Data Processing Agreement
How StorBrain processes personal data on behalf of business customers.
Table of Contents
Definitions
- Controller — You (the business entity) that determines purposes of processing
- Processor — StorBrain, processing data on your behalf
- Personal Data — Information relating to an identifiable person
- Data Subject — The individual whose data is processed (your employees, customers)
- Processing — Any operation on personal data
- Sub-Processor — Third party engaged by StorBrain to process data
Roles & Responsibilities
You Are the Controller
You are responsible for having a lawful basis for processing, providing required privacy notices to data subjects, and complying with applicable privacy laws.
StorBrain Is the Processor
We process data only on your instructions, implement appropriate security measures, assist with data subject rights requests, notify you of breaches, and delete data upon termination.
Data Processed
| Category | Data Types | Purpose | Retention |
|---|---|---|---|
| Employee Data | Names, contact, hours, wages, roles | Workforce management | 30 days post-cancellation |
| Customer Data | Names, purchase history, loyalty points | Loyalty program | 30 days post-cancellation |
| Financial Data | Sales, expenses, revenue | Analytics & reporting | 30 days post-cancellation |
| Usage Data | IP addresses, session data | Security & improvement | 90 days |
Security Measures
- TLS 1.2+ encryption in transit, AES-256 at rest
- Role-based access controls
- Complete company data isolation
- Regular security monitoring
- Incident response procedures
- Regular backups with secure storage
Sub-Processors
| Sub-Processor | Location | Purpose |
|---|---|---|
| Stripe | USA | Payment processing |
| Anthropic | USA | AI processing |
| Vercel | USA | Platform hosting |
| Neon | USA | Database hosting |
| Resend | USA | Email delivery |
We will notify you of sub-processor changes with at least 14 days notice.
Breach Notification
In the event of a personal data breach, StorBrain will notify you within 72 hours, including: nature of the breach, data subjects affected, data records affected, likely consequences, and remediation measures.
Data Deletion
Upon termination, StorBrain will delete all personal data within 30 days unless otherwise required by law. Deletion confirmation available upon request.
International Transfers
StorBrain processes data in the United States. For EEA users, we implement Standard Contractual Clauses (SCCs) for international transfers. Copies available upon request.
📬 Contact Us
StorBrain
14730 Jasper Stream Ct, Houston, TX 77069
Legal: legal@storbrain.com
Support: support@storbrain.com
Billing: billing@storbrain.com