Data Processing Addendum

Roles

For the personal data inside your projects — subscriber addresses you collect, names appearing in release material — you are the controller and SCRIVT LIMITED is the processor. This addendum forms part of the Terms of Service for every business customer, no signature ceremony required; countersigned copies are available on request at privacy@logg.sh.

Our commitments as processor

• process personal data only on your documented instructions — running the service is the standing instruction
• encrypt third-party credentials at rest and all traffic in transit
• restrict access to personnel bound by confidentiality
• engage only the listed subprocessors, and give notice before adding one so you can object
• assist with data-subject requests and, where required, breach notification without undue delay
• delete or return personal data at the end of the relationship — account deletion does this immediately, with backups aging out inside 30 days

Transfers

Production data lives in London, United Kingdom. Where a subprocessor processes data outside the UK/EEA, transfers rest on adequacy decisions or standard contractual clauses.

Audit

We answer reasonable written security questionnaires and make available the information necessary to demonstrate compliance with this addendum.