Updated 29 October 2026

Data processing agreement.

Intended processing scope

For subscriber operations, the merchant determines its subscription purposes and instructions. Durably processes subscription references, renewal and cancellation information, encrypted subscriber addresses, notice content and operational records to provide the merchant's workflow. Separate roles apply to account administration and Durably's own billing.

Data and people concerned

Data subjects include merchant workspace users and subscribers. Data can include email addresses, subscription IDs, amounts and dates, cancellation requests, notice content and provider references. Special-category data is not required for the intended service; do not include it in templates or subscriber imports.

Security currently implemented

The application checks workspace ownership on authenticated routes, encrypts subscriber addresses and manually supplied Stripe keys before database storage, verifies incoming Stripe signatures and checks stored audit-pack fingerprints on retrieval. These controls do not constitute a security certification or replace contractual safeguards.

What must be agreed before production

• Documented processing instructions, scope, roles and duration.
• Confidentiality, security measures, incident assistance and rights-request handling.
• Subprocessor authorisation and change procedures.
• Return/deletion, retention, backups and treatment of existing evidence records.
• Audit/cooperation provisions and international-transfer arrangements covering the Brazilian operator and relevant providers.

The ICO guidance on controller–processor contracts describes the required contract subjects. Applicable transfer arrangements also require assessment; they are not established by choosing a UK hosting region.

Request production onboarding

Contact contato@asppect.com.br to discuss processor terms. No signature or acceptance is collected through this page.

Service providers and subprocessors · Privacy notice