Draft, pending legal review

This document describes how the product actually behaves, but it has not been reviewed by counsel and is not yet a binding agreement. Do not rely on it for compliance purposes.

Data processing addendum

A signed DPA is available for customers who need one for a GDPR, CCPA, or vendor security review. We have not published a self-serve version, because the terms are usually negotiated alongside the master services agreement.

What we can confirm now

  • Role. For crawled content, you are the controller and datamint acts as a processor. For your account data, datamint is the controller.
  • Sub-processors. Hosting, managed Postgres, transactional email, and payment processing. A current list is provided with the DPA, and we give notice before adding a new sub-processor.
  • International transfers. Data is processed in the regions where our sub-processors operate. Standard contractual clauses are available where required.
  • Security. Encryption in transit and at rest, scoped database access, hashed API keys, and short-lived authentication tokens.
  • Data minimisation. PII redaction runs at ingestion — see the privacy policy for specifics.
  • Deletion. Account deletion removes account, session, key, and usage records, and we confirm completion in writing.
  • Breach notification. We notify affected customers without undue delay after becoming aware of a personal data breach.

Requesting one

Email legal@datamint.xyz with your company name, the entity that will sign, and any security questionnaire you need completed. Enterprise agreements include the DPA, a master services agreement with IP indemnification for public data collection, and a signed uptime and success-rate SLA.

Note: the summary above describes our current practices. It is not itself a DPA and creates no contractual obligation. The executed document governs.