Data processing agreement

Parties and scope

This agreement is between you, the account holder, as controller, and Affiliate Intelligence Ltd, a company registered in England and Wales under number 14577286, whose registered office is at 86-90 Paul Street, London, EC2A 4NE, United Kingdom, as processor. It forms part of the terms of service and covers personal data we process on your behalf when we run your projects, mainly your apps' end users' data. It's written to meet Article 28 of the UK GDPR and the EU GDPR.

The processing

• Subject matter and purpose: hosting and running your apps, their databases, files, authentication, email and other Flatstack features you use.
• Duration: for as long as you have an account, then until the data is deleted as described below.
• Data subjects: your apps' end users, and anyone else whose data you put on Flatstack.
• Personal data: whatever your apps store or send, typically names, email addresses, sign-in records, and content end users create. You decide what that is.
• Special category data should only be stored where you have a lawful basis for it and have chosen suitable settings.

What we commit to

• We process the data only on your documented instructions, which are these terms and your use of Flatstack, unless the law requires otherwise, in which case we'll tell you unless the law forbids it. We'll tell you if we think an instruction breaks data protection law.
• Everyone at Flatstack who can access the data is bound by confidentiality.
• We keep the security measures described on the security page, and keep them appropriate to the risk.
• We help you answer your end users' requests to access, correct, export or delete their data, through the export and deletion tools in Flatstack and, where those aren't enough, by assisting directly.
• We help you with security, breach notification, data protection impact assessments and consultations with regulators, as far as our role allows.
• We tell you without undue delay after becoming aware of a personal data breach affecting your data, with what we know and what we're doing about it.

Subprocessors

You authorise us to use the subprocessors on the subprocessors page. We email account owners 30 days before adding or replacing one. If you object on reasonable data protection grounds and we can't address it, you can cancel and we'll refund any period paid for and not used. We put the same data protection obligations on each subprocessor and remain responsible for them.

International transfers

Each project's data is stored in the region you choose. Where data is transferred outside the UK or EU, including to subprocessors in the United States, the transfer is covered by the UK International Data Transfer Addendum or the EU Standard Contractual Clauses (module 3, processor to processor, or module 2 where applicable), or by an adequacy decision.

Deletion and return

You can export all of your data at any time. When your account ends, it's read-only for 30 days so you can export it, then deleted, including from backups as they expire, unless the law requires us to keep it.

Audits

We'll give you the information you need to show we meet this agreement. If that isn't enough, you or an auditor bound by confidentiality may audit our compliance once a year, with 30 days' notice, at your cost. Requests go to privacy@flatstack.dev.

Liability and precedence

The liability terms in the terms of service apply to this agreement. If this agreement conflicts with the terms of service about personal data, this agreement wins.

Accepting it

This agreement applies to every account from signup. Account owners can also accept it in the dashboard and download a signed PDF of the version they accepted.