Data processing agreement
Last updated September 30, 2026
Draft: business details (entity, state, email) are still being added.
This agreement is part of the terms of service between Shuttrflow (“processor”) and each studio (“controller”). It covers the personal information of the studio's clients that the studio stores in Shuttrflow.
Roles
The studio decides what client information to collect and why. We process it only to provide Shuttrflow, following the studio's instructions (which are given by how the studio uses Shuttrflow), unless the law requires otherwise.
Confidentiality
Everyone at Shuttrflow who can access client information is bound to keep it confidential and accesses it only when needed (for example, to fix a problem the studio reports).
Security
We maintain the security measures described in our privacy policy, including encryption in transit, separation of each studio's data, strong password rules, rate limiting and short-lived photo links.
Subprocessors
The studio authorizes the providers listed below. We require each to protect the information at least as well as this agreement does, and we'll post changes to this list before they take effect.
| Provider | What they do | Where |
|---|---|---|
| Vercel | Hosts the website and app, and measures page speed (Speed Insights: anonymous, no cookies) | United States |
| Supabase | Database and sign-in (logins, studio records) | United States (Oregon) |
| Cloudflare (R2) | Stores photos, logos and exports | United States / global |
| Stripe | Card and bank payments, Shuttrflow subscriptions, studio payouts | United States |
| Resend | Sends account and client emails | United States |
| Have I Been Pwned | Checks new passwords against known breaches (only the first 5 characters of a one-way hash are sent) | Global |
Breaches
If we become aware of a breach affecting a studio's client information, we'll tell the studio without undue delay (and within 72 hours where possible), with the details we have, and help it meet its own obligations.
Requests from clients
We'll help the studio respond to its clients' requests to access, correct, export or delete their information. The dashboard lets the studio do most of this itself; the full export covers the rest.
When the studio leaves
The studio can export its data at any time. When a studio is deleted, its data is erased 30 days later, except where the law requires us to keep it.
Information and audits
We'll provide the information reasonably needed to show we meet this agreement, such as answers to a security questionnaire.
Where data is processed
Client information is processed mainly in the United States.