Data Processing Addendum

This Addendum applies where VPS Snaps processes personal data on your behalf in the course of providing the Service, and forms part of the Terms of Service.

For that data you are the controller and VPS Snaps is the processor. Where we process data about you as our own customer — your account record, your billing history — we act as controller, and our Privacy Policy governs that instead.

The subject matter is the provision of automated backup orchestration. Processing lasts for as long as your account is open, plus the deletion period in section 8.

The purpose is limited to operating the Service: scheduling and running backup jobs, connecting to the providers and storage destinations you configure, notifying you of outcomes, and enforcing the limits of your plan. We do not process your data for any other purpose, and we do not sell it.

Data subjects are you and any colleagues you invite into your workspace. The categories processed are:

• Account data — email address, name, hashed password, two-factor settings
• Connection credentials — provider API tokens, OAuth grants and SSH keys, encrypted at rest
• Infrastructure metadata — server names, IP addresses, region and storage bucket names
• Backup metadata — job names, schedules, run status, timestamps and archive sizes
• Billing data — subscription status and plan. Card details are handled by Stripe and never reach our systems

Backups take one of two paths, and the difference matters, so both are set out here rather than described in general terms.

• Backups we never receive. Provider snapshots, and backups of servers you control — over SSH, through an agent, or through the WordPress plugin — are written directly from your infrastructure to storage you own. The contents never reach our systems at any point, and we hold only metadata describing the backup: when it ran, whether it succeeded, how large it was.
• Backups that stream through us. Managed hosting platforms give you a database but no server to run anything on. For those, the export runs on our infrastructure and is streamed to your storage as it is produced. It is never written to disk here and never retained — but it does pass through, and while it does we are processing whatever it contains.

Where a backup takes the first path and contains personal data, VPS Snaps is not a processor of that data. Where it takes the second, we are, for the duration of the transfer only.

Which path a backup job takes is shown on the job itself, and follows from what is being backed up rather than from any setting.

We process personal data only on your documented instructions, which are given through your configuration of the Service and through this Addendum, except where law requires otherwise — in which case we will tell you before processing, unless that law forbids it.

Everyone with access to personal data is bound by confidentiality. We maintain technical and organisational measures appropriate to the risk, described in full on the Security page, including AES-256-GCM encryption of credentials at rest, bcrypt password hashing, TLS in transit, optional two-factor authentication, and workspace-scoped access control.

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own notification obligations.

You authorise the subprocessors below. Each is bound by data protection terms no less protective than this Addendum.

The providers and storage destinations you connect — DigitalOcean, Hetzner, Vultr, Linode, AWS, Google Cloud and any S3-compatible storage — are not our subprocessors. You hold those relationships directly; we act on them using the credentials you supply.

We will give notice before adding or replacing a subprocessor, and you may object on reasonable data protection grounds.

You can export your data and delete your account at any time from the dashboard. On termination we delete personal data within 30 days, except where law requires us to keep it — billing records, for example, carry statutory retention periods.

Deleting your VPS Snaps account does not touch backups already written to your own storage. Those remain entirely yours and are unaffected.

Taking into account the nature of the processing, we will assist you in responding to requests to exercise rights of access, rectification, erasure, restriction, portability and objection, and in meeting your obligations on security, breach notification and impact assessments. Most requests can be satisfied directly from the dashboard; for anything else, contact us.

Personal data is stored in the United States, and the subprocessors above are predominantly US-based. Where data is transferred out of the EEA or UK, that transfer relies on the European Commission's Standard Contractual Clauses, incorporated into this Addendum by reference, together with the UK Addendum where the UK GDPR applies.

On reasonable written notice, and no more than once a year unless a regulator requires otherwise, we will make available the information necessary to demonstrate compliance with this Addendum. We do not currently hold a SOC 2 or ISO 27001 report; we say so plainly on the Security page rather than leave it to be discovered during procurement.

This Addendum takes effect on your acceptance of the Terms of Service and needs no separate signature. If your procurement process requires a countersigned copy, email [email protected] and we will arrange it.