1. Roles
The Customer is the data controller. Fideria is the data processor acting on the Customer's documented instructions. Where Fideria determines the purposes and means of processing (e.g. billing, security telemetry), Fideria is the controller for that limited purpose and the Privacy Policy applies.
2. Subject-matter and duration
Fideria processes Customer Personal Data to provide the AI Investment Overview platform for the duration of the subscription and any wind-down period agreed in the Terms of Service.
3. Nature and purpose of processing
- Hosting, storing, and displaying Customer content in the platform.
- Processing usage, spend, and governance data to compute portfolio insights.
- Providing support, security monitoring, and audit-log functionality.
4. Categories of data subjects and data
- Data subjects: Customer's employees, contractors, and authorized users.
- Personal data: name, business email, job title, department, role, IP address, product usage.
- No special categories of personal data are required by the Service.
5. Customer instructions
Fideria will process Customer Personal Data only on the Customer's documented instructions, including those given through the Service configuration and the Terms of Service, unless required otherwise by EU or Member-State law.
6. Confidentiality
Personnel authorized to process Customer Personal Data are bound by confidentiality obligations of at least equivalent scope to those in the Terms of Service.
7. Security measures (Art. 32)
- Encryption in transit (TLS 1.2+) and at rest for stored customer data.
- Row-Level Security enforcing organization-scoped access on every query.
- Role-based access controls, least-privilege administration, and audit logging of privileged actions.
- SSO (SAML) for enterprise identity federation; MFA available via the identity provider.
- Segregated development, preview, and production environments.
- Regular backups and a documented incident-response process.
8. Sub-processors
Fideria uses the sub-processors listed at /sub-processors. Contractual protections differ by provider. No data processing agreement is in force between Fideria and Lovable, which operates the platform, AI gateway, mailbox relay and email service.
Fideria notifies customers without undue delay after it has itself been notified of a sub-processor addition or replacement. The customer's objection period starts with Fideria's notification and is never shorter than the objection period available to Fideria from its upstream provider. For upstream changes, notice is given as soon as Fideria knows, not a fixed number of days in advance. Customers may object on reasonable data-protection grounds. If an objection cannot be resolved, the customer may terminate the affected part of the Service in accordance with the master agreement.
9. International transfers
Storage and processing happen in different places. The application database and its backups are stored in Stockholm, Sweden. AI prompt content, including text extracted from invoice emails, is sent to Google and OpenAI endpoints and processed in the United States. Lovable states that these transfers rely on the mechanisms in its own Privacy Policy, including clauses it has entered with its service providers. Those clauses are Lovable's, not an agreement between Fideria and Lovable.
10. Data subject requests
Fideria will, taking into account the nature of the processing, assist the Customer by appropriate technical and organizational measures to respond to requests from data subjects to exercise their rights under Chapter III of the GDPR.
11. Personal data breach
Fideria will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and provide information reasonably needed for the Customer to meet its own notification obligations.
12. Deletion and return
On termination or at the Customer's request, Fideria will return Customer Personal Data or delete it from the live database, unless retention is required by applicable law. Backup limitations apply as follows.
Fideria deletes the customer's records from the live database. Backup copies age out according to a retention period that Lovable does not publish. Selective deletion of a customer's records from backups is not possible.
Lovable's platform-level deletion operates per project or account: data first becomes inaccessible, then is permanently removed, including from backups, after a retention period Lovable does not publish. This is not the same as Fideria deleting one customer's records in a shared live database.
13. Audits
The Customer may request evidence of Fideria's compliance with this DPA once per 12-month period. Fideria will respond with reasonable documentation (security overview, sub-processor list, control descriptions). On-site audits are available on request under reasonable notice and confidentiality terms.
14. Contact
Data protection questions: privacy@fideria.ai. To execute this DPA as a counter-signed agreement, contact legal@fideria.ai.
Annex A. Fideria as data processor
Fideria AB · [ORG_NR] · [REGISTERED_ADDRESS] · Data protection contact: privacy@fideria.ai.
Note: bracketed fields will be filled in the counter-signed version.