Data Processing Agreement

1. What we process

Operational data from services you connect (deployment, uptime, payment totals and recent payment summaries, email statistics, search and app-store figures, error summaries) and the access keys you provide. Purpose: showing your dashboard, sending your alerts, and answering your assistant questions.

2. Our commitments

• We process data only on your instructions (your use of Command Deck) and for no other purpose.
• Everyone with access is bound by confidentiality.
• Security measures: encryption in transit and at rest, a separate encryption key per customer account, read-only access by design, access logging, and least-privilege administration.
• We will tell you without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting your data.
• We help you respond to data subject requests and with data protection impact assessments where relevant.
• On deletion of your account we delete your data immediately, except billing records we must keep by law.
• We make available the information needed to demonstrate compliance and allow reasonable audits.

3. Sub-processors

Vercel Inc. (hosting), Neon Inc. (database), Sendinblue SAS / Brevo (email and SMS), Stripe Payments Europe (billing), Anthropic PBC (AI assistant, only if enabled). We will give notice of new sub-processors on this page. Transfers outside the UK use the UK International Data Transfer Addendum or an adequacy decision.

4. Law

This agreement is governed by the laws of England and Wales and forms part of the Terms of service.