Data Processing Agreement

1. Parties

• Data Processor:FremTech AS, org.nr. 937 616 236, operating Vibe Code at vibe-code.no. Contact: contact@vibe-code.no
• Data Controller: You, the user creating and managing the Professional hub.

2. Subject matter and purpose

The Processor hosts and stores the content you and your hub members upload to your Professional hub (code snippets, tools, comments, and associated metadata) on a server located in Norway. The purpose is to provide the Vibe Code platform service.

3. Controller responsibilities

As the Data Controller, you are responsible for:

• Ensuring you have a lawful basis for uploading any personal data to your hub
• Informing your hub members about how their data is processed
• Responding to data subject requests relating to content in your hub
• Ensuring that any client or third-party data you upload complies with applicable data protection law

4. Processor obligations

The Processor will:

• Process hub content only as necessary to deliver the platform service
• Not share your hub content with other users outside your hub
• Apply appropriate technical security measures (HTTPS/TLS, access controls, hashed credentials)
• Delete hub content when you delete your hub or your account
• Notify you without undue delay if a personal data breach affecting your hub content occurs
• Process data only within Norway, except where sub-processors are used (see section 5)

5. Sub-processors

The Processor uses the following sub-processors that may process hub-related data:

• Deploi VPS — server infrastructure, located in Norway. All hub content is stored here.
• Resend (resend.com) — transactional email delivery. Only email addresses and notification content are processed. US-based; transfers covered by Standard Contractual Clauses.

You will be notified via a notice on this page if sub-processors change materially.

6. Duration and deletion

This DPA applies for as long as you maintain a Professional hub on Vibe Code. Upon deletion of your hub or account, all associated content will be permanently deleted from the platform. Server access logs (which may contain IP addresses) are retained for 14 days and then automatically deleted.

7. Data subject rights

If a data subject submits a request relating to content in your hub (e.g. a request for erasure or access), the Processor will forward the request to you as the Controller. You are responsible for responding within the timeframes required by GDPR. The Processor will assist technically where possible (e.g. by deleting specific content on your instruction).

8. Governing law

This DPA is governed by Norwegian law. Disputes shall be resolved in accordance with Norwegian jurisdiction. GDPR and the Norwegian Personal Data Act (Personopplysningsloven) apply.