Legal

Data Processing Agreement

Last updated: June 30, 2026

This Data Processing Agreement ("DPA") forms part of the Devora Terms of Service and applies to customers who process personal data through Devora. Devora is operated by XFoundry.

1. Definitions

  • "Controller" means the customer who determines the purposes and means of processing personal data.
  • "Processor" means Devora (operated by XFoundry), which processes personal data on behalf of the Controller.
  • "Personal Data" means any information relating to an identified or identifiable person.

2. Processing

We process personal data only on your documented instructions and for the sole purpose of providing the Devora service. This includes:

  • GitHub account information (username, email, avatar)
  • Repository metadata (name, description, language)
  • Chat messages you send to the AI
  • Usage data (request counts, message counts)

3. Sub-processors

We use vetted sub-processors for hosting, caching, and storage. A current list is available on request — contact xfoundationcom@gmail.com. All sub-processors are GDPR-compliant and sign Standard Contractual Clauses.

4. International transfers

Data may be transferred outside the EU/EEA. We rely on Standard Contractual Clauses (SCCs) as the legal basis for transfer.

5. Data subject rights

We assist you in responding to data subject requests (access, correction, deletion, portability) within 30 days of receipt. Contact xfoundationcom@gmail.com to initiate a request.

6. Data security

We implement appropriate technical and organizational measures to protect personal data, including:

  • Encryption in transit and at rest
  • Access controls and authentication
  • Regular security reviews

7. Data breach notification

In the event of a personal data breach, we will:

  • Notify you without undue delay (within 72 hours of becoming aware)
  • Provide a description of the breach and likely consequences
  • Describe the measures taken to address the breach

8. Data deletion

Upon account deletion or contract termination, we will delete all your personal data within 30 days, except where retention is required by law.

9. Audit rights

You may audit our compliance with this DPA upon reasonable notice. Contact xfoundationcom@gmail.com to arrange an audit.

10. Contact

DPA questions: xfoundationcom@gmail.com

Learn more about XFoundry at xfoundryy.vercel.app.