Data processing addendum

Last updated 2 August 2026

A template summary for teams whose procurement needs one on file. A signed DPA is available on Team plans — email legal@shipshot.app.

Roles

You are the controller of any personal data in the screenshots or metadata you upload. We are the processor and act only on your instructions.

Subprocessors

• Supabase — auth, database, storage. US or EU region, your choice on Team plans.
• Anthropic — copy generation. Receives a text description of a screen, never your images.
• Stripe — payments.
• Vercel — hosting and logs.

We give 30 days' notice before adding a subprocessor, and you may object.

Security

• TLS 1.2+ in transit, AES-256 at rest.
• Row-level security on every table, so a project is only readable by its owner.
• Least-privilege access; the service-role key is never exposed to the browser.
• Breach notification without undue delay, and within 72 hours where the GDPR requires it.

Transfers

Where data leaves the EEA or UK, transfers rely on the Standard Contractual Clauses and the UK Addendum.

Deletion

On termination we delete your data within 30 days, except where retention is legally required. Deletion can be triggered earlier from Settings.