Data processing
A plain summary of the data processing terms that apply when your vault holds personal data: as your service provider under US state privacy laws, and as your processor under GDPR Article 28 once Reliquary is offered in the EU. To sign a data processing agreement, email andres@redmage.cc.
Roles
The vault's owner (you) is the controller (the business, under US state laws). Red Mage is the processor (your service provider), and doesn't sell, share or use your data for anything but providing the service to you.
Reliquary is run by Red Mage (Andrés): Memento Vivre Fine Arts LLC, doing business as Red Mage, a single-member limited liability company registered in Colorado, United States under ID 20238181121, 1500 N Grant St, Ste R, Denver, CO 80203, United States. Contact: andres@redmage.cc.
What we process, and why
| Subject matter | Hosting and serving your vaults: context, proposals, logs and environment variables |
|---|---|
| Duration | While you use Reliquary, until the data is erased or the vault deleted |
| Purpose | Only to provide the service to you and your team, on your instructions (what you and your members do in the product is the instruction) |
| Categories of data | Whatever you put in: typically names, email addresses and work details of your members and of people mentioned in your content; credentials in variables |
| Data subjects | Your members, and people your content is about (clients, contacts, colleagues) |
| Special categories | Not allowed: don't store health, biometric or similar data |
What we commit to
- Process your data only on your documented instructions, and tell you if we believe an instruction breaks the law.
- Keep it confidential: only Red Mage has operator access, and uses it only to run and support the service.
- Keep the security measures on the security page in place.
- Use only the listed sub-processors, with data protection terms at least as protective as these, and tell you 30 days before adding or replacing one, so you can object.
- Help you answer your data subjects' requests: export, erasure of a file, deletion of a vault.
- Tell you without undue delay, and within 72 hours of becoming aware, of a personal data breach affecting your data, with what we know.
- At the end, let you export, then delete your data; backups age out after Supabase keeps daily backups for 7 days; the operator also keeps up to 14 off-site copies, in which variable values exist only as ciphertext.
- Give you the information you need to show compliance, and answer reasonable audit questions in writing.
Transfers outside the EU (once offered in the EU)
The database is in the EU; the app runs in the United States, and other sub-processors may access data from outside the EU. Before Reliquary is offered in the EU, this names the safeguard each transfer relies on. The sub-processor list names each provider and its location.