Data processing agreement

Last updated 29 October 2026

This agreement covers the personal information about your clients that GetSetKeys processes for your agency. It is part of our terms of service, applies as soon as you use the service, and needs no signature. If your organisation wants a countersigned copy for its records, email hello@getsetkeys.com and we send one.

Who is who

Your agency is the controller of your clients' information, and GetSetKeys, run from India, is your processor. Where your agency is itself a processor for its client, we are your sub-processor, and this agreement applies in the same way. "Client data" here means the personal information you or your clients put into the service. Information about your own account, team and billing is covered by our privacy policy, where we act for ourselves.

What we process, and why

  • Purpose: running your client setup and handover links: the steps you choose, the live checks that verify them, the files and answers your clients send, messages, reminders and Porter's answers.
  • People: your clients' contacts and anyone they share a link with, and your teammates where they appear on a link.
  • Information: names and business email addresses, project names, domains and DNS records, platform roles and invite addresses, the files and short answers clients send, messages and screenshots sent to Porter, the device type, browser and country a link was opened from, and IP addresses in security logs.
  • Sensitive information: none is needed, and the service is not meant for it. Please don't ask clients for health, financial account or similar data.
  • How long: for as long as you use the service, then as described under When the service ends.

What we commit to

  • We process client data only to provide the service, on your instructions. The terms, your settings and the links you create are those instructions. If we think an instruction breaks data protection law, we tell you.
  • Everyone who can access client data is bound to keep it confidential. Today that is one person, the founder.
  • We keep the security measures under Security in place, and improve them over time without weakening them.
  • We help you answer requests from people to see, correct, export or delete their information, and with security, breach notices and data protection impact assessments, as far as the service is involved.
  • We never sell client data, use it for advertising, or use it to train AI models. Our AI provider can't train on it either.
  • We make the information you need to show compliance available, as described under Audits.

Sub-processors

You authorise us to use these providers. Each is bound by a written agreement with data protection terms at least as protective as these.

  • Cloudflare (United States, with the database in North America): hosting, storage of links and files, reading the platform invites your agency forwards, and network security.
  • Resend (United States): sending link emails, reminders, email codes and reports.
  • Anthropic (United States): the AI model behind Porter, when a client asks a question or an access guide is read.
  • Clerk (United States): signing your team in to the console.
  • Google Workspace (United States): our email, which receives the platform invites your agency forwards and passes them to the service, and any email you or your clients send us.

We tell customers by email at least 14 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we can't resolve it, you can stop using the service, and we refund what you paid for the time after.

International transfers

Our team is in India and our providers are mainly in the United States. For client data from the European Economic Area or Switzerland, the European Commission's standard contractual clauses (2021/914) apply between you and us and are part of this agreement: Module 2 where you are a controller, Module 3 where you are a processor. For them, Option 2 of Clause 9 applies with the notice period above, the optional wording in Clause 11 is not used, the law and courts of Ireland apply under Clauses 17 and 18, and the sections of this page fill in the annexes. For client data from the United Kingdom, the UK's International Data Transfer Addendum applies to those clauses. Our providers transfer data under their own recognised safeguards, such as the standard contractual clauses and the EU-US Data Privacy Framework.

Security

  • Everything travels over HTTPS, and our providers encrypt stored data.
  • Clients never share a password with us. Each step uses the platform's own invite or sign-in, and a one-time sign-in is discarded right after use.
  • Client links are addressed by long, unguessable codes, can ask for an email code on each new device, and are read-only for your own team.
  • Uploaded files are checked for their type and size, and you download them through links that expire after ten minutes.
  • Requests are rate limited, and only the founder can reach production systems.
  • Files are deleted 30 days after their link is done, and other service data within 30 days after an account closes.

Our security page has the detail.

Breaches

If we become aware of a breach that affects your client data, we tell you without undue delay, and where we can within 48 hours. We share what happened, the data and people likely to be affected, the likely consequences, and what we are doing about it, and we keep you updated as we learn more.

Audits

We answer reasonable security questionnaires and share the information you need to show that this agreement is kept. If that isn't enough, or a regulator requires it, you can audit our compliance once a year, with 30 days' notice, at your own cost, under a confidentiality agreement, and without access to other customers' data.

When the service ends

Before your account closes, you can download your clients' files and each client's access record. After it closes, we delete client data within 30 days, unless the law requires us to keep part of it, and we confirm the deletion if you ask.

General

The liability limits in our terms apply to this agreement. If this agreement and the terms differ on data protection, this agreement wins, and the standard contractual clauses win over both. When this page changes, we update the date at the top, and we email customers about any change that matters to them before it takes effect.

Contact

For a countersigned copy, questions, or anything about your clients' data: hello@getsetkeys.com.