Data Processing Agreement
This Data Processing Agreement (“DPA”) forms part of the Sinqlo Terms of Use between iFRAME OE, Kristalli 1, 45221 Ioannina, Greece (VAT EL997861806, “Sinqlo”, “we”) and the customer who uses the Service (“you”). It applies when we process personal data on your behalf under Article 28 of the GDPR. By accepting the Terms of Use, you accept this DPA.
1. Roles
For personal data you put into Sinqlo about other people, you are the controller and we are your processor. Examples are teammates you invite, people you share brand kits with, and names or contact details in your notes and files. For your own account and billing data, we are the controller, as described in our Privacy Policy.
2. Our obligations
We will:
- process personal data only on your documented instructions, which are these Terms, this DPA and your use of the Service’s features, unless EU or Greek law requires otherwise. If so, we’ll tell you first unless the law forbids it;
- make sure everyone who processes the data is bound by confidentiality;
- apply the security measures in section 3;
- use subprocessors only as set out in section 4;
- help you respond to data subject requests, mainly through the Service’s own tools (editing, export, deletion), and otherwise by email;
- help you with security, breach notification, impact assessments and consultations with authorities, taking into account the nature of the processing;
- delete personal data when you delete it or delete your account (see section 6);
- give you the information you need to show compliance with Article 28 and allow audits as set out in section 7.
3. Security measures
- Encryption in transit (HTTPS/TLS) and at rest.
- Database access rules that keep each account’s data separate.
- API keys stored only in hashed form; read-only access for AI tools (MCP).
- Rate limiting, bot protection and security logging (logs kept 90 days).
- Automatic database backups, overwritten after 7 days.
- Production access limited to authorised staff only.
4. Subprocessors
You authorise us to use these subprocessors:
| Subprocessor | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, file storage, authentication, server functions | EU (Stockholm, Sweden) |
| Vercel Inc. | Hosting of the web app | USA / global edge network |
| Resend Inc. | Delivery of share emails and team invitations | USA |
We’ll announce new or replacement subprocessors by updating this page and emailing account owners at least 30 days in advance. If you object on reasonable data protection grounds, you can end your subscription before the change takes effect and get a refund for the unused period. Each subprocessor is bound by data protection terms at least as protective as this DPA.
Connectors you turn on yourself, such as Notion, Slack, Google Drive, Figma or AI tools connected with an API key, are not our subprocessors. They receive data on your instruction, under their own terms.
5. International transfers
Where a subprocessor processes personal data outside the European Economic Area, the transfer relies on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
6. Deletion
When you delete content or your account, we delete the personal data straight away. Backups are overwritten within 7 days. You can export your logos at any time before deleting your account.
7. Audits
On written request, we’ll answer reasonable security and compliance questionnaires. If that isn’t enough to show compliance, you may audit us once a year. You need to give us 30 days’ notice, cover the cost of the audit, and keep everything you learn confidential.
8. Personal data breaches
We’ll notify you without undue delay, and within 72 hours, after becoming aware of a breach affecting your personal data. We’ll include what we know about its nature, likely consequences and the measures taken, and update you as we learn more.
9. Liability and order of precedence
Liability under this DPA follows the Terms of Use. If this DPA and the Terms conflict on data protection, this DPA prevails.
Annex: Details of processing
- Subject matter and duration: providing the Service, for as long as your account exists.
- Nature and purpose: storing, organising, displaying, sharing and delivering brand assets.
- Data subjects: your teammates, your clients and their staff, and the people you share with.
- Personal data: names, email addresses, and any personal data you include in files, notes or brand guidelines.
- Special categories: none expected. Don’t upload them.
Questions or requests: info@sinqlo.com