Data Processing Agreement
Scope
When business customers upload personal data (for example customer names or emails inside files or chats), we process it on their behalf as a processor under Article 28 GDPR. This Data Processing Agreement (DPA) is part of the Terms of Service and applies automatically to every paid and trial account.
Our commitments
- Process customer data only on documented instructions — to provide the Service.
- Keep it confidential; staff with access are bound by confidentiality.
- Apply appropriate security: encryption in transit (TLS), access control per workshop, isolated database rows, automatic deletion of files and calculations after 24 hours.
- Use only the sub-processors listed below, and announce new ones 30 days in advance so customers can object.
- Help customers answer data-subject requests and notify them of a personal data breach without undue delay.
- Delete or return all customer data at the end of the contract.
- Where data leaves the EU/EEA, rely on adequacy decisions or the EU Standard Contractual Clauses.
Sub-processors
- Google Cloud — hosting, Israel (Tel Aviv region) — a country with an EU adequacy decision
- Anthropic — assistant replies
- Paddle — payments and invoicing
- Google — sign-in and service email
Signed copy
Need a countersigned copy for your records? Write to support@buildfill.com.