Data Processing Agreement
Every [SQUARE BRACKET] is a placeholder or a lawyer question. Labels: Decided by user 2026-11-07 — pending lawyer review and DEFAULT — confirm with user / lawyer. Questions for the lawyer are in README.md.
This agreement is part of the Questproof Terms of Service. It covers the personal information of your clients that you (the freelancer) put into Questproof or that Questproof records when your clients use your links.
1. The parties and their roles
- You, the freelancer, decide which clients to add and what to send them. You are the controller of your clients' personal information.
- HANALIGHT LIMITED, a company registered in New Zealand, runs Questproof and processes that information only for you, as your processor.
[UNVERIFIED: the controller / processor roles (PRD §3.1 and §10 Q7) and the matching NZ Privacy Act 2020 s 11 agent position need a lawyer's confirmation. Q7: DEFAULT — confirm with user / lawyer.]
For your own account details (your email, profile and billing), HANALIGHT LIMITED is the controller (see the Privacy Policy).
2. What we process
| People | Your clients, and anyone who opens or uses a link you send |
|---|---|
| Information | Name and email (entered by you); the stored copy of what they were shown and its SHA-256 fingerprint; their decision, typed name and reason; the server time (UTC); their IP address and user agent; their IP address as a rate-limit key |
| Purpose | To show your clients the scope or change order you send, record their decision as a record of agreement, protect the links from abuse, and let you download the record |
| Duration | Until your account is deleted, with the limits in section 6 |
3. Our duties
We will:
- process your clients' information only to provide Questproof to you, and as you instruct through the app or in writing;
- not sell it or use it for our own purposes;
- make sure our staff and contractors who can reach it keep it confidential;
- keep it safe (section 5);
- tell you about a breach (section 7);
- help you answer your clients' requests (section 8);
- delete it as set out in section 6.
4. Sub-processors
You agree that we use these sub-processors:
| Sub-processor | What it does | Region |
|---|---|---|
| Supabase | Database, sign-in, file storage, server functions | EU region: Frankfurt, Germany (eu-central-1) [for lawyer review.] |
| Resend | Sends email notices to you (never to your clients). The email holds your display name, the project title, the change order number or "the scope", and your client's typed name, decision, server time (UTC) and reason if given (free text that may contain personal information). It never holds their IP address, user agent or link code. Resend also delivers your sign-up confirmation and password reset emails. [for lawyer review.] | [UNVERIFIED] |
| Paddle (when paid plans are available) | Checkout and billing for your own account. It receives no client information. | [UNVERIFIED] |
| Cloudflare | Hosts the website and app files; sees visitors' technical information such as IP address. Cloudflare Turnstile checks for bots on the freelancer sign-in screens only and does not run on client pages, so it does not receive your clients' data. [for lawyer review: LAWYER D6: does Turnstile belong in this list, given it concerns the freelancer's own sign-in?] | [UNVERIFIED] |
We will tell you before we add or replace a sub-processor, by email or in the app, at least [NOTICE PERIOD] before the change, so you can object or stop using Questproof. [LAWYER D1: notice period and objection process.]
5. Security
- Row-level security (RLS). Every row belongs to one freelancer, and the database stops anyone else reading it.
- No direct client access. Your clients never reach the database. The client page goes through one server function, which only returns the stored copy for a valid link.
- Link codes are hashed. We store only the SHA-256 of each link's secret code, never the code itself. A wrong, revoked or withdrawn link shows the same message: "This link is no longer active. Please contact your freelancer."
- EU region. The database runs in Supabase's EU region, in Frankfurt, Germany (
eu-central-1) (section 4). [for lawyer review.] - Insert-only evidence. Accepted scope versions and client decisions cannot be edited or deleted, except by account deletion and the removal of IP address and user agent after 6 years (section 6).
- Rate limits on the client link, by IP address.
- Encryption in transit. Data is sent over encrypted connections.
6. Deletion and the grace period
- While your account exists, we keep your clients' information. Projects cannot be deleted, only archived.
- IP address and user agent are removed 6 years after the client's decision. [Q6: Decided by user 2026-11-07 — pending lawyer review.]
- Rate-limit keys are kept for up to 1 day.
- Account deletion. When you ask to delete your account, a 30-day grace period starts, during which you can cancel. After it, we delete your account and all your clients' information in it. [D-A: DEFAULT — confirm with user / lawyer.]
- Before you delete, download your PDFs and data. We cannot restore them afterwards.
- Copies inside backups end when those backups expire [IF BACKUPS ARE IN PLACE; CONFIRM PERIOD].
7. Breach notice
If we become aware of a breach of security affecting your clients' information, we will tell you without undue delay, and within [HOURS] hours. We will tell you what happened, what information is affected, and what we are doing about it, and help you meet your own duties to notify regulators and your clients. [LAWYER D2: the hours, and how this fits the NZ notifiable-breach rules and GDPR. UNVERIFIED.]
8. Help with your clients' requests
[Q7: DEFAULT — confirm with user / lawyer.]
- If one of your clients asks us to see, correct or delete their information, we will pass the request to you within [N] working days and will not answer it ourselves unless the law requires it.
- We will help you answer, as you instruct. You can download all your data in Settings at any time.
- Accepted records cannot be changed. A client can ask for a statement of correction to be kept with the record. [LAWYER D3: is this enough for correction and erasure requests? UNVERIFIED.]
9. Transfers outside the EU / UK
HANALIGHT LIMITED is in New Zealand, and some sub-processors may be outside the EU. [LAWYER D4: which transfer safeguards are needed, for example whether an adequacy decision for New Zealand applies, or standard contractual clauses. UNVERIFIED.]
10. Audits
[SUGGESTED] We will give you the information reasonably needed to show we meet this agreement. [LAWYER D5: audit rights for a small processor.]
11. Contact
HANALIGHT LIMITED [POSTAL ADDRESS] Email: [CONTACT EMAIL]