Data processing agreement

The Processor processes account data only to provide the service, for as long as the Controller's users keep accounts.

User email addresses and names; saved patterns, templates and presets; download history metadata; counts in run reports. File contents are processed only on the user's device and are never received by the Processor.

Process data only on documented instructions; ensure staff confidentiality; apply appropriate technical and organisational measures (encryption in transit and at rest, row-level access control); assist with data subject requests; notify the Controller of a personal data breach without undue delay and within 72 hours.

Cloud database and authentication hosting. The Controller will be informed of changes and may object.

Where data leaves the EEA, transfers rely on the European Commission's Standard Contractual Clauses.

On termination, data is deleted. The Controller may request information needed to demonstrate compliance.