For your account and billing records we are the controller. For the content you store on services you rent from us, you are the controller and we are the processor acting on your instructions.
Legal
GDPR & Data Processing
Our role as processor, where data sits, and what a data processing agreement covers.
Production infrastructure is located in Kansas, United States. Customers in the EEA and UK should treat this as a third-country transfer and should ask us for a data processing agreement with standard contractual clauses before storing personal data of EU or UK residents.
We use Stripe for payment processing and Convex for application data. A current sub-processor list is available on request, and we will give notice before adding one that handles customer personal data.
We assist with access, correction, deletion, and portability requests. The client portal provides self-service data export and an account-deletion request flow with a grace period before irreversible destruction.
Where we become aware of a personal data breach affecting your data, we notify you without undue delay and with the detail you need to meet your own notification obligations.