Effective 15 September 2026
Data Processing Addendum
This addendum applies only where Cordango processes personal data on behalf of a customer in connection with Wheel of Vibe Coding. It forms part of the applicable agreement between that customer and Cordango.
Roles and instructions
The customer is the controller and Cordango is the processor for customer personal data. Cordango will process that data only to provide, secure, maintain, and support the service, according to the customer’s documented instructions and applicable law.
Processing details
Processing may include collecting, storing, retrieving, displaying, deleting, and protecting account details, claim details, submitted content, transaction references, and technical usage data. Data subjects may include customer users and people whose details a customer submits. Processing lasts for the service term and any lawful retention period.
Confidentiality and security
Cordango will restrict personal-data access to authorised people subject to confidentiality duties and maintain appropriate technical and organisational safeguards proportionate to the risk, including access controls, data minimisation, and protection of data in transit.
Subprocessors
The service runs on third-party infrastructure. Cordango remains responsible for requiring subprocessors to protect personal data consistently with this addendum. We currently use:
| Provider | What it does |
|---|---|
| Lovable | Hosting, publishing, and management of the application and its backend infrastructure. |
| Lovable Cloud (Supabase) | Database (profiles, apps, claims, sponsors, payment history), authentication (accounts and sessions), and storage. Runs on Google Cloud infrastructure. |
| Google Sign-In, used to authenticate accounts. Only your name, email address, and profile picture are received when you sign in. | |
| Stripe | Payment processor for claims and sponsor purchases; also calculates and collects tax. Payment details are handled by Stripe and never stored by Cordango; we keep only transaction references. |
Requests and incidents
Taking account of the nature of processing, Cordango will reasonably assist the customer with data-subject requests, security obligations, impact assessments, and regulator enquiries. Cordango will notify the customer without undue delay after becoming aware of a personal-data breach affecting customer personal data.
Transfers
Where personal data is transferred internationally, Cordango will use a lawful transfer mechanism and supplementary safeguards where required by applicable data-protection law.
Return and deletion
At the end of the service, Cordango will delete or return customer personal data on request, unless law requires retention. Data may remain temporarily in protected backups until the normal deletion cycle completes.
Audit information
Cordango will provide information reasonably necessary to demonstrate compliance with this addendum and will support proportionate audits, subject to confidentiality, security, and reasonable advance notice.