Data Processing Agreement

1. Scope and roles

• "Customer Personal Data" means personal data that Cloud Canal processes on the Customer's behalf in providing the Service: data in the Customer's apps and sites, and data about their visitors, users, form submitters and email recipients. Annex 1 describes it. Data about the Customer's own account holders is not Customer Personal Data; our Privacy Policy covers it.
• For Customer Personal Data, the Customer is the controller and Cloud Canal is the processor. If the Customer acts as a processor for someone else (for example, an agency building a site for its client), Cloud Canal is the Customer's subprocessor, and the Customer confirms its client has authorised this.
• "Data Protection Laws" means every law that applies to the processing, including the EU GDPR, the UK GDPR, the Swiss FADP, Canada's PIPEDA and provincial privacy laws, and US state privacy laws such as the CCPA. Terms such as "controller", "processor", "personal data breach" and "data subject" have the meanings those laws give them.
• The Customer is responsible for having a lawful basis for its processing, for the instructions it gives, and for informing its visitors and users, including by placing the privacy notice the dashboard provides for analytics on its site.

2. Instructions

Cloud Canal processes Customer Personal Data only on the Customer's documented instructions. These are: the Terms and this DPA; the Customer's use and configuration of the Service, including through its AI tools; and any other written instructions both parties agree. Cloud Canal will tell the Customer if it believes an instruction breaks Data Protection Laws, and will process data otherwise only where the law requires it, informing the Customer first unless the law forbids that.

3. Confidentiality

Cloud Canal ensures that anyone it authorises to process Customer Personal Data is bound by confidentiality, and gives access only to those who need it to provide, secure or support the Service.

4. Security

Cloud Canal implements and maintains the technical and organisational measures in Annex 2. They are appropriate to the risk, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing. Cloud Canal may update them as long as the overall level of protection does not go down.

5. Subprocessors

• The Customer gives general authorisation for Cloud Canal to use the subprocessors in Annex 3.
• Cloud Canal will tell the Customer, by email or in the dashboard, at least 30 days before adding or replacing a subprocessor. The Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Service and receive a pro-rated refund of prepaid fees for it.
• Cloud Canal binds each subprocessor to data protection obligations that protect the data at least as well as this DPA, and remains responsible for their performance.
• Services the Customer connects with its own accounts (Google, X, Bluesky, and the Stripe account it sells with) are not Cloud Canal's subprocessors. Customer Personal Data reaches them only when the Customer's instructions send it there, for example by publishing a post or taking a payment, and they process it under the Customer's own agreement with each provider.

6. Data subject requests

Cloud Canal will help the Customer answer requests from people exercising their data protection rights. Much of this the Customer can do directly in the dashboard, for example by viewing, exporting and deleting records, users and form submissions. If Cloud Canal receives a request about Customer Personal Data directly, it will pass it to the Customer without undue delay and will not answer it itself, except to say it has been passed on.

7. Personal data breaches

Cloud Canal will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will contain the information the Customer needs to meet its own obligations, as far as Cloud Canal knows it at the time, with more to follow as it becomes known. Cloud Canal will take reasonable steps to contain the breach and limit its effects. A notice is not an admission of fault.

8. Assistance

Taking into account the nature of the processing and the information available to it, Cloud Canal will give the Customer reasonable help with data protection impact assessments and with consultations with supervisory authorities about the Service.

9. Return and deletion

• While the Customer's account is active, the Customer can export its data and sites using the dashboard's export features.
• When the Customer deletes an app, Cloud Canal begins deleting its Customer Personal Data within minutes. This covers the app's server, database, files, backups, static site, email servers, Inbox (form submissions, received email and its attachments, and social mentions), social posts, store records (products, orders, customers, subscriptions, refunds and disputes), AI conversations and analytics website. Analytics events are purged from the analytics store within 7 days. If a step fails, it is retried automatically.
• An app suspended for non-payment is deleted the same way 7 days after suspension.
• When the agreement ends, Cloud Canal deletes any remaining Customer Personal Data within 30 days, unless the law requires it to keep it.

10. Audits

Cloud Canal will make available the information reasonably needed to show it complies with this DPA, including written answers to reasonable security questionnaires. If that is not enough to meet a requirement of Data Protection Laws, the Customer may audit Cloud Canal's compliance, or have an independent auditor bound by confidentiality do so. This is limited to once a year, on 30 days' notice, during business hours, at the Customer's cost, and without access to other customers' data. A supervisory authority may audit as the law allows.

11. International transfers

• Cloud Canal is established in Canada, which the European Commission recognises as providing adequate protection for organisations subject to PIPEDA. Transfers of Customer Personal Data from the EEA, the UK or Switzerland to Cloud Canal rely on that adequacy decision and its UK and Swiss equivalents.
• Where adequacy does not apply, the parties agree to the European Commission's Standard Contractual Clauses (Decision 2021/914), incorporated here by reference. Module Two (controller to processor) or Module Three (processor to processor) applies as appropriate. Clause 7 (docking) applies; under Clause 9, option 2 (general authorisation) applies with the notice period in section 5; the optional wording in Clause 11 does not apply; Clauses 17 and 18 select the law and courts of Ireland. Annexes 1 to 3 of this DPA complete the Clauses' annexes.
• For the UK, the UK Addendum to the Clauses (issued by the Information Commissioner) applies. For Switzerland, the Clauses apply with references read as references to the FADP and the Federal Data Protection and Information Commissioner.
• Onward transfers to subprocessors outside the EEA, the UK and Switzerland use an adequacy decision (such as the EU–US Data Privacy Framework, where the subprocessor is certified) or Standard Contractual Clauses.

12. US state privacy laws

Where the CCPA or a similar US state law applies, Cloud Canal is a "service provider" or "processor". It will not sell or share Customer Personal Data. It will not retain, use or disclose that data outside the direct business relationship with the Customer or for any purpose other than providing the Service. It will not combine that data with personal data from other sources except as those laws allow. It will notify the Customer if it can no longer meet these obligations.

13. General

This DPA lasts as long as Cloud Canal processes Customer Personal Data. If it conflicts with the Terms, this DPA prevails on data protection; if it conflicts with the Standard Contractual Clauses, the Clauses prevail. Liability under this DPA is subject to the limits in the Terms, except where Data Protection Laws or the Clauses do not allow that. Cloud Canal may update this DPA as the Terms describe, but not in a way that lowers the protection of Customer Personal Data without the Customer's agreement.

Annex 1: Processing

Data subjects: visitors to the Customer's sites; users of the Customer's apps; people who submit the Customer's forms; recipients of email the Customer's apps send, and people who email them; people who buy from the Customer's sites; people who mention or reply to the Customer's connected social accounts; and anyone else whose data the Customer puts into the Service.

Duration: for the term of the agreement, then as section 9 describes.

Nature and purpose, by feature:

• Hosting — storing and serving the Customer's sites, database records, user accounts and files, and running its workflows. Data: whatever the Customer's apps hold.
• Backups — copies of the app's database and files on the schedule and retention the Customer sets (default: daily, kept 30 days; 7 days on the free plan).
• Form submissions (Inbox) — storing messages sent through the Customer's forms and emailing them to recipients the Customer chooses. Data: the fields submitted, plus the page, country, browser user agent and referrer. The IP address is stored only as a salted hash, for spam control. Kept 90 days.
• Analytics — aggregate traffic statistics for the Customer's live site. Data: page address, referrer (origin and path), campaign tags, country, region and city, browser, operating system, device type, language and screen size, linked only by a pseudonym that changes daily. The IP address is replaced by that pseudonym before storage and is never stored. Visitors whose browser sends Global Privacy Control or Do Not Track are not measured, and any visitor can opt out on the site's opt-out page (/_cc/optout) or through controls the Customer builds; an opted-out visitor's choice is kept in their own browser, and nothing is measured or stored for them. Stored in the EU (Frankfurt) for 25 months.
• Email sending — delivering the email the Customer's apps send. Data: recipient addresses, message content and delivery events. Open and link-click tracking is off for every email server created from October 6, 2026.
• Email receiving (Inbox) (paid plans) — receiving email sent to the app's addresses, notifying the people the Customer chooses and passing it to the Customer's workflows. Data: the sender's and recipients' addresses, subject, the text of the message (HTML is converted to text and not stored), attachments other than executable and other dangerous file types, the sender-authentication results and the spam score. Kept 90 days; attachments go with their message.
• Social posting and listening (paid plans) — publishing the Customer's posts and replies to X and Bluesky through accounts the Customer connects, and, if the Customer turns listening on, bringing posts that mention or reply to those accounts into the Inbox. Data: the author's handle, the post's text and address, and the conversation it belongs to. Mentions are kept 90 days in the Inbox; the Customer's own posts are kept until the app is deleted.
• Payments (paid plans) — selling from the Customer's site through the Stripe account the Customer connects. Data: the buyer's name and email address, the site account they bought with (if any), what they bought, amounts, discounts and tax, subscription status, refunds and disputes. Buyers enter card details only on Stripe's own pages; Cloud Canal never receives them. Stripe processes the payment under the Customer's own agreement with Stripe (section 5). Cloud Canal keeps a copy of the store records, in the United States (US East), until the app is deleted.
• Search and advertising — Search Console and Google Ads statistics for the Customer's site and campaigns. These are aggregate figures (clicks, impressions, search queries, spend); no personal data about visitors is intended. Cloud Canal uploads no audience lists or conversions and sets no retargeting tags.
• AI assistant (paid plans) — answering the Customer's requests. Prompts and the app data needed to answer them, which can include database records, users and form submissions, are sent to the AI providers in Annex 3. Conversations are kept until the app is deleted.
• Logs — operating the Customer's servers. Request logs on each app server are kept for 7 days; recording of visitor IP addresses in the app's database logs is off by default and the Customer can change it.

Special categories: none intended. The Customer must not use the Service for special-category data, or for data regulated by sector-specific rules such as health or payment-card data, unless Cloud Canal agrees in writing.

Annex 2: Security measures

• Isolation: each paid app runs on its own virtual server. Each app has its own storage buckets and access keys, limited to that app.
• Encryption in transit: all public traffic uses TLS. Connections between Cloudflare's network and our servers use origin certificates with strict validation.
• Network: server firewalls admit only the traffic each service needs. The analytics service accepts traffic only from Cloudflare's network and administrative access only from authorised addresses.
• Access control: administrative access is limited to authorised personnel using SSH keys. The control channel between our platform and each app server is authenticated with a per-app signing key, which the platform stores encrypted.
• Data minimisation: analytics replaces IP addresses with a daily pseudonym before storage; form submissions store a salted hash in place of the IP; app servers do not log visitor IPs in their database logs by default. AI providers are instructed not to collect data where the routing service offers that control.
• Resilience: continuous database replication and scheduled backups to separate storage, with documented restore procedures.
• Monitoring: health checks and alerts on platform services.
• Abuse prevention: bot checks on signup and login, rate limits on public endpoints, and spam scoring on form submissions.

Annex 3: Subprocessors

• Amazon Web Services, Inc. (United States) — app servers, the platform's servers and the analytics service. Location: the region chosen for each app (currently the United States or the European Union); the platform in the United States (US East); analytics in the European Union (Frankfurt, Germany).
• Cloudflare, Inc. (United States) — DNS, content delivery, traffic routing, bot checks, edge computing for the site router and AI tools, and the custom-domain service. Location: global network.
• Backblaze, Inc. (United States) — static site hosting, file storage and backups. Location: United States, or the European Union (Netherlands) for apps in the EU region.
• ActiveCampaign, LLC (Postmark) (United States) — sending and receiving email for the platform and for the Customer's apps. Location: United States.
• OpenRouter, Inc. (United States) — routing AI requests to model providers: OpenAI (United States); Google (United States); and, for DeepSeek models, inference providers hosted in the United States. Paid plans only.
• Stripe, Inc. (United States) — billing the Customer. When the Customer sells through Cloud Canal Payments, its buyers' payments are processed by Stripe under the Customer's own agreement with Stripe, not as Cloud Canal's subprocessor (section 5).
• OpenCage GmbH (Germany) — turning addresses the Customer enters while building a site into map coordinates. Only the address text is sent.

Questions about this DPA: [email protected].