GDPR Tools

Why this page says "today"

GDPR isn't optional if you have EU users. Many platforms describe their compliance as a list of buttons. We would rather say exactly what is self-serve, what goes through our team, and how fast — because one untrue sentence on a marketing page costs more than a missing button.

Everything below is included on every plan — Starter, Growth and Scale. There is no separate "compliance" SKU.

Data residency: EU by default

Your customer data is hosted on our own servers in Bulgaria (EU). Backups are encrypted before they leave the server and stored in Cloudflare R2; the decryption key is held offline.

Two exceptions, described in the Privacy Policy: AI features send the content they work on to OpenAI (United States) under Standard Contractual Clauses, and Cloudflare processes request metadata on its global network. Data goes nowhere else outside the EU.

Data subject rights

Requests for access, rectification, erasure, restriction and portability go to [email protected]. We respond within 30 days. Here is what is fulfilled from which side:

• CDP — full export and full erasure of a profile with its events, run by our team on your request.
• CRM — contacts are edited and deleted directly by your team; workspace-level export.
• Push — subscribers unsubscribe themselves from any message; pseudonymisation of the record on request.
• Hub, Automation, Pages, Assistant — on request, handled by our team.

We are building self-serve export and erasure buttons across all services. Until they ship, we do not advertise them.

Per-purpose consent (CDP)

The CDP stores each profile's consent across four purposes — analytics, marketing, personalization, functional — with a full history of every change (when, from where). The consent API accepts the state from your cookie banner (OneTrust, Cookiebot or your own) or from our built-in widget.

• Withdrawn marketing consent is synced to Push, so campaigns stop reaching the person.
• The default posture (implied or explicit) is set per workspace — you decide whether new visitors start with or without consent.
• Daily aggregates per purpose — granted and revoked — in the CDP's GDPR dashboard.

Audit trail

The Hub records account and subscription actions — registration, login, password changes, service activation and deactivation, plan and payment changes, administrative actions on the workspace. The CDP records every consent change with its source. Records are available on request for a regulator response.

Data Processing Agreement and sub-processors

For the data you upload and collect, you are the controller and we are the processor under Article 28 GDPR. The written DPA and the maintained sub-processor list are being finalised and will be published on this site; until then, request them at [email protected]. Any sub-processor change is announced 30 days in advance.

Today's third parties are listed in Privacy Policy §5 — one list, the same on every page.