Holistic Quality LLC (US (Ohio, USA))
Contact: privacy@holisticquality.io
Under GDPR Article 28, we maintain Data Processing Agreements with all sub-processors that handle personal data on our behalf.
| Processor | Jurisdiction | Data Location | DPA Status | DPA | Executed |
|---|---|---|---|---|---|
| Cloudflare | US (global edge network) | Global edge network | in_force | View DPA | 2026-04-03 |
| Upstash | EU (Ireland) | eu-west-1 (AWS Ireland) | in_force | View DPA | 2025-04-01 |
| Vercel | US | iad1 (US-East) and global edge | in_force | View DPA | 2026-03-31 |
| Resend | US | US | in_force | View DPA | 2025-12-31 |
| Google Workspace | Not checked: the captured pages name no contracting entity, so no country is stated for one. | Any country where Google or its subprocessors maintain facilities, subject to its data location commitments (Cloud Data Processing Addendum, section 10.1) | in_force | View DPA | Per the Google Workspace agreement (the Addendum is incorporated into it by reference; Google's page gives no date) |
| Stripe | US | US | in_force | View DPA | Per active SSA |
Action required: Processors with "Pending" status require DPA execution. This page will be updated once agreements are in place.
For processors located outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission (2021 Decision) to ensure adequate data protection.
| Processor | SCCs Required | SCCs Status | Transfer Mechanism |
|---|---|---|---|
| Cloudflare | Conditional | Only for a Restricted Transfer (Cloudflare Customer DPA v6.4, clause 6.2). A transfer under the Data Privacy Framework is not one: “transfers of Customer Data to Cloudflare made under the Data Privacy Framework shall not be a Restricted Transfer”; if Cloudflare’s certification lapses or is invalidated, “any transfers of Personal Data from Customer to Cloudflare shall immediately be deemed a Restricted Transfer” (clause 6.4). | Where a transfer to Cloudflare is a Restricted Transfer: the EU SCCs, with Module Two where the Customer is a Controller and Module Three where the Customer is a Processor (clause 6.2(a)), and for UK transfers the UK Addendum (Version B1.0). A transfer made under the Data Privacy Framework is not a Restricted Transfer (clause 6.4). The DPA also says “Cloudflare has certified to the Global CBPR System and the Global PRP System” (clause 3.2). |
| Upstash | Conditional | Only if European Data Protection Laws require safeguards and the Data Privacy Framework does not cover the transfer to Upstash Inc. or is invalidated (DPA section 3.2(B)(2)): “If European Data Protection Laws require that appropriate safeguards are put in place (for example, if the Data Privacy Framework does not cover the transfer to Upstash Inc. and/or the Data Privacy Framework is invalidated), the Standard Contractual Clauses will be incorporated by reference and form part of the Agreement”. | The DPA says “Upstash Inc. is a recipient of European Data in the United States” (section 3.2(B)), and “Upstash Inc. will use the Data Privacy Framework to lawfully receive European Data in the United States” (section 3.2(B)(1)). The Standard Contractual Clauses (Modules Two and Three) are the fallback quoted in sccs_required. |
| Vercel | Conditional | Only for a transfer that is subject to the Standard Contractual Clauses. Schedule 3 applies on the Addendum’s own condition: “To the extent that Customer's use of the Services requires an onward transfer mechanism to lawfully transfer personal data” (from the EEA, the UK, Switzerland or another listed jurisdiction to Vercel outside it); and Schedule 3 section 3 says “For data transfers from the EEA, the UK, and Switzerland that are subject to the Standard Contractual Clauses, the Standard Contractual Clauses will apply”. | Schedule 3 of the Vercel DPA defines its Standard Contractual Clauses as “the 2021 Standard Contractual Clauses approved by the European Commission in decision 2021/914” (section 1) and applies them as section 3 states; for transfers from the United Kingdom, “For data transfers from the United Kingdom, the UK IDTA will be deemed entered into” together with those clauses (section 2). |
| Resend | Yes | in_force | 2021 EU Commission SCCs incorporated in Resend DPA; EU-U.S. Data Privacy Framework (Resend DPF-certified) |
| Google Workspace | Conditional | Only where Google has not adopted an Alternative Transfer Solution for the transfer (Cloud Data Processing Addendum, Appendix 3, European Data Protection Law, section 4.1) | Where European data protection law applies to a restricted transfer: an Alternative Transfer Solution, if Google has adopted one (published at https://cloud.google.com/terms/alternative-transfer-solution); if it has not, the SCCs that Google's terms define (https://cloud.google.com/terms/sccs/eu-c2p and the other SCCs listed there) apply (Cloud Data Processing Addendum, Appendix 3, European Data Protection Law, section 4.1) |
| Stripe | Conditional | Only if the Data Privacy Framework does not apply to the transfer. Stripe’s Data Transfers Addendum puts the Data Privacy Framework first: “the transfer will be subject to one Data Transfer Mechanism only, according to the following order of precedence: (a) the Data Privacy Framework; (b) the EEA SCCs or the UK International Data Transfer Addendum, as applicable” (Data Transfers Addendum, section 2). | For a transfer that requires a Data Transfer Mechanism, the DPA says “the Data Transfers Addendum, which is incorporated into this DPA, will apply” (DPA section 6.1). In the Addendum the Data Privacy Framework comes first (“Stripe, LLC is self-certified under the Data Privacy Framework”, section 3); if that certification is withdrawn, “an alternative Data Transfer Mechanism will apply” (section 3): the EEA SCCs (Modules 1, 2 and 3, section 4) or the UK International Data Transfer Addendum (section 2). PCI-DSS Level 1 certified processor |
Detailed breakdown of data categories, retention periods, and encryption for each processor.
Jurisdiction: US (global edge network) (Global edge network) · Encryption: Not applicable (DNS only; no personal data)
Data categories:
| Data Type | Retention |
|---|
Jurisdiction: EU (Ireland) (eu-west-1 (AWS Ireland)) · Encryption: Not recorded
Data categories:
| Data Type | Retention |
|---|---|
| api keys active | Up to 2 years after the key was last used (a paid key never used: 2 years after issue; an unused trial key: 14 days after issue) |
| api keys post cancellation | Remaining time kept (up to 2 years after last use); cancellation does not shorten it. The stripe_customer reference expires 90 days after cancellation |
| trial flags | 30 days (auto-TTL) |
| usage metadata | 90 days (auto-TTL) |
| rate limits | 24 hours (auto-TTL) |
| inquiry data | 30 days (auto-TTL) |
| backup snapshots | Weekly snapshot of key, Stripe-customer and webhook records, written to the same database; each snapshot expires 30 days after it is taken |
| stripe customer active | The email, up to 5 years from checkout while the subscription is active |
| watchlists and webhooks | Expire with the key record they belong to (up to 2 years after last use); if setting that expiry fails, a cleanup run at every deploy sets it, or deletes the record if its key record is already gone; a deleted webhook takes its delivery log; a verified erasure request deletes them |
| rapidapi user daily counts | Until the end of the UTC day; if setting that expiry fails, a cleanup run at every deploy sets it, or deletes the count if its day is already over |
| unsubscribe records | No expiry, so the unsubscribe is honoured; an erasure request keeps them |
| per client analytics | 30 days (auto-TTL); each client identified by a keyed hash of its IP address or API key; used to see which clients use the API heavily and may need an API key or a paid plan |
Jurisdiction: US (iad1 (US-East) and global edge) · Encryption: TLS 1.2 or 1.3 in transit, encrypted at rest
Data categories:
| Data Type | Retention |
|---|---|
| function logs | 30 days (Observability Plus) |
| cdn cache | Per Cache-Control headers |
Jurisdiction: US (US) · Encryption: TLS in transit
Data categories:
| Data Type | Retention |
|---|---|
| email logs | 28 days (Resend retention policy) |
Jurisdiction: Not checked: the captured pages name no contracting entity, so no country is stated for one. (Any country where Google or its subprocessors maintain facilities, subject to its data location commitments (Cloud Data Processing Addendum, section 10.1)) · Encryption: Google-managed; Appendix 2 (Security Measures) of its Cloud Data Processing Addendum includes measures to encrypt Customer Data (not independently assessed by us)
Data categories:
| Data Type | Retention |
|---|---|
| retention | Not checked: retention of our own mailbox and of the feedback form's responses has not been looked up for this entry. Google's deletion terms are in section 6 (Data Deletion) of its Cloud Data Processing Addendum. |
Google Workspace sub-processor list
Jurisdiction: US (US) · Encryption: TLS 1.2+ in transit, AES-256 at rest (Stripe managed)
Data categories:
| Data Type | Retention |
|---|---|
| billing data | Per Stripe retention policy |
For your full data subject rights (access, erasure, rectification, portability), see our Privacy Policy.
To exercise your right to erasure: POST /api/keys/erasure with your email address.
This compliance documentation is reviewed quarterly. Next scheduled review: 2026-10-20.
Material changes to sub-processors or data handling will be reflected here and noted in the API release notes. Per-compound data updates are published in the data changelog feed.
ALETHEIA Safety Database · Holistic Quality LLC · API Root · Accessibility