Data-processing agreement
The processor terms under which Enova Studio handles a publisher's member and contributor data.
Draft
Draft pending professional review (see the Legal overview). Effective date: to be set at launch. This agreement is part of the terms of service for every publisher; a signed copy is available on request.
Parties and roles
The publisher ("controller") and Enova Studio ("processor"). The processor handles personal data of the controller's site members, contributors and staff only to provide SponsorPass as described in the terms of service and in this site's documentation, and only on the controller's documented instructions, which these terms and the controller's use of the service are.
The data
Member identifiers, email addresses and names; contributors' display names and companies; the staff email addresses Ghost includes in webhook payloads; the contributions themselves; the audit trail of what was done with them. Categories of people: the controller's members and staff. No special categories are intended; the controller must not use the service to collect them.
Duration
For as long as the site is connected, plus the 30 days in which the data is deleted after disconnection, or earlier on the controller's instruction. Backups holding the data expire within 8 weeks of their creation.
The processor's duties
- Process the data only as instructed, and tell the controller if an instruction appears to break the law.
- Keep every person with access bound by confidentiality.
- Apply the security measures below and keep them under review.
- Engage sub-processors only from the list below, tell the controller of changes 30 days in advance by email, and let the controller object by ending the service.
- Help the controller answer people's requests about their data, within five business days of being asked.
- Tell the controller of a personal-data breach affecting the data without undue delay and within 72 hours of becoming aware of it, with what is known, what was done and what the controller may need to do.
- Return or delete the data at the end, as the controller chooses, within 30 days, and confirm deletion.
- Make available what is needed to show compliance, and allow an audit on reasonable notice, at most once a year unless a breach or a regulator requires more.
Security measures
Site credentials are envelope-encrypted with a key held outside the database. Every tenant's rows are isolated by the application and, independently, by the database's row-level security. Connections are encrypted in transit. The operator's access needs a second factor and every action is logged. Backups are encrypted at rest, kept for a limited time and restored for a test every week. Rate limits, body caps and content validation protect the service from abuse. The design and its reasoning are described in the developer documentation.
Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Stripe | Billing of the controller's plan (the controller's own account data, not member data) | United States, European Union |
| Resend | Transactional email to the controller's staff and contributors | United States |
| Cloudflare | DNS, proxying, encrypted backup storage (R2) | Global; backups in a chosen region |
| The hosting provider (Hetzner at launch) | Running the service and its database | European Union |
Transfers outside the European Economic Area rely on the European Commission's standard contractual clauses where they apply.
Liability and law
The liability provisions and the governing law of the terms of service apply to this agreement.