Snapshot 227313
Normalized text
Scripts and page chrome removed; this is what change detection compares.
PRIVACY POLICY AND DATA
PROCESSING TERMS
Last updated: November 5, 2026
The Privacy Policy and Data Processing Terms complement the ConvertAPI Terms of
Service (Master Service Agreement) and apply to data processing by UAB ConvertAPI
(further referred to as “ConvertAPI”, “we”, “us” or “our”) for the Client (further referred as
“Client”, “you” or “your”).
Definitions used in this Privacy Policy shall have the following meanings:
“Data protection laws” mean Regulation (EU) 2016/679 of 25 May 2018 and any mandatory
national or international regulation applicable to personal data processing.
“Document” means any information, data, file, or document the Client may upload to the
Services infrastructure and/or Website for the purposes of the Services.
“Services” and “Website” shall have the meaning as defined in the ConvertAPI Terms of
Service (Master Service Agreement).
Other definitions shall be understood as they are defined in the Data Protection Laws
and/or the ConvertAPI Terms of Service (Master Service Agreement).
HOW WE PROCESS PERSONAL DATA
ConvertAPI offers online Document processing services, which are described and defined
in ConvertAPI Terms of Service (Master Service Agreement). When using such Services
and Website, the Client may upload, process, and store Documents containing personal
data of the Client or third parties on the Services and/or Website.
As a general rule, ConvertAPI strictly acts as a personal data processor (as detailed in
Appendix No 1, second table) and accesses, collects, acquires, receives, transfers,
processes, and/or uses any personal data only for the purposes of rendering the Services
and ensuring proper functionality of the Website.
ConvertAPI may act as the data controller (as detailed in Appendix No 1, first table) only
when processing personal data pertinent to your Services user account on the Website, and
as it is needed to perform contractual obligations under ConvertAPI Terms of Service
(Master Service Agreement), as well as to process your Services orders and to get in touch
with you.
More detailed information about data processing by ConvertAPI is disclosed in Appendix 1.
There is no statutory obligation for you to provide your data to ConvertAPI. However, you
cannot use some of our Services if you do not provide your data to us. Your decisions to
provide us with your personal data and use Services for Document processing are
completely voluntary.
If appropriate, we may set out the terms of this Privacy Policy and Data Processing Terms in
the individual written Data Processing Agreement. However, unless the individual Data
Processing Agreement is signed the terms of this Privacy Policy and Data Processing
Terms will apply to all our processing of any personal data.
CATEGORIES OF PERSONAL DATA THAT ARE
PROCESSED
When acting as the data processor, we transiently process only the personal data contained
in the Documents. The categories and scope of such processing are entirely dependent on
you. We do not independently access, store, save, process, or perform any operations on
such data without your direction. Only the following conversions use artificial intelligence
(AI) models (the “AI Conversions”): Document Moderation (document/to/moderate), Image
Moderation (image/to/moderate), Extract PDF (pdf/to/extract), PDF to Factur-X
(pdf/to/facturx), PDF to ZUGFeRD (pdf/to/zugferd), Redact PDF (pdf/to/redact), PDF
Watermark Remover (pdf/to/remove-watermark) and PO Translator (po/to/translate). For the
AI Conversions only, the Document, or content extracted from it (such as text or page
images), is sent to our AI sub-processor indicated in Appendix No 2, solely to perform the
conversion requested by you. Such data is not used by ConvertAPI or its AI sub-processor
to train or improve AI models. Adding a conversion to this list is a change of sub-processor
processing and is communicated in accordance with the section “Third-Party Sub-
processors”.
Documents submitted to all other conversions are not processed by AI models.
When acting as the data controller, we process your IP address, Services session data and
your user account data, including your email address and payment information. Our
Website also uses web analysis tools and cookie tools, as described in our Cookie Policy.
Cookies generate information about how you use the Website, and our server saves this
information. Strictly necessary cookies are used without consent. All other cookies
(preferences, statistics and marketing) are set only after you give your consent via the
cookie consent banner displayed on the Website, where you can accept all cookies, select
individual categories or decline them. You can change or withdraw your consent at any time
via the Cookie Declaration in our Cookie Policy. You can also block cookies through your
internet browser's settings; however, if you do this, you may be unable to use all of the
functions on our Website.
If you pay for Services using a payment card, we do not collect and store any payment
information, such as payment card numbers or verification codes. You disclose this
information only to the respective payment processor used by ConvertAPI.
PURPOSES AND LEGAL BASES OF PROCESSING
When acting as the data controller, ConvertAPI processes personal data for the following
purposes and on the following legal bases under Article 6(1) of Regulation (EU) 2016/679:
Providing the Services: creating and managing your user account, providing the
Services, processing your orders and payments, and communicating with you about
the Services. Legal basis: performance of a contract (Article 6(1)(b) of Regulation
(EU) 2016/679).
Customer support: handling your support requests and enquiries. Legal basis:
performance of a contract (Article 6(1)(b)).
Security and service integrity: ensuring the security, integrity and availability of the
Website and Services, including operational logging and the prevention of fraud and
abuse. Legal basis: our legitimate interests in protecting the Website, the Services
and our Clients (Article 6(1)(f)).
Cookies and website analytics: use of preference, statistics and marketing cookies
and similar technologies. Legal basis: your consent, given via the cookie consent
banner (Article 6(1)(a)).
Direct marketing: where we send you information about ConvertAPI services similar
to those you use. Legal basis: our legitimate interests in promoting our Services
(Article 6(1)(f)), or your consent where required by applicable law. You may object or
unsubscribe at any time.
Legal obligations: compliance with accounting, tax and other obligations under
applicable law. Legal basis: compliance with a legal obligation (Article 6(1)(c)).
Legal claims: the establishment, exercise or defence of legal claims. Legal basis: our
legitimate interests (Article 6(1)(f)).
Where ConvertAPI acts as a data processor, the Client, as the data controller, is
responsible for determining the legal basis for the processing of personal data contained in
Documents.
OUR DATA PROCESSING OBLIGATIONS
ConvertAPI processes personal data contained in the Documents on your behalf and only
by following instructions made by you electronically (your action or direction on the
Website), and only to the scope determined by you. Standard processing pertaining to
personal data subjects, terms, purposes, procedure of personal data processing, also with
categories of personal data subjects are listed in Appendix 1.
ConvertAPI shall immediately inform the Client if, in its opinion, an instruction infringes
Regulation (EU) 2016/679 or other Union or Member State data protection provisions.
ConvertAPI ensures compliance of personal data processing with the Data protection laws
and pertinent instructions by supervisory authorities. ConvertAPI has no reasonable means
to, and does not verify, and has no obligation to verify that Client is a legitimate data
controller for the personal data that the Client included into the Documents and processes
through the Services. It is the sole responsibility of the Client to maintain the legitimacy of
such data processing.
ConvertAPI may reasonably assist you in fulfilling data controller’s obligations arising from
the Data protection laws, including but not limited to your obligations with respect to the
data subjects rights, e.g. right of access by the data subject, right to rectification, right to
erasure, right to restriction of processing.
Taking into account the nature of processing and the information available to ConvertAPI,
ConvertAPI shall also reasonably assist the Client in ensuring compliance with the
obligations pursuant to Articles 32 to 36 of Regulation (EU) 2016/679, including the security
of processing, notification of personal data breaches, data protection impact assessments
and prior consultation with supervisory authorities.
ConvertAPI will implement all appropriate technical and organisational data security
measures (as detailed in Appendix No 1) to ensure security and confidentiality of data
processing in accordance with the Data protection laws. ConvertAPI will not perform any
action, which would cause the Client to act in violation of the Data protection laws.
ConvertAPI will not transfer or otherwise disclose any personal data or other information
relating to personal data processing to any other third party, other than third-party sub-
processors as described below, or authorized government institutions. ConvertAPI will notify
you about situations, where it must disclose personal data processed on your behalf in
order to fulfil obligations stipulated in the Data protection laws, unless this is precluded by
the applicable law.
THIRD-PARTY SUB-PROCESSORS
The Services and Website are hosted on a secure third-party cloud platform, with data
processing locations determined based on your configuration. For example, if you configure
the API to use EU-based servers, data will be processed and stored within the EU. To
deliver our Services, we may engage third-party providers for data storage and processing,
ensuring compliance with applicable data protection standards. ConvertAPI is responsible
for all sub-processing of personal data by such third parties.
You agree and consent that such third parties, which are listed in Appendix No 2 and
described in Appendix No 1, will be engaged by ConvertAPI as sub-processors of personal
data. Before engaging new or changing the existing third-party sub-processors of personal
data, we will communicate and/or disclose this to you by providing third-party details and
other pertinent information. The current list of sub-processors engaged by ConvertAPI,
including their legal entity, the services they provide, the personal data concerned and the
safeguards applied to transfers of personal data, is set out in Appendix No 2, which
ConvertAPI keeps up to date. Such notice will be given at least fourteen (14) days before
the new or replacement sub-processor begins processing personal data. You may object to
the engagement on reasonable data protection grounds by notifying us at
privacy@convertapi.com within that period. In that case, we will discuss your objection with
you in good faith and, where no mutually acceptable solution is reached, you may terminate
the affected Services without penalty; prepaid fees are non-refundable, except as required
by applicable law or as otherwise agreed in an individual Data Processing Agreement.
Where the replacement of a sub-processor is urgently required for security or service
continuity reasons, ConvertAPI may engage the replacement sub-processor immediately
and will notify you as soon as reasonably practicable, in which case you will have the same
right to object.
ConvertAPI undertakes to execute its best efforts to ensure that all third-party sub-
processors observe all applicable data protection laws and are bound by privacy rules that
meet all applicable requirements required by data protection laws.
You have the right to object, at any time, to the processing of your personal data based on
our legitimate interests or for direct marketing purposes.
Legitimate Interests: If our processing of your personal data is based on our legitimate
interests, you may object to this processing by providing a specific reason related to
your particular situation. Upon receiving your objection, we will evaluate your request
and cease processing your data unless we have compelling legitimate grounds to
continue or if the processing is necessary for the establishment, exercise, or defense
of legal claims.
Direct Marketing: You have the absolute right to object to the processing of your
personal data for direct marketing purposes at any time without providing any specific
reason. If you object, we will stop using your personal data for such purposes
immediately.
To exercise your right to object, please contact us at privacy@convertapi.com. We will
respond to your request within the applicable legal timeframes.
TRANSFER OF PERSONAL DATA OUTSIDE THE EEA
For clients using proper domain (REST API endpoint) configuration in the European
Economic Area (EEA) and for clients in the rest of the world except the United Kingdom
(UK), ConvertAPI will not transfer personal data beyond the EEA without prior written
consent of the Client. Upon receipt of the consent of the Client to transfer the personal data
but before sending that data beyond the EEA, ConvertAPI must enter into a valid personal
data transfer agreement complying with the provisions of Chapter V of Regulation (EU)
2016/679 and/or applicable international law.
For clients in the UK, ConvertAPI will process personal data only within the UK, as detailed
in Appendix 1.
Certain third parties indicated in Appendix 1, namely Cloudflare, Inc., ActiveCampaign, LLC
(Postmark), GitHub, Inc. and Mezmo Inc., are established in the United States, and
personal data may be accessible to or processed by them in the United States. Such
transfers are made on the basis of the European Commission’s adequacy decision for the
EU-US Data Privacy Framework, where the recipient is certified under it, or of the Standard
Contractual Clauses adopted by the European Commission (Article 46(2)(c) of Regulation
(EU) 2016/679), supplemented by additional safeguards where necessary. In respect of
personal data processed on behalf of the Client, the Client authorises such transfers by
engaging the Services, subject to these safeguards. Information on the safeguards applied
may be requested at privacy@convertapi.com.
DATA SECURITY AND DATA BREACH NOTIFICATIONS
ConvertAPI uses and maintains appropriate technical and organizational measures to
ensure the security of personal data processing and to protect personal data from
accidental loss, destruction, damage, theft, alteration, unauthorized disclosure or
unauthorized access, and from any forms of unlawful processing. These measures shall be
appropriate to the harm that might result from any unauthorized or unlawful processing,
accidental loss, destruction, damage, or theft of the personal data and having regard to the
nature of the personal data. Technical and organizational security measures employed are
based on the regular risk assessment, as well as the nature, scope, context, and purposes
of the processing, damage likelihood, and risk severity for the rights and freedoms of the
data subjects.
ConvertAPI shall ensure the reliability and confidentiality obligations of all personnel who
may have access to the processed personal data. Furthermore, ConvertAPI shall ensure
that in each case the access to personal data is strictly limited to those individuals who
need to know or access the relevant personal data, as strictly necessary for the purposes of
the Services, and in compliance with the applicable Data protection laws.
ConvertAPI undertakes to timely perform all obligations under the Data protection law to
assist the Client in case of a personal data breach in order to reduce negative
consequences of such a breach, also to immediately notify the Client about any incident
relating to personal data and unauthorised access to personal data as required by the Data
protection laws.
ConvertAPI ensures that these requirements apply to all third-party sub-processors.
DATA SUBJECT RIGHTS
Data subjects shall have the right to information about personal data that we process.
Where we have reasonable doubts concerning the identity of the person making a request,
we may request additional information necessary to confirm it, such as confirmation from
the e-mail address associated with the user account; we will request only information that is
necessary and proportionate for this purpose. Data subjects also have a right to rectification
or deletion or restriction of processing, as it is applicable under the applicable Data
processing laws. Furthermore, in accordance with legal requirements, data subjects have
the right to object to us against the processing of specific data. Data subjects also have the
right to data portability, as well as the right to lodge a complaint about the processing of
personal data to a competent data protection authority, including the State Data Protection
Inspectorate of the Republic of Lithuania (Valstybinė duomenų apsaugos inspekcija,
https://vdai.lrv.lt). All rights shall be executed in a reasonable and economical way.
Requests are handled free of charge. Where requests are manifestly unfounded or
excessive, in particular because of their repetitive character, ConvertAPI may charge a
reasonable fee or refuse to act on the request, in accordance with Article 12(5) of
Regulation (EU) 2016/679. ConvertAPI will respond to requests without undue delay and in
any event within one (1) month of receipt; this period may be extended by two further
months where necessary, taking into account the complexity and number of requests, in
which case the data subject will be informed of the extension within one (1) month of
receipt.
Right to withdraw consent. Where the processing of personal data is based on consent,
data subjects have the right to withdraw their consent at any time by contacting
privacy@convertapi.com or, in respect of cookies, via the Cookie Declaration in our Cookie
Policy. Withdrawal of consent is as easy as giving it and does not affect the lawfulness of
processing based on consent before its withdrawal.
Rights related to automated decision-making and profiling. ConvertAPI does not make
decisions based solely on automated processing, including profiling, which produce legal
effects concerning data subjects or similarly significantly affect them, within the meaning of
Article 22 of Regulation (EU) 2016/679. Should this change, data subjects will be informed
in advance and will have the right to obtain human intervention, to express their point of
view and to contest the decision. AI models used in the AI Conversions process Documents
solely at the Client's direction to perform the requested conversion, and do not make
decisions concerning data subjects.
CHILDREN’S PERSONAL DATA
ConvertAPI’s Services and Website are intended for business use and are not directed at
children. ConvertAPI does not knowingly collect or process personal data of individuals
under the age of 18 as a data controller. If we become aware that personal data of a person
under the age of 18 has been provided to us, we will delete it promptly. Where Clients
upload Documents for processing, ConvertAPI acts as a data processor and the Client, as
the data controller, remains solely responsible for the lawfulness of processing any personal
data, including personal data of children, contained in such Documents.
DATA PROCESSING AUDIT
ConvertAPI undertakes to provide reasonable disclosures, which would be sufficient for the
Client to perform data processing risk assessment and ensure that personal data
processing by ConvertAPI complies with the requirements of the Data protection laws.
At Client's reasonable written request provided no less than four (4) weeks in advance and
subject to advance payment of reasonable costs, ConvertAPI shall allow the Client to audit
processing of the personal data of the Client. The audit shall be conducted in a way that the
audit would not interfere with normal operation of the Services, Website, ConvertAPI and
other clients of ConvertAPI.
Audits may be initiated by mutual agreement if there are justified causes or if a court or data
protection authorities mandate them. The audit shall be conducted by a competent and
independent auditor whose candidacy must be communicated in advance to ConvertAPI
and allow ConvertAPI to reasonably object to unsuitable candidates.
DATA PROCESSING PERIOD AND TERMINATION OF
PROCESSING
This Privacy Policy is applicable for as long as ConvertAPI processes the personal data of
or on behalf of the Client. We delete all your registration data either within 24 months
following the last usage of the ConvertAPI service, as soon as you delete your user account
with us, or once the statutory retention period expires. Data processing shall be terminated
if there are no legal grounds for processing according to the applicable laws and/or the
Client requests the termination of such processing.
You can delete your user account yourself in your user account or by requesting it in writing.
Upon termination of Services, the data processing may continue in the scope required by
the applicable laws.
Upon termination of the data processing, ConvertAPI shall delete and destroy all
Documents and personal data provided by the Client, except data required according to the
applicable law. ConvertAPI shall ensure that all third-party sub-processors comply with the
data processing termination.
LIABILITY
ConvertAPI's liability for any losses resulting from the breach of the Data protection laws
caused through the fault of ConvertAPI or third-party sub-processors is established
according to the applicable law and in no event shall be greater than 5 (five) times the
aggregate amount paid by the Client to ConvertAPI for Services during the last twelve (12)
months. ConvertAPI liability is limited to direct damages.
In addition, where liability is covered under ConvertAPI’s insurance policy, liability shall
extend to the applicable policy limits, provided such liability is not otherwise excluded by the
terms of the Master service agreement or this policy.
DISPUTES
Any disputes resulting from data protection matters shall be settled in the Republic of
Lithuania courts. The parties shall seek complete confidentiality of the information about
applying to a court, information about a process of examination of a case, and a judgement
confidential. Laws of the Republic of Lithuania shall apply.
CONTACT INFO AND COMMUNICATION
Data processing is done by ConvertAPI, UAB, a company registered in the Republic of
Lithuania, address Lauksargio g. 111, Vilnius LT-10105, Lithuania, company code
304461332.
For all further inquiries about personal data processing by ConvertAPI, please contact
ConvertAPI DPO at privacy@convertapi.com.
Appendix No 1
1. Personal data related to contract management (where we act as data controllers):
Personal data is
transferred to
To manage contracts with Clients while providing Services by
ConvertAPI for the
ConvertAPI
following
purposes:
Contract-related Personal Data may include personal contact
Categories of information such as full name, phone number, and email address;
personal data being details including employer name, job title and function, and
transferred: business contact details; payment card-related data; IP
addresses; and interest data.
Data subjects may include Client representatives and end users,
Categories of data
such as employees, contractors, collaborators, partners, and
subjects:
Clients.
Personal data
processing Data deletion, storage, systematization, analysis, transfer, making
operations carried copies. All these operations can be done only to provide Services.
out by ConvertAPI:
1. At ConvertAPI UAB head office in Vilnius, Lithuania.
2. IBM data centers: for customers using the EEA domain
(REST API endpoints) located within EEA; for customers
using the US domain (REST API endpoints) located within
Place of Personal the US; for customers using UK domain (REST API
endpoints) within UK. For specific IBM data center locations
data processing
operations: within each domain, please refer to
https://www.convertapi.com.
3. Business locations of the third parties indicated below, within
the EEA or, where described in the section “Transfer of
Personal Data Outside the EEA”, in the United States.
1. access to Personal Data is restricted, controlled and
recorded;
2. access to personal data has been allowed to only those
employees, who require the personal data to perform their
functions and only to the extent required to perform their
functions.
Technical and 3. access of unauthorized persons to premises where the
organizational personal data have been stored is strictly restricted;
measures for 4. upon expiry of the personal data storage period, secure
storage of personal destruction of the personal data is ensured;
5. persons, having access to the personal data, use at a
data:
minimum password of at least 10 characters long and
containing uppercase letters, lowercase letters and digits
and passwords are changed at least every year or if
compromise is suspected.
6. only encrypted communication channels are utilized to
transfer personal data.
Third Parties: 1. IBM Cloud Services, as Personal Data could be stored
encrypted at IBM Cloud Services data centres, so IBM
engineers can impact physical security and availability of
physical equipment and computer networks.
2. Google Ireland Ltd. provides email and the support mailbox
for ConvertAPI (Google Workspace), where personal data
can be processed through e-mail communication with the
client and the resolution of client requests.
3. Paddle.com - payment processor.
4. Mezmo Inc. is used for operational log storage, analysis, and
alerts.
5. Cloudflare, Inc. provides DNS, content delivery, web
application firewall and DDoS protection for the Website and
Services, so IP addresses and request metadata pass
through its network.
6. Postmark (ActiveCampaign, LLC) sends ConvertAPI's
transactional e-mail (account, billing and support
notifications), so recipient e-mail addresses and message
content are processed.
7. GitHub, Inc. hosts ConvertAPI's support case records, so
client contact details and the content of support requests are
processed.
8. OpenAI Ireland Limited provides AI-generated instant
answers on ConvertAPI’s support page, so the content of
questions submitted by Website visitors is processed.
2. Personal data processed during Document conversion (where we act as data
processors):
Personal data is
transferred to
ConvertAPI for To provide Services by ConvertAPI to the Client.
the following
purposes:
While using the ConvertAPI service, the Client may upload
Documents containing Personal Data, which are processed using
automated methods, and no persistent storage is utilized.
Categories of ConvertAPI does not access the contents of Documents while
personal data Document is processed so in this case categories to be maintained
being transferred: by Client, and Personal Data may include personal contact
information such as full name, phone number, email address; details
including employer name, job title and function, business contact
details; IP addresses and interest data.
Categories of data Data subjects may include Client representatives and end users,
subjects: such as employees, contractors, collaborators, partners, Clients.
Personal data Data deletion, storage, systematization, analysis, transfer, making
processing copies. All these operations can be done only to provide services.
operations carried
out by
ConvertAPI:
IBM data centres: for customers using EEA domain (REST API
endpoints): located within EEA; for customers using US domain
(REST API endpoints) located within US; for customers using UK
Place of Personal
domain (REST API endpoint) within UK. For specific IBM data
data processing
centre locations within each domain, please refer to
operations:
https://www.convertapi.com/. For the AI Conversions, the
Document, or content extracted from it, is additionally processed by
the AI sub-processor indicated below.
1. access to Personal Data is restricted, controlled and recorded;
2. access to personal data has been allowed to only those
employees, who require the personal data to perform their
functions and only to the extent required to perform their
functions.
3. access of unauthorized persons to premises where the
Technical and personal data have been stored is strictly restricted;
organizational 4. upon expiry of the personal data storage period, secure
measures for destruction of the personal data is ensured;
storage of 5. persons, having access to the personal data, use at a
minimum password of at least 10 characters long and
personal data:
containing uppercase letters, lowercase letters and digits and
passwords are changed at least every year or if compromise
is suspected.
6. only encrypted communication channels are utilized during the
transfer of personal data.
7. personal data is encrypted while (if) stored;
Third Parties: 1. IBM Cloud Services, as Personal Data could be stored
encrypted (non-persistent, only temporarily storage up to 3
hours, depending on configuration used by Client) at IBM
Cloud Services data centres, IBM engineers can impact
physical security and availability of physical equipment and
computer networks but not access Personal Data, during
processing or short-term storage (if applicable).
2. Cloudflare, Inc. provides network security (web application
firewall, DDoS protection) and traffic routing in front of the
REST API endpoints, so Documents pass through its network
in transit.
3. GitHub is used for application source code repositories.
4. Mezmo Inc. is used to store operational logs, analyses, and
alerts.
5. OpenAI Ireland Limited provides the AI models used only for
the AI Conversions (as listed in the section “Categories of
Personal Data That Are Processed”). For these conversions,
the Document, or content extracted from it, is sent to OpenAI
Ireland Limited solely to perform the conversion requested by
the Client. No data from any other conversion is sent to
OpenAI Ireland Limited.
Appendix No 2 – List of Sub-processors
ConvertAPI engages the following sub-processors. “Part 1” refers to personal data related
to contract management, where ConvertAPI acts as data controller, and “Part 2” to personal
data processed during Document conversion, where ConvertAPI acts as data processor, as
described in Appendix No 1. Changes to this list are communicated in accordance with the
section “Third-Party Sub-processors”.
Sub-processor Location and
Service / Personal data Processing
(country of transfer
purpose concerned context
establishment) safeguards
IBM data
centres in the
EEA, US or
UK, according
User account data;
to the REST
Hosting of the Documents
API endpoint
Website and (encrypted,
IBM Cloud Parts 1 and domain
Services transient:
Services 2 selected by
infrastructure processed in
the Client. For
(data centres). memory or stored
EEA
for up to 3 hours).
endpoints,
IBM hosting
stays within
the EEA.
Global
DNS, content
network. EU-
delivery, web
US Data
application IP addresses and
Privacy
Cloudflare, Inc. firewall, DDoS request metadata; Parts 1 and
Framework
(USA) protection and Documents in 2
and/or
traffic routing transit only.
Standard
for the Website
Contractual
and Services.
Clauses.
Google Ireland E-mail and Contact details; Part 1 EU entity.
Ltd. (Ireland) support content of e-mail Onward
mailbox and support transfers
(Google communications. governed by
Workspace). the provider’s
data
processing
terms
(Standard
Contractual
Clauses).
EU entity.
Onward
Billing and
transfers
Paddle Payment payment data.
governed by
Payments processing Payment card data Part 1
the provider’s
Limited (Ireland) (Paddle.com). is processed solely
data
by Paddle.
processing
terms.
Log data is
stored in the
Operational log United States.
Operational log data about EU-US Data
Mezmo Inc. storage, conversions: date Parts 1 and Privacy
(LogDNA) (USA) analysis and and time, duration, 2 Framework
alerts. conversion type and/or
and account ID. Standard
Contractual
Clauses.
EU-US Data
Transactional Privacy
Recipient e-mail
ActiveCampaign, e-mail Framework
addresses; content
LLC – Postmark (account, billing Part 1 and/or
of transactional e-
(USA) and support Standard
mails.
notifications). Contractual
Clauses.
EU-US Data
Support case Privacy
Client contact
records; Framework
GitHub, Inc. details; content of Parts 1 and
application and/or
(USA) support requests. 2
source code Standard
No Documents.
repositories. Contractual
Clauses.
OpenAI Ireland AI models for Documents or Parts 1 and EU entity.
Limited (Ireland) the AI content extracted 2 Onward
Conversions from them (AI transfers
and for AI- Conversions only); governed by
generated questions the provider’s
instant answers submitted on the data
on the support support page. Not processing
page. used to train or terms
improve AI models. (Standard
Contractual
Clauses).