Last updated: May 15, 2026
GDPR and processing information
This page summarizes privacy and processing arrangements. Final copy follows after legal review.
Roles
The customer is usually the data controller. DeepCraft may act as processor for customer data processed through AI assistants.
Data processing agreement
A GDPR-compliant data processing agreement is available by default for projects that process customer data.
Sub-processors
Hosting, analytics, calendar, and communication tools may be used as sub-processors after alignment with the customer.
Location and transfers
Where possible, we use EU hosting in Frankfurt or Amsterdam. Any transfer outside the EEA is contractually safeguarded.
Security
Access is limited to what is needed. Data is protected with technical and organizational measures appropriate to the project scope.
Export and deletion
Customer data is exportable or deletable on request, within practical and legal limits.