Data Processing Agreement

The Service checks the files and web pages you submit against your brand rules and accessibility standards. In doing so we process:

• Account data: names, email addresses and roles of the people you add to your workspace.
• Customer content: the documents, images, presentations and web pages you upload or point us at, and the findings, scores, screenshots and reports we derive from them. These may incidentally contain personal data of third parties (a name in a brochure, a face in a photograph).
• Usage and audit data: who did what in your workspace and when, kept so you can account for it.

The purpose is the provision of the Service as described in the Terms. We do not process your content for any other purpose, and we do not use it to train AI models.

We process personal data only on your documented instructions. Your instructions are: the Terms, this DPA, your configuration of the Service (which brands, which files, which standards, which team members), and any written instruction you send to support. If we believe an instruction breaks data protection law we will tell you before acting on it.

Everyone we authorise to access your data is bound by a confidentiality obligation. Access to production systems is limited to named individuals, protected by two-factor authentication. Support access to your workspace is time-limited and, like every other privileged action in it, is recorded in the workspace audit log that forms part of your data export. Our commitment that information obtained through the Service is never used by Druff to approach your clients is set out in section 10 of the Terms and applies to everyone we authorise.

We maintain technical and organisational measures appropriate to the risk, described on our Security page. In summary: encryption in transit and at rest; workspace isolation enforced in the application and at the database; two-factor authentication available to every user and required for owners and admins; sandboxed processing of untrusted files and web pages; dependency and vulnerability monitoring; and a configurable retention period for uploaded files.

We use the following sub-processors. Each is bound by a written agreement imposing data protection obligations no less protective than this DPA.

• Supabase — authentication, database and file storage.
• Vercel — application hosting and the processing of reviews and scans.
• Anthropic — AI analysis of the visual layout of submitted files. Content is sent for analysis and not retained for training.
• Adobe (PDF Services) — conversion of PowerPoint files to PDF before analysis. Only .pptx files are sent.
• Resend — transactional email.
• Paddle — billing and subscriptions, as merchant of record (Paddle is an independent controller for payment data).
• Slack — only if you connect a Slack channel, and only the notifications you choose to receive there.
• Sentry — error reporting. Stack traces only; request bodies, cookies and headers are stripped before anything leaves the platform.

Druff’s agency businesses are not a sub-processor and receive no personal data from the Service. We will give you at least 30 days’ notice by email before adding or replacing a sub-processor. If you object on reasonable data-protection grounds and we cannot resolve it, you may terminate the affected part of the Service.

Our sub-processors operate in the United States and the European Union. Where personal data leaves the EEA, the UK or South Africa, the transfer is covered by the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable), or by an adequacy decision, in each case as implemented in the sub-processor’s own terms.

Taking into account the nature of the processing, we will assist you in meeting your own obligations: responding to data-subject requests (access, correction, erasure, portability), security of processing, breach notification, and data protection impact assessments. The Service provides self-serve export and deletion of your workspace so most requests need no assistance at all.

We will notify you without undue delay, and in any case within 72 hours of becoming aware, of any personal data breach affecting your data, with the information we have at that point and updates as we learn more.

You can export your workspace data at any time, and the account owner can delete the workspace at any time; deletion removes your content, findings, reports and team data and the logins of people who belong only to that workspace. Uploaded files are also deleted automatically at the end of the retention period you configure. When the Service ends, the same applies on request, subject only to what the law requires us to keep.

We will make available the information needed to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by you or an auditor mandated by you, on reasonable notice, no more than once a year unless a breach or a supervisory authority requires otherwise.

This DPA lasts as long as we process personal data for you. Where it conflicts with the Terms on a data protection matter, this DPA prevails.