We act as a data processor for your end-customer messages and as a controller for your account data. This page summarizes how we meet our obligations under the GDPR and what we promise to you in our Data Processing Addendum.
1. Data Processing Addendum
Every paid customer is auto-enrolled into our standard DPA. You can download a signed copy from Settings → Legal at any time. Custom DPAs are available for Enterprise plans.
2. EU data residency
Choose Frankfurt (eu-central-1) at sign-up to keep all conversation data, backups and AI inference within the EU. Cross-region transfer is opt-in and gated by Standard Contractual Clauses.
3. Subprocessors
We maintain a public subprocessor list, publish 30-day notices before adding any, and let you object. Current subprocessors include AWS (hosting), Twilio (telephony fallback) and OpenAI/Google (LLM inference, no training).
4. Data subject requests
If an end-customer exercises their rights, we forward the request to you within 24 hours and provide one-click tools to fulfill access, rectification, erasure and portability requests.
5. Breach notification
In the unlikely event of a personal data breach, we notify affected customers without undue delay and never more than 72 hours after we become aware.
6. International transfers
All transfers outside the EEA rely on the European Commission's 2021 Standard Contractual Clauses plus supplementary measures including transit encryption (TLS 1.3) and at-rest encryption (AES-256).
7. Reach our DPO
Email dpo@smartlycraft.com. EU representative under Article 27: SmartlyCraft EU OU, Tallinn, Estonia.