> ## Documentation Index > Fetch the complete documentation index at: https://docs.brandatlas.pro/llms.txt > Use this file to discover all available pages before exploring further. # Data Processing Agreement > How we handle the personal data inside your brand on your behalf. **Draft, not yet in force.** This document is being reviewed and will change before it applies to anyone. *Last updated: 4 October 2026.* ## 1. Who this is between, and what it covers This agreement is between the customer who accepts the [Terms of Service](/legal/terms) ("you") and \[TEAM TO CONFIRM: the legal name of the company] ("we"). It forms part of the Terms, and you accept it by accepting them. If you need a signed copy, write to \[TEAM TO CONFIRM: legal contact email]. It covers personal data in the content you put into Brand Atlas, where you decide what is processed and why (you are the controller), and we process it for you (we are the processor). Personal data we handle for our own purposes, such as your account details, is covered by our [Privacy Policy](/legal/privacy) instead. It is written to meet Article 28 of the UK GDPR and the EU GDPR. ## 2. The processing | | | | - | - | | **What we do** | Store, display, share as you direct, search, back up, and run the AI features you use on your content. | | **Why** | To provide Brand Atlas to you. | | **How long** | For as long as you use Brand Atlas, and then until it is erased as set out in section 6. | | **Kinds of data** | Whatever personal data you put in, typically names, job titles, email addresses, phone numbers and photos of your team or contacts, and the personal data of the people on your account. | | **Whose data** | Your staff, contacts, team members, and anyone else your content is about. | ## 3. What we promise We will: * process the data only on your documented instructions, which are these terms and how you use Brand Atlas, unless the law requires otherwise, in which case we tell you first unless the law forbids it; * make sure everyone who can access it is bound to keep it confidential; * protect it with the measures in the Annex; * tell you if we think an instruction breaks data protection law. ## 4. Subprocessors You give us general permission to use the subprocessors on our [Subprocessors](/legal/subprocessors) page. We put each under written terms that protect the data at least as well as this agreement, and we remain responsible for them. We tell you at least 30 days before adding or replacing one. If you object on reasonable data protection grounds, we will try to find a way round it; if we cannot, you may end the affected service and we will refund any fees paid for the time after it ends. ## 5. Helping you We help you, as far as is reasonable, to: * answer requests from people using their data protection rights. Much of this you can do yourself in Brand Atlas; * carry out data protection impact assessments and consult regulators, where the law requires it. **Breaches.** If we become aware of a breach affecting your data, we tell you without undue delay, with what we know and what we are doing about it, and update you as we learn more. ## 6. At the end When you delete a brand or your account, we keep the data for 30 days so it can be restored, then erase it from our live systems. Backups expire within a further 30 days. Before you delete, you can export your content. We keep only what the law requires us to. \[TEAM TO CONFIRM: the deletion timings we promise.] ## 7. Audits We make available the information you need to show we meet this agreement, mainly by answering a reasonable security questionnaire once a year. Where the law requires more, we will agree an audit with you, at a reasonable time and at your cost. ## 8. International transfers Some subprocessors process data outside the UK and the EU, as shown on the [Subprocessors](/legal/subprocessors) page. Where they do, we rely on the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or an adequacy decision. \[TEAM TO CONFIRM: the transfer safeguard with each subprocessor.] ## 9. Liability Each party's liability under this agreement is subject to the limits in the [Terms of Service](/legal/terms). ## Annex: security measures * **Hosting.** The database is in Frankfurt, Germany, on Supabase. Files and backups are in Cloudflare's EU storage. * **Encryption.** Data is encrypted in transit and at rest by our providers. Backups are encrypted before they leave the database. AI keys you give us are encrypted again on their own. * **Access.** Row-level rules in the database keep each brand's data apart. Only a small number of named staff have administrative access, and only to provide and support the service. * **Sign-in.** Passwords are stored only as secure hashes. Sign-in codes expire after 10 minutes and are limited in number. Sign-up and sign-in forms check for bots. * **Links.** Share links use long random tokens, can expire, and can be switched off at any time. File downloads use short-lived signed links. * **Backups.** The database is backed up every night and backups are kept for 30 days. * **Monitoring.** Errors are tracked with personal data stripped out, and the service is checked for uptime. The [Security](/legal/security) page describes these in more detail. ## Changes * **4 October 2026:** first draft. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.