Data Processing Addendum (DPA)

Last Updated: 5 October 2026 • Compliant with UK GDPR & EU GDPR Article 28

1. Purpose and Scope

This Data Processing Addendum ("DPA") supplements the Launchfolio Terms of Service between Launchfolio Ltd ("Processor", "we", "us") and the workspace creator/subscriber ("Controller", "Customer", "you").

This DPA applies to the processing of personal data relating to your portal members, readers, and commenters ("Customer Personal Data") carried out by Launchfolio in the course of providing the software and hosting services.

2. Roles of the Parties

Customer is the Data Controller of Customer Personal Data, and Launchfolio is the Data Processor acting strictly on Customer’s documented instructions.

3. Processor Obligations

Launchfolio agrees that it shall:

Process Customer Personal Data only on documented instructions from the Customer, including with respect to transfers of personal data to a third country.
Ensure that persons authorized to process the personal data have committed themselves to confidentiality.
Take all measures required pursuant to Article 32 of GDPR (Security of Processing), including encryption at rest (AES-256-GCM) and in transit (TLS 1.3).
Respect the conditions for engaging another processor (Sub-processors), including Cloudflare and AWS.
Assist the Controller by appropriate technical and organizational measures in fulfilling the Controller’s obligation to respond to requests for exercising data subject rights (including GDPR Article 17 Right to Erasure).
At the choice of the Controller, delete or return all personal data to the Controller after the end of the provision of services.

4. Sub-processors

Customer grants general authorization to Launchfolio to engage the following infrastructure sub-processors for hosting and delivering the platform:

Neon Inc. (AWS EU / US): Managed PostgreSQL database storage.
Cloudflare Inc.: Global CDN edge caching, DNS, and R2 object storage.
Hostinger International Ltd: Virtual Private Server (VPS) infrastructure.

5. Security Incident Management

In the event of a confirmed personal data breach affecting Customer Personal Data, Launchfolio shall notify Customer without undue delay (and in any event within 48 hours) upon becoming aware of the breach, providing sufficient information to enable Customer to meet its obligations under data protection law.

6. Contact Us

For inquiries regarding this DPA or sub-processor notifications, please contact privacy@launchfolio.app.