Data processing addendum

Last updated 27 September 2026

This addendum applies where you are a controller of personal data and Studio processes it on your behalf. It forms part of the terms of service.

1. 1. Roles

   You are the controller of the personal data you put into Studio, including your clients’ contact details and the comments they leave. We are the processor, acting on your documented instructions.

   Your use of the product is the instruction. We do not process that data for any other purpose.

2. 2. What is processed

   Names, email addresses, IP addresses recorded against sign-off and audit entries, comment text, and the page context captured with each comment.

   Categories of data subject: your team, and the contacts at your clients.

3. 3. Security

   Encryption in transit and at rest. Row-level isolation between workspaces in the database, behind an application layer that scopes every query. Passwords hashed with Argon2id. Access to production limited to named staff and logged.

4. 4. Sub-processors

   Oracle Cloud (hosting the application), Supabase (the database and file storage), Resend (email), Razorpay (payments), Cloudflare (the status page and its monitor, which see request counts but no personal data) and Ollama (the model behind Ask Studio, for what a person sends it; it may be processed in the United States and on infrastructure Ollama uses to run models; Ollama states it is not kept beyond answering or used for training).

   We keep this list current and will give you thirty days’ notice before adding one, so you can object. If you object and we cannot resolve it, you may cancel without penalty for the remainder of the period.

5. 5. Assistance

   We will help you answer a data subject request, and a supervisory authority, within the timeframes the law sets. Export is self-serve so most requests need nothing from us.

6. 6. Deletion and return

   On cancellation, data remains available for export for ninety days and is then deleted, including from backups on their normal rotation. We will confirm in writing when it is done.

7. 7. Breach notification

   We will notify you without undue delay and within seventy-two hours of becoming aware of a personal data breach affecting your data, with what we know at the time and what we are doing about it.