Last updated: draft
This summary describes how we process personal data on behalf of your organization (you are the controller, we are the processor for your clients' data). A full, signable DPA is available on request before launch.
Storage and processing of project documents, generation of estimates and documents (deviz, offer, contract), and transactional email delivery.
Supabase, Vercel (including Vercel AI Gateway and Vercel Blob), and Resend. All are engaged under DPAs and process data in the EU/EEA or with adequate safeguards.
Encryption in transit (TLS) and at rest (provider-level), multi-tenant isolation via Row Level Security, file access via signed URLs only, security headers, and session limits.
In the event of a personal data breach, we will notify without undue delay and, where applicable, within 72 hours, in line with GDPR.