Data Processing Agreement

1. Parties

This Data Processing Agreement ("DPA") is entered into between the SendDeck account holder ("Data Controller" / "Controller") and Lukins Labs AB (Org. nr 559517-2676), operating as SendDeck ("Data Processor" / "Processor"), and forms part of the SendDeck Terms of Service.

2. Scope and purpose

The Processor processes personal data on behalf of the Controller to provide the SendDeck service, which includes:

• Storing and serving uploaded presentation files
• Collecting anonymised viewer engagement analytics when shared links are accessed
• Providing the Controller with dashboards and reports on viewer activity

3. Categories of data subjects

• Controllers / account holders: Registered SendDeck users who upload and share presentations
• Viewers: Recipients who access shared presentation links (no PII collected — see Section 4)

4. Types of personal data processed

For account holders:

• Email address
• Display name
• OAuth profile data (if using Google sign-in)
• Payment information (processed by Stripe; not stored by SendDeck)

For presentation viewers:

• Anonymised session identifier (randomly generated, not linked to any identity)
• Approximate geographic location (city/country level, derived from IP — IP itself is not stored)
• Device type, browser, and operating system (derived from User-Agent header)
• Slide viewing duration and engagement events

Note: No viewer names, email addresses, cookies, or persistent identifiers are collected. The Processor does not consider the anonymised viewer data to constitute personal data under GDPR in most contexts, but processes it with equivalent safeguards.

5. Infrastructure and sub-processors

SendDeck's backend runs on Lovable Cloud, a managed platform built on Supabase's open-source foundation. The following sub-processors are used:

6. Processor obligations

The Processor shall:

• Process personal data only on documented instructions from the Controller
• Ensure that persons authorised to process personal data are bound by confidentiality obligations
• Implement appropriate technical and organisational security measures including encryption in transit (TLS) and at rest, Row Level Security (RLS) policies, and access controls
• Assist the Controller in responding to data subject requests
• Delete or return all personal data upon termination of the service, at the Controller's choice
• Make available all information necessary to demonstrate compliance and allow for audits
• Notify the Controller without undue delay (and in any event within 72 hours) of any personal data breach

7. Controller obligations

The Controller shall:

• Ensure they have a lawful basis for sharing presentation analytics data
• Inform their own clients/prospects about analytics tracking as appropriate within their own privacy policies
• Not upload presentations containing sensitive personal data (special categories under GDPR Art. 9) without additional safeguards

8. International data transfers

Primary data storage is within the EU (AWS eu-central-1, Frankfurt). Where sub-processors process data outside the EU/EEA (e.g., Stripe, Deno edge locations), appropriate safeguards are in place including Standard Contractual Clauses (SCCs) and adequacy decisions where applicable.

9. Data retention and deletion

• Account data is retained for the duration of the account and deleted upon account deletion
• Presentation files and associated viewer analytics are deleted when the Controller deletes the presentation or their account
• The Processor does not retain personal data beyond what is necessary for the service

10. Security measures

• All data encrypted in transit via TLS/HTTPS
• Data encrypted at rest via Lovable Cloud's managed encryption
• Row Level Security (RLS) ensuring strict data isolation between users
• Optional password protection for shared presentations
• Serverless, auto-scaling infrastructure with no persistent attack surface
• Secrets and API keys stored securely via Lovable Cloud's secrets management

11. Term and termination

This DPA remains in effect for the duration of the Controller's use of SendDeck. Upon termination, the Processor will delete all Controller data within 30 days unless retention is required by law.

12. Governing law

This DPA shall be governed by the laws of Sweden and the European Union, including the General Data Protection Regulation (EU) 2016/679.

13. Contact

For questions regarding this DPA, contact:

Lukins Labs AB
Org. nr: 559517-2676
Email: support@lukinslabs.com