# GDPR and your data (/docs/security/gdpr)

Your databases hold your customers' personal data. For that data you are the **controller** and backupd is your **processor**: it only dumps, encrypts, stores, tests and restores it, on your schedule and your instructions. For your own account (name, email, sign-ins, billing) backupd is the controller. The [privacy policy](https://backupd.dev/privacy) covers both.

## Where data is processed [#where-data-is-processed]

- **The app, the API, its database, the backup workers and the restore-test sandboxes** run on Oracle Cloud in Frankfurt, Germany.
- **Backups** are stored on Backblaze B2 in the region your workspace picks: **EU Central** (Amsterdam), **US East** or **US West**.

### Keep backups in the EU [#keep-backups-in-the-eu]

Pick **EU Central** for the workspace's storage when you create it. Backups are then stored in the EU, and with the workers and sandboxes in Frankfurt they never leave it. See [Storage](/docs/storage) for how regions work.

## Sub-processors [#sub-processors]

| Provider | What for | Where |
| --- | --- | --- |
| Oracle Cloud Infrastructure | Hosting: app, API, database, workers, sandboxes | Frankfurt, Germany |
| Backblaze B2 | Encrypted backups | The region you pick |
| Cloudflare | DNS, TLS and network protection | Global network |
| Polar | Payments and invoices, as merchant of record (independent controller) | See Polar's privacy policy |
| Resend | Alerts, invitations and security emails | United States |
| PostHog | Product analytics and session replays, only after you accept | United States |
| Zoho Mail | Our support, sales and privacy mailboxes | United States |
| Have I Been Pwned | Checks new passwords against known breaches (only a 5-character hash prefix is sent) | Global |

Transfers outside the EEA rely on the EU–US Data Privacy Framework or the Standard Contractual Clauses in each provider's data processing terms. Customers are told before a provider that processes their data is added.

## How long data is kept [#how-long-data-is-kept]

| Data | Kept for |
| --- | --- |
| Backups | Your retention setting, then deleted |
| Deleted backups | 7 days (recoverable), then removed |
| Deleted workspaces | 7 days (recoverable by support), then removed with all backups |
| Uptime checks, notification history | 90 days |
| Audit log | 1 year |
| Sign-in sessions | Until they expire or you sign out |
| Your account | Until you delete it |

### Erasure requests from your customers [#erasure-requests-from-your-customers]

When one of your customers asks you to erase their data, delete it from your database. backupd's copies age out with your retention setting. To remove them sooner, delete the backups that contain them from the **Backups** page.

## Your rights [#your-rights]

- **Correct your profile** in **Settings → Profile**.
- **Delete your account** in **Settings → Profile → Delete account**. If you are the only owner of a workspace, delete the workspace or make someone else an owner first. Your sessions and memberships are removed, and your name and email are removed from the audit logs of workspaces you were in.
- **Download your backups** at any time, encrypted or decrypted.
- **Withdraw analytics consent** with **Cookie settings** at the bottom of backupd.dev, or **Settings → Profile → Analytics** in the app.
- For anything else, including a copy of your account data, write to privacy@backupd.dev. Requests are answered within one month.

## Cookies [#cookies]

- A session cookie keeps you signed in. It is needed for the app to work.
- Your analytics choice is stored in your browser.
- Only if you accept analytics, PostHog stores a random id to count visits and record sessions. Replays mask every form field, and in the app every piece of text.

## Support access [#support-access]

When backupd support signs in as a member of your workspace to help, the session lasts at most an hour and the [audit log](/docs/team/audit-log) records everything done as **backupd support**. backupd's own admin panel requires a fresh two-factor code.

## Breaches [#breaches]

If a breach affects your data, the owners of your workspace are told without undue delay, so you can meet your own duty to report to your supervisory authority within 72 hours.

## Data processing agreement [#data-processing-agreement]

A standard data processing agreement (DPA) is being finalised. Write to privacy@backupd.dev and it will be sent to you as soon as it's ready.