identifier), never chat content. Requests by email to support@meteor-ai.com with sender, content and attachments.

4. Categories of data subjects

Users: the customer's employees and agents who use Meteor-AI.
Third parties: persons whose data users enter into content, for example the customer's customers, prospects, business partners and employees.

5. Place of processing

European Union. Database and file storage in Frankfurt am Main (eu-central-1); model requests via Eden AI's EU endpoint to models that compute in the EU; exceptions only under § 7 and Annex 3.

6. Duration

Term of the main contract, then § 10.

Annex 2 – Technical and organisational measures

Under Art. 32 GDPR. Meteor-AI runs no servers of its own. The infrastructure is provided by the sub-processors in Annex 3; their data centres are subject to their own measures and certifications, which the provider evidences on request.

1. Confidentiality (Art. 32(1)(b) GDPR)

Physical access control

No server rooms of its own. The data is held in the sub-processors' data centres with their physical safeguards.
The provider's work devices are kept in rooms not accessible to the public.

System access control

Users sign in through Supabase Auth with email address and password; the email address is confirmed before first use. The application stores neither passwords nor hashes.
Changing a password requires the current password.
Accounts can be blocked; sign-up can be closed.
New accounts are created only from the EEA and Switzerland; the check takes place in the database, not in the form.
The provider's access to the service providers' admin consoles (Supabase, Vercel, Eden AI, Plunk, Microsoft 365, Stripe, GitHub) is personal and protected by strong, unique passwords, additionally by two-factor authentication where the service provider offers it.
The provider's work devices are locked with a password and their storage is encrypted.

Data access control

Row Level Security on every table of the database: an account sees and changes only rows that belong to it. The rule applies in the database, not just in the interface.
An account can read but not change ledger entries, plan and credit; only the server writes them.
The provider's admin area shows accounts, usage and the state of the installation, but no content. It runs on database functions that check authorisation themselves in their first line.
Only the owner has technical access to the database itself. He uses it for the customer's content only where necessary for operation, troubleshooting or support, or where the customer instructs it.
The API key for the models is held server-side as a secret and is never visible to users.
HTML apps run in an isolated frame without access to sign-in token, storage or database.

Separation control

Logical separation of data per account through Row Level Security.
Separate databases for development and production; tests run against the development environment.
Usage data for billing is stored separately from content and contains no content.

Pseudonymisation and data minimisation

After an account is deleted, billing rows remain only with an identifier, without name or email address.
No tracking, no analytics or advertising services, no third-party fonts or icons.
If the sign-up check succeeds, the IP address is not stored.

2. Integrity (Art. 32(1)(b) GDPR)

Transfer control

All connections – browser to application, application to service providers – are encrypted with TLS.
Model requests go exclusively through Eden AI's EU endpoint. Models without processing in the EU are blocked.
Zero data retention in model processing: input and answers are neither stored there nor used for training; set out by contract with Eden AI.
Database and file storage are encrypted at rest.

Input control

Server logs at Supabase (7 days) and Vercel (at most 1 day).
Every model request is recorded with time, account, model, tokens and cost, without content.
Changes to the database schema are made exclusively through versioned migrations with history; changes to the code through Git with pull requests.

3. Availability and resilience (Art. 32(1)(b) and (c) GDPR)

Database as a managed service at Supabase with daily backups; backups are kept for 7 days and then overwritten.
Delivery of the application through Vercel's network.
Usage limits per account and rate limits on public forms protect against abuse and overload.
If a search fails, the model answers without search rather than aborting the request.

4. Process for regular review (Art. 32(1)(d) GDPR)

Supabase's security and performance advisories are reviewed after schema changes.
New functions are first tried on the development environment and only then taken into production.
If service providers, storage locations, retention periods or deletion behaviour change, the privacy policy, Annex 3 and this annex are updated at the same time.
Processor control: sub-processors only with an agreement under Art. 28 GDPR (Annex 3); the customer's instructions are documented in text form.

Annex 3 – Sub-processors

Supabase

Company: Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513
Service: database, sign-in, file storage, server functions
Data: all types of data in Annex 1
Location: Frankfurt am Main (AWS eu-central-1)
Basis: Supabase's Data Processing Addendum (Art. 28 GDPR); for access from Singapore, standard contractual clauses (Art. 46(2)(c) GDPR)

Eden AI

Company: Eden AI SAS, 19 rue Louis Guérin, 69100 Villeurbanne, France
Service: intermediary to language and image models and to web search
Data: content of the respective request, search terms
Location: EU, exclusively through the EU endpoint
Basis: data processing agreement with Eden AI, including zero data retention

Model providers (through Eden AI)

Service: processing the request in the model chosen by the user
Data: content of the respective request
Location: infrastructure in the EU only; models without EU processing are blocked
Basis: Eden AI's agreements with the model providers; zero data retention
Note: The model picker in the application shows which models are available. The provider shares the current list of model providers on request.

Linkup (through Eden AI)

Service: web search, when the user switches it on for a model that does not search itself
Data: search term (beginning of the last input, at most 400 characters)
Location: EU, through Eden AI's EU endpoint
Basis: through Eden AI

Plunk

Company: Plunk, Coenraetsstraat 72, 1060 Brussels, Belgium
Service: sending the application's emails
Data: name, email address, content of the respective email
Location: storage in Germany (Hetzner), delivery through Amazon Web Services in Stockholm (eu-north-1)
Basis: Plunk's data processing agreement (Art. 28 GDPR)

Vercel

Company: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA
Service: delivering the application's files
Data: connection data (IP address, time, requested file, browser identifier); no accounts, no content
Location: project region Frankfurt am Main (fra1); delivery from the nearest location of Vercel's network
Basis: Vercel's Data Processing Addendum (Art. 28 GDPR); EU-US Data Privacy Framework (Art. 45 GDPR), supplemented by standard contractual clauses (Art. 46(2)(c) GDPR)

Microsoft

Company: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland
Service: mailboxes (Exchange Online in Microsoft 365) through which support requests by email arrive and are answered
Data: sender, content and attachments of emails to support@meteor-ai.com and info@meteor-ai.com
Location: data centres in Germany; storage in the EU guaranteed by contract (Microsoft's EU Data Boundary)
Basis: Microsoft's Data Protection Addendum (Art. 28 GDPR); for access by Microsoft Corporation (USA), EU-US Data Privacy Framework (Art. 45 GDPR), supplemented by standard contractual clauses (Art. 46(2)(c) GDPR)

Stripe (Stripe Payments Europe, Limited, Dublin) is not a sub-processor for the customer's data. Stripe processes the payments of the main contract and, for this, processes account data in its relationship with the provider as its service provider or as a controller in its own right (§ 1(3)); Stripe receives no content.

Versions

Version of 13 October 2026: Microsoft as sub-processor for the mailboxes (Annex 3), support requests by email (Annex 1), access to Microsoft 365 (Annex 2).
Version of 12 October 2026: first version.