Legal
The Data Processing Agreement.
When you process shopper events through Headless Builds, you're the controller and we're the processor. This agreement spells out exactly how we handle that role.
- We process personal data only on your documented instructions.
- Standard Contractual Clauses cover any cross-border transfer.
- Sub-processors are listed publicly and you're notified before any change.
- Breach notification within 72 hours, with full incident detail.
- Data is encrypted in transit and at rest, end to end.
- On termination, we return or delete all personal data at your choice.
Signing the DPA
Our DPA is pre-signed and incorporated into the Terms of Servicefor every paid workspace — there's nothing to fax. If your legal team needs a countersigned copy or wants to redline specific clauses, reach the security deskand we'll turn it around quickly.
Sub-processors
We keep the list short on purpose: infrastructure, our database provider, and Stripe for billing. The full, current roster — with regions and roles — is maintained on the security page.