Data Processing Information
Template notice: these documents are starting points only and do not constitute legal advice. They must be reviewed by a qualified legal professional before a public commercial launch. Replace all placeholders (company name, address, contact emails, registration numbers, hosting provider details).
Roles
For customer content and account data, your organisation (if applicable) may be the controller; we act as processor as defined in your Data Processing Agreement (DPA) — [placeholder].
Categories of data
Identity, contact, project content, uploaded PDFs, usage events, billing metadata, support tickets.
Sub-processors
Supabase, Vercel, Stripe, and configured AI providers. Maintain a current list and notify customers.
AI providers
When you enable OpenAI or OpenRouter, prompts and context may be transmitted per their terms. Configure data retention and zero-retention options where available.
DPA
[Placeholder] Link or process to execute a GDPR-compliant DPA with customers.
Requests
For export or erasure requests contact privacy@example.com with subject line "Data request".