数据处理

This Data Processing Agreement is incorporated into the Terms of Service by reference and applies from the moment you create an account. You do not need to request, negotiate, or sign it for it to bind us.

If your procurement process requires an executed copy on your own paper, or a counter-signed version of this text, write to us with the subject line "DPA request". We do not charge for it and we do not gate it behind a sales conversation.

For personal data you place in your database cells, or that we process to provide the service on your instructions, you are the controller and we are the processor. Where we determine our own purposes - billing records, security logging, our own corporate correspondence - we are the controller, and the Privacy Policy governs.

Where we engage another company to help us provide the service, that company is our subprocessor, engaged under terms no less protective than these.

• -Subject matter: provision of managed PostgreSQL database cells and the lifecycle operations around them
• -Duration: for as long as you hold an account, plus the backup retention window of your plan
• -Nature and purpose: hosting, transmission, backup, restoration, migration, and deletion of the data you store
• -Types of personal data: whatever you choose to store - we neither restrict nor inspect the schema
• -Categories of data subject: whichever your application serves - your users, customers, employees, or contacts
• -Controller obligations: yours are to have a lawful basis, to give lawful instructions, and not to place data in the platform that you are not permitted to process

We process your data only on your documented instructions. Using the product is an instruction: creating a cell, running a query, taking a backup, restoring to a point in time, importing from another provider, and deleting a project are all instructions given through the dashboard, the API, the CLI, or the MCP server.

If we are required by EU or member-state law to process beyond your instructions, we will tell you first unless that law forbids it. If we believe an instruction infringes data-protection law, we will say so rather than execute it quietly.

Everyone with access to production is bound by confidentiality obligations that survive their engagement, and access is granted on need rather than by role seniority. Operator access to a cell's contents is logged and happens only for support you requested or for an incident that cannot be resolved otherwise.

We implement technical and organizational measures appropriate to the risk, described in full on the Security page, which forms part of these terms. In summary: one isolated cell per project with its own process, storage, credentials, and resource limits; no network egress from standard cells; encryption in transit and at rest; credential relay that never holds your password; API keys stored only as hashes; continuous off-node backup with verified restores; and least-privilege, logged operator access.

Measures may change as the platform evolves, but not in a way that materially reduces the level of protection.

If we become aware of a personal data breach affecting your data, we will notify you without undue delay and in any event within 48 hours of becoming aware, with what we know at the time: the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the measures taken or proposed.

We will assist you with your own notification obligations to supervisory authorities and to data subjects, and we will not delay telling you in order to complete our investigation first.

You give general authorization for us to engage subprocessors. The categories currently engaged are published, and the named list is available on request. We give at least 30 days' notice of a new or replacement subprocessor to anyone on the change list, and you may object on reasonable data-protection grounds - see Subprocessors.

We remain fully liable to you for the performance of each subprocessor's obligations.

• -Data subject requests: the dashboard, the CLI, and standard SQL give you direct access to everything in your cells, which is usually faster than asking us. Where a request needs us, we help.
• -Security, breach notification, and impact assessments: we provide the information you reasonably need to meet Articles 32 to 36, taking into account the nature of processing and what is available to us.
• -Records of processing: the categories, locations, and transfer mechanisms on this page and on Subprocessors are written to be pasted into your Article 30 record.

You can export your data at any time, without asking us, for as long as your account exists - see Data portability and exit. On termination, cells are destroyed and their backup copies age out of the archive on the retention schedule of your plan.

We will delete or return data on your written request at the end of the service, except where EU or member-state law requires us to keep it.

We make available the information needed to demonstrate compliance with Article 28 and will answer a security questionnaire from a customer or their assessor. We do not currently hold a SOC 2 or ISO 27001 certification, and we do not claim one.

On-site audits are available on reasonable notice, no more than once a year unless an incident or a supervisory authority requires otherwise, conducted so as not to disrupt other tenants, and at the requesting party's cost.

Database cells and their backups stay in the European Union. Where a subprocessor transfers personal data outside the EEA, the transfer relies on an adequacy decision where one applies, and otherwise on the European Commission's Standard Contractual Clauses, which are incorporated here by reference with CapyDB as data importer or exporter as appropriate, together with the supplementary measures identified in a transfer risk assessment.