Data Processing Agreement (DPA)
Last updated: 1 July 2026
This DPA forms part of the agreement between the customer (workspace owner, the “Controller”) and Shippp (the “Processor”) and governs Shippp’s processing of personal data on the Controller’s behalf under Art. 28 GDPR.
1. Parties & roles
Processor: Dipatch Bt. — see the Legal Notice.
For workspace content that the Controller and its members create, Shippp acts as Processor and processes personal data only on the Controller’s documented instructions. For account, authentication and billing data, Shippp acts as an independent controller (see the Privacy Notice).
2. Subject-matter, duration, nature & purpose
- Subject-matter: provision of the Shippp design-to-code service.
- Duration: for the term of the subscription plus statutory retention periods.
- Nature & purpose: hosting, storing, transmitting and processing workspace content to provide the Service and its features.
- Types of personal data: account identifiers, names, emails, and any personal data the Controller places in workspace content.
- Categories of data subjects: the Controller’s users, workspace members and their contacts.
3. Processor obligations (Art. 28)
- Process personal data only on the Controller’s documented instructions.
- Ensure persons authorised to process are under a duty of confidentiality.
- Implement appropriate technical and organisational security measures (Art. 32).
- Assist the Controller with data-subject requests and with Arts. 32–36 obligations.
- Notify the Controller without undue delay after becoming aware of a personal-data breach.
- At the Controller’s choice, delete or return personal data at the end of the service, subject to legal retention.
- Make available information necessary to demonstrate compliance and allow audits.
4. Sub-processors
The Controller authorises Shippp to engage the sub-processors listed below. Shippp imposes data-protection obligations on each sub-processor no less protective than this DPA and remains liable for their performance. Shippp will inform the Controller of intended changes and give an opportunity to object.
| Recipient / processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Stripe (Stripe Payments Europe, Ltd.) | Payment processing & subscription billing | Ireland / United States | SCCs / EU-US Data Privacy Framework |
| Neon, Inc. | Managed Postgres database hosting | EU region / United States | SCCs |
| Resend (Plus Five Five, Inc.) | Transactional & marketing email delivery | United States | SCCs |
| Cloudflare, Inc. (PartyKit) | Realtime collaboration infrastructure | United States / global edge | SCCs |
| Cloudflare R2 | Asset / file storage | EU / global | SCCs |
| KBOSS.hu Kft. (e-invoicing provider) | Invoice issuance & Hungarian Tax Authority (NAV) reporting | Hungary (EU) | Within the EU |
| Google Ireland Ltd. (Google Analytics) | Website analytics (consent-gated) | EU / United States | SCCs / EU-US Data Privacy Framework |
| Vercel, Inc. | Application & website hosting | United States / global edge | SCCs / EU-US Data Privacy Framework |
| OpenAI, Anthropic, Google, xAI, DeepSeek, OpenRouter (AI providers, BYOK) | AI-assisted canvas features — receive user/workspace content when AI is used with your own API key | United States (DeepSeek: China) / global | International transfer; under BYOK the controller for the provider relationship may be you (the user) |
Note on AI providers (BYOK): when the Controller or its members use AI features with their own provider API key, workspace content is sent to the selected AI provider (OpenAI, Anthropic, Google, xAI, DeepSeek or OpenRouter). Because this runs on the Controller’s own key/account, the provider relationship’s controller may be the Controller; the Controller is responsible for that provider’s terms and any transfer. If AI egress is disabled, no such processing occurs.
5. International transfers
Where a sub-processor is outside the EEA, transfers rely on an adequacy decision or the Standard Contractual Clauses with supplementary measures, as reflected in the table above.
6. Security, audits, liability
Shippp maintains measures appropriate to the risk (Art. 32). The Controller may request information and audits on reasonable notice. Liability follows the main agreement and applicable law. This DPA prevails over conflicting terms of the main agreement with respect to processing of personal data.