1. Roles
You are the Data Controller; Malwipe is the Data Processor. This DPA is incorporated by reference into your Terms of Service.
2. Sub-processors
- AWS (hosting, EU-Central-1 for EU customers)
- LemonSqueezy (billing, Merchant of Record)
- Anthropic (AI verdict, zero-retention)
- Plausible (privacy-respecting analytics)
3. Data residency
EU customers on Agency plan can pin all data to Frankfurt (eu-central-1). Standard customers are stored in AWS Mumbai (ap-south-1) with EU-adequate SCC transfer safeguards.
4. Data subject rights
Access, rectification, erasure, portability, restriction, and objection are all supported through your dashboard or by email to [email protected].
5. Breach notification
We notify affected customers within 72 hours of discovering any Personal Data breach.