LEGAL · GDPR PACK v1.1
Data Processing Agreement
Last updated: 23 October 2026
When we build or run agents and automations for your store, we act as your processor under Art. 28 GDPR. This page summarises the DPA we sign with every client; the signed version is sent with your proposal. Request it at hello@quietstack-team.com.
1. Parties
Processor: SankPower SIA (Riga, Latvia, EU), operating as Quietstack Automation. Controller: the client named in the proposal.
2. Processing
- Subject matter: customer-support automation and back-office workflows for your store.
- Data categories: customer names, contact details, order references and support messages you route to the agent.
- Processing only on your documented instructions; no use of your data to train models.
3. Security & retention
- Least-privilege access, NDA before any access, credentials held in the client's own systems where possible.
- Public demo: zero conversation body storage. Technical event logs: 30-day retention.
- Client data deleted or returned at the end of the engagement, at your choice.
- Personal data breaches notified to you without undue delay.
4. Sub-processors
Current sub-processors. We notify clients before adding or replacing one, with a right to object.
| SUB-PROCESSOR | PURPOSE | LOCATION | TRANSFER BASIS |
|---|---|---|---|
| Vercel Inc. | Website hosting, serverless functions, technical event logs | USA / EU edge | Provider DPA (SCCs) |
| Notion Labs, Inc. | Lead record storage (store URL, email, stated pain point) | USA | Provider DPA (SCCs) |
| LLM API provider (Anthropic) | Generating sandbox demo answers; message processed transiently | USA | Provider DPA (SCCs) |
| Telegram (Telegram Messenger Inc.) | Internal notification of new demo requests to our team | Global | Provider terms |
| Upstash, Inc. | Rate-limit and duplicate-ticket counters (hashed keys, no message content) | Region chosen at setup | Provider DPA (SCCs) |
Client projects may add your own systems (e.g. Shopify, your helpdesk, your n8n instance) — those are listed per project in the signed DPA.
5. Audits & assistance
We assist with data subject requests, DPIAs and audits as required by Art. 28(3) GDPR, and provide the information needed to demonstrate compliance.