Data Processing Agreement

01Roles and scope

For personal data that your app's users entrust to your app ("Customer Data"): you are the controller, Gemmein Ltd is the processor. This DPA governs all processing of Customer Data by Gemmein on your behalf.

(For your own account data, Gemmein is the controller and the Privacy Policy applies instead.)

In plain English: your users' data is yours; we only ever handle it to run your backend, on your instructions, under this contract.

02Details of processing

• Subject matter & duration: provision of authentication and storage services for your apps, for the life of your account plus the deletion window.
• Nature & purpose: storing, retrieving, and deleting records; authenticating users and managing their sessions; recording sign-in security data; holding events sent to a paused app for up to 30 days; producing audit logs; enforcing the storage rules you configure.
• Data subjects: end users of your apps.
• Categories of data: whatever your app stores — typically email addresses, user-generated content, and app records. You must not store special-category data (health, biometrics, etc.) or payment card numbers in collections without our prior written agreement.
• Sign-in security data (generated by the Service): for each signed-in device, a browser and operating-system label, approximate country, the sign-in IP address, and the most recent IP address seen on that session (one value, replaced as the session is used); and the full IP address recorded in event records for Security Events — sign-in code requests and verifications, session creation, sign-outs, refused, rate-limited or suspended-account attempts, step-up checks, export and erasure requests, and checkout initiation. Event records do not capture IP addresses on ordinary data reads or writes.
• Retention of sign-in security data: IP addresses in event records are deleted automatically 30 days after collection. The signed-in device record, including both IP addresses, is deleted when the session ends; a device IP address is removed sooner if it is 30 days old (sign-in IP) or has not been refreshed for 30 days (most recent IP). Event records, including the device label and approximate country kept on sign-in events, follow the audit-log schedule without IP addresses (90 days live, 12 months archived). A user's sign-in security data is included in user exports and deleted when that user is erased.
• Events held for a paused app: events from your Stripe account and your relays that arrive while Live is paused. We keep only what is needed to deliver them on resume — where possible the event ID, with details re-fetched from Stripe when Live resumes — and hold them for up to 30 days. Held events are deleted once delivered or after 30 days, whichever is first, and any held event relating to a user is purged or redacted when that user is erased.

03Our commitments as processor

Gemmein will:

1. process Customer Data only on your documented instructions — given through the APIs, SDKs, and dashboard — and never for our own purposes, except for platform security as set out in Section 3A;
2. ensure everyone with access is bound by confidentiality;
3. maintain the security measures in Annex A, and not degrade them during your subscription;
4. use subprocessors only of the kinds listed in our Privacy Policy, remain fully liable for them, provide the named list on request at legal@gemmein.com, and give 30 days' email notice before adding or replacing one (you may terminate if you reasonably object);
5. assist you with data-subject rights — the platform's APIs (including user account deletion and record export) exist so that access, deletion, and portability requests can be honoured by your app directly;
6. notify you of a personal data breach affecting Customer Data without undue delay after becoming aware (target: within 72 hours), with the information needed for your own regulatory notifications;
7. when your account ends, other than by you deleting it, keep Customer Data available for you to export for 30 days (and during any notice period before that), then delete it within a further 30 days, with encrypted backups ageing out within 7 days after that, unless the law requires us to keep it. If you delete your account yourself, deletion starts straight away and completes within 30 days, with backups ageing out within a further 7 days;
8. make available information reasonably necessary to demonstrate compliance — including our security architecture documentation and our infrastructure provider's independent certifications (such as SOC 2 reports) — and allow audits where GDPR requires, at your cost and on reasonable notice.
9. assist you, taking into account the nature of the processing, with data protection impact assessments and any prior consultation with a supervisory authority;
10. if Live is paused because your subscription has ended or a payment has failed, continue to store Customer Data, keep it secure under Annex A, and let you view, export and delete it through the dashboard and APIs, so you can respond to your users' requests. A pause does not start the deletion period in item 7.
11. tell you promptly if, in our opinion, an instruction from you infringes data protection law.

3APlatform security

To protect the Service and all its customers, Gemmein also processes the IP addresses and related request data of traffic to the Service, including your users' requests and the sign-in security data in Section 2. It uses this data for firewalling, rate limiting, and detecting, investigating and stopping attacks, fraud and abuse. For this limited purpose only, Gemmein acts as an independent controller, relying on its legitimate interest in the security of the Service (UK/EU GDPR Article 6(1)(f)). It uses this data for no other purpose — never for profiling, advertising or analytics — keeps it hashed, masked or short-lived wherever possible, and sets out retention in its Privacy Policy.

04International transfers

Customer Data is processed in the United States, on the infrastructure of a leading cloud infrastructure provider. Transfers from the EU to us in the UK rely on the EU's adequacy decision for the UK. Onward transfers to our subprocessors in the United States rely on their certification under the EU-US Data Privacy Framework and its UK Extension (UK-US Data Bridge), supplemented where required by the EU Standard Contractual Clauses (Module 3: processor to processor) and the UK Addendum, which are incorporated by reference. Encryption in transit and at rest applies regardless of mechanism.

05Your commitments as controller

You warrant that you have a lawful basis for the Customer Data your app collects and the processing you instruct (including the sign-in security data in Section 2), that you have given your users any information the law requires about it, that your instructions are lawful, and that you will not direct us to process data prohibited by Section 2 or the Terms. How you use sign-in security data is your decision as controller.

06Liability

Liability under this DPA is subject to the limitations and carve-outs in the Terms of Service.

ASecurity measures (summary)

Full detail is maintained in Gemmein's Security Architecture documentation. Measures include, as of the date above:

• Encryption: TLS 1.3 in transit; AES-256 at rest (database, storage, backups); database SSL with CA validation inside the private network.
• Tenant isolation: every query scoped to app and environment at the SQL layer; cross-tenant access is structurally impossible, not policy-dependent.
• Access control: collection rules enforced server-side by a dedicated rules engine; server-decided identity (owner/role fields cannot be set by clients); secret keys scoped to named collections; management endpoints gated by owner/admin session.
• Network: no public IPs on compute or database; ingress restricted to the edge network; web application firewall with managed and custom rules and per-IP rate limits.
• Authentication: passwordless email codes (cryptographically random, stored hashed, 3 attempts, 10-minute expiry); strong random session tokens stored only as hashes; constant-time comparisons.
• Containers: non-root, read-only filesystem, all capabilities dropped, immutable images, scan-on-push.
• Monitoring: audit logging of auth, storage, and management events; client IP addresses recorded in event records on security events only, plus one overwritten last-seen IP per active session, all deleted within 30 days; automated alarms; log retention 90 days live / 12 months archived.
• Personnel: access limited to Gemmein's operating personnel under confidentiality; least-privilege IAM per role.
• Resilience: automated encrypted backups (7-day cycle); deletion protection on the database.

In plain English: the same security page we publish is the security annex we sign. One set of claims, contractual and marketing alike.