Data Processing Agreement (DPA)

Last updated: April 2026

1. Scope

This Data Processing Agreement ("DPA") supplements the Terms of Service and applies when DaVinci Lab L.L.C-FZ ("Processor") processes personal data on behalf of the Customer ("Controller") in connection with the Urban Design Toolkit service.

2. Data We Process

Account Data: Email address, name, hashed password
Project Data: Design files, images, 3D models created within the platform
Usage Data: Feature interactions, session duration, device information
AI Interaction Data: Prompts and generated outputs processed through third-party AI providers

3. Third-Party Sub-Processors

We use the following sub-processors for service delivery:

Google Cloud / Gemini: AI image generation and analysis
OpenAI: AI text and vision analysis
Anthropic: AI text analysis
Mapbox: Map rendering and geocoding
Google Maps: Satellite imagery and 3D tiles
Stripe: Payment processing
Resend: Transactional emails

4. Data Security Measures

All data transmitted over HTTPS (TLS 1.3)
Passwords hashed with bcrypt (cost factor 12)
JWT tokens with cryptographic signing
Rate limiting and brute-force protection
Database access restricted to application layer only
Regular automated backups

5. Data Retention

Account Data: Retained until account deletion
Project Data: Retained until project or account deletion
Usage Analytics: Aggregated after 90 days, deleted after 1 year
Audit Logs: Retained for 2 years for security compliance

6. Your Rights (GDPR)

Access: Request a copy of your data via Settings → Export Data
Rectification: Update your profile information at any time
Erasure: Delete your account and all associated data via Settings → Delete Account
Portability: Export your projects in standard formats

7. Contact

For data processing inquiries: davincilaba@gmail.com