# Data Processing Agreement | NorthernGo > NorthernGo Art. 28 data processing agreement for the default app database: roles, sub-processors, transfers and deletion. Source: https://northerngo.com/dpa/ Language: en Updated: 2026-08-28 --- Last updated: 22 August 2026 ## 1. Parties and scope This agreement applies when you as a NorthernGo user (controller) collect personal data from your end-users via the built-in default database. NorthernGo, operated by Nicklas Långberg, sole trader, Lycksele, Sweden (processor), processes that data only to keep your app running. The agreement is entered when you accept the terms. It is an operational Art. 28 agreement, not legal advice. ## 2. What is not covered Your own NorthernGo account (email, profile, projects) is processed by us as controller under the privacy policy, not under this agreement. If you connect your own database, webhooks or Stripe keys, NorthernGo is not a processor for that data. Special-category data (e.g. health, national ID numbers, card details) must not be stored in the default database. ## 3. Subject, nature and duration We store and retrieve records that your app writes to the default database (Supabase PostgreSQL in the EU). Processing lasts while you have an active account or until you delete the app. We do not use your app's end-user data for our own purposes, marketing or model training. ## 4. Data and data subjects Categories of data and data subjects are determined by you: typically email, names and whatever your app collects from your end-users. You are responsible for a legal basis (e.g. consent) and for informing them. ## 5. Instructions We process the data only under this agreement, the terms, and what your app requests via our API. We will tell you if an instruction in our view conflicts with the GDPR. ## 6. Sub-processors You authorise us to use the following sub-processors for the default database and the operations needed for the app to respond: We require sub-processors to protect the data to a level matching this agreement. Material changes are announced via support@northerngo.com or an update to this page. If you object within 14 days and we cannot accommodate that, you may delete the app and export the data. - Supabase — PostgreSQL database in the EU - Render — API server - Google Firebase — platform account and hosting (not your app's end-user data in the default database) - Google Gemini — if your app calls built-in AI (window.NorthernGoAI). Prompts may be processed in the US under SCCs. - Resend — if your app sends email via window.NorthernGo.sendEmail ## 7. International transfers The default database is in the EU. The API server (Render) and some platform services may process metadata outside the EU/EEA. In that case we rely on the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. ## 8. Security Traffic uses TLS. App data in the default database is access-controlled per project. API keys you store with us (e.g. Stripe) are encrypted. We have not enabled multi-factor authentication on platform accounts. You must not store card numbers or extra-sensitive data in the default database. ## 9. Data-subject rights You as controller handle requests from your end-users. We assist technically where reasonable (e.g. deletion via the app API or account deletion). Send requests to support@northerngo.com. ## 10. Deletion and return When you delete the app or your NorthernGo account, that app's default database is deleted. You can export code and account data beforehand. Backups at sub-processors are cleared under their retention, typically within 30–90 days. ## 11. Audit and incidents On written request we provide information reasonably needed to show we comply with this agreement, primarily via vendor reports. Personal-data breaches affecting your app's data are notified without undue delay to the support contact on your account. ## 12. Contact - Processor: Nicklas Långberg, NorthernGo, Lycksele, Sverige - support@northerngo.com --- NorthernGo is an AI-powered platform for building production-ready web apps with zero coding. Local AI generation via WebGPU is unlimited and free, and you own all generated source code. https://northerngo.com/