Data processing agreement

Draft — under review. This document is published so you can read it before you rely on it. It has not yet completed the operator's legal review.

1. What this covers, and who is who

This agreement applies when you use Grexus to run an application that holds other people's personal data — the people who sign in to your app, or who it emails. For that data, you are the controller and Deep IT Consulting is your processor (Art. 28 GDPR). It sits alongside the terms of use, which govern your own account; the privacy notice describes the data we hold about you, where we are the controller.

2. Subject-matter, duration, nature and purpose

Subject-matter: hosting and operating the application you build with Grexus. Duration: for as long as your project exists. Nature and purpose: storing, retrieving, transmitting and deleting the data your application handles, and authenticating and emailing the people who use it — for no purpose other than providing the service to you.

Types of personal data: whatever your application collects, plus the sign-in identities we hold for it (email address, verification status, sign-in times) and the record of the mail it sends (a hashed and truncated recipient, subject line, delivery status — never a message body). Categories of data subject: the users and customers of your application.

3. We act only on your instructions

We process this data only on your documented instructions, which are: your configuration of the project (turning on sign-in, turning on email, publishing it), the requests your application itself makes, and the actions you take on the privacy page of that project. If we are ever required by law to process it otherwise, we will tell you first unless that law forbids it.

We do not use it for our own purposes. It is never used to train or evaluate AI models, never used as demonstration or seed data, and never included in our own analytics.

4. Confidentiality and security

Everyone with access is bound to confidentiality. Our measures (Art. 32) include: isolation of every application in its own sandbox with default-deny network egress; encryption in transit and at rest; secrets held encrypted and decrypted only at the moment of injection, never logged; access to production restricted and logged; an append-only audit trail; and regular backups with tested restore.

5. Other companies we use

You give us general authorisation to use the sub-processors listed in your account under Settings → Privacy, which names each one, what it does, where it is and the safeguard covering any transfer outside the EU. We impose data-protection obligations on them no weaker than these, and we remain fully liable to you for what they do.

If we intend to add or replace one, we will tell you at least thirty days beforehand. You may object within that period; if we cannot resolve your objection, you may terminate the affected service and we will refund any unused prepaid fees.

6. Helping you answer your users

We will not answer a request from one of your users ourselves — you are their controller, so it is yours to answer. Instead, the privacy page of each project gives you a working way to do it: enter the person's address and we will produce a copy of what we hold about them, or delete it. The result always tells you what we cleared and what remains yours to do — in particular, your application's own database, which we host but cannot interpret.

If a request reaches us directly, we will pass it to you and tell the person that you are their controller. We also assist you, taking into account the nature of the processing and the information available to us, with your obligations under Arts. 32 to 36.

7. If something goes wrong

If we become aware of a personal data breach affecting your users' data, we will notify you without undue delay, with what we know at that point — the nature of the breach, the categories and approximate number of people and records affected, the likely consequences, and the measures taken. We will send more as we learn it rather than waiting for a complete picture, because your own seventy-two-hour deadline starts when we tell you.

8. Deletion and return

Deleting a project deletes what it held: the application's database, its repository, its sign-in tenant and every account in it, its sending domain, and our records of what it sent. Deleting your account does the same for every project in it, after the thirty-day grace period. You can take a copy of your own data at any time before that from Settings → Privacy.

9. Audits and information

We will make available the information needed to demonstrate compliance with this agreement, and allow and contribute to audits — including inspections — conducted by you or an auditor you appoint, on reasonable notice, no more than once a year unless a breach or a supervisory authority requires otherwise.

10. Transfers outside the EU

The platform and your application run in the European Union. Where a sub-processor listed in your account processes data outside it, that transfer is covered by an adequacy decision — including the EU-US Data Privacy Framework — or by the EU standard contractual clauses, which are incorporated into this agreement by reference for those transfers. The list in your account names which applies to each.

One is worth stating here because it affects what your privacy notice must say: sign-in accounts for your application are held by Google in the United States, under the Data Privacy Framework and the standard contractual clauses.