In short
- For the content you upload, you are the controller and we are the processor.
- We process it only to provide the service, on your instructions.
- We tell you without undue delay if we become aware of a breach.
Roles
For the personal data in the content you upload, you are the controller and we are the processor. For your own account data, we are the controller and the privacy policy applies.
Instructions
We process that data only to provide the service and only on your documented instructions, which include your use of the product.
Confidentiality
Everyone with access is bound by confidentiality obligations and gets access only where their role requires it.
Security
Encryption in transit and at rest, least-privilege access, and logging of administrative actions. Details are on the security page.
Sub-processors
We use the sub-processors listed on that page. We give notice before adding one, and you may object.
Assistance
We help you answer data subject requests, and notify you without undue delay if we become aware of a personal data breach.
Return and deletion
On termination, your content is deleted on the schedule set in the privacy policy, or sooner on request.