Data processing agreement

This agreement applies when a business uses dododonedone and personal data ends up in its workspace. It is part of the terms of service and follows article 28 of the GDPR.

1. Parties and roles

The customer that owns the workspace is the data controller. Uneven Bits ApS, Denmark (CVR 30487842), is the data processor.

2. What the processing covers

• Purpose: providing dododonedone: storing, syncing and showing the workspace, sending reminders, notifications and digests, running the MCP server, support and backups.
• Duration: as long as the customer has a workspace with us, and until the data has been deleted afterwards.
• Personal data: names and email addresses of members and guests, and whatever personal data the customer puts in tasks, comments and attachments.
• Data subjects: the customer's members and guests, and people mentioned in the workspace's content.

3. Instructions and confidentiality

We process the data only on the customer's documented instructions, which are these terms and the way the customer uses the product. Everyone at Uneven Bits with access to the data is bound by confidentiality.

4. Security

• All traffic is encrypted with TLS.
• Passwords and access tokens are stored as hashes; OAuth tokens are scoped to one workspace and can be revoked.
• Attachments are kept in a private bucket under random names and served only through signed, expiring links.
• Every write is checked against the member’s role and project access before anything happens.
• The database is backed up every night; access to production is limited to the people who run it.

5. Sub-processors

The customer authorises the sub-processors listed in the privacy policy: Contabo (hosting, Lauterbourg, France), Hetzner (hosting instead of or alongside Contabo, EU data centres only), Cloudflare (DNS and R2 storage), Stripe (payments), Brevo (email, France) and Sentry (error reports). We will tell the customer before adding or replacing one, and the customer may object.

6. Transfers outside the EU

Where a sub-processor handles data outside the EU or EEA, the transfer relies on the EU-US Data Privacy Framework or the EU standard contractual clauses.

7. Assistance

We help the customer answer requests from data subjects, mostly through the product's own export and deletion, and with security, impact assessments and prior consultation where that is relevant to our part.

8. Personal data breaches

We notify the customer without undue delay after becoming aware of a breach that affects its data, with what we know and what we are doing about it.

9. At the end

The customer can export everything at any time. When the workspace is deleted, we delete the data from the live database and from backups as they expire, unless the law requires us to keep it.

10. Documentation and audits

We make the information needed to show compliance with this agreement available on request, and allow for reasonable audits at the customer’s cost.