Data Processing

Data Processing terms

Last updated: [DATE]

Draft for legal review. This page has not been checked by a lawyer. Everything in [brackets] must be filled in before it is published.

These terms apply when Stitch and Co processes personal information on behalf of your shop, such as your customers’ and staff’s details. They form part of our Terms of Service. [LAWYER TO CHECK AGAINST UK GDPR ARTICLE 28]

Roles

Your shop decides what personal information goes into the apps and why. We process it only to provide Stitch and Co and only on your shop’s instructions.

What we process

Types of information: customer names, contact details and addresses; job, quote and invoice details; photos and attachments; staff details, hours, leave and wages.
Duration: for as long as your shop has a subscription, then [PERIOD].

Sub-processors

Supabase (database, sign-in and file storage; Sydney, Australia region)
Netlify (hosting)
Stripe (payments)
Anthropic (AI processing)
[EMAIL SENDING PROVIDER]

We will tell you before adding a new sub-processor. [NOTICE PERIOD]

Security

Each shop’s records are separated at the database. Wages and the invoice archive are locked to your administrators. Staff see only their own work.

Breaches

We will tell you without undue delay, and within [HOURS], after becoming aware of a personal data breach affecting your shop’s data.

End of service

[RETURN AND DELETION OF DATA]

Contact

[PRIVACY EMAIL]