GDPR & Data Processing
Last updated: October 12, 2026
This page explains how to exercise your data-protection rights and how we process customer data. Read it with our Privacy Policy.
Your rights under GDPR
Subject to applicable law, you can:
- Request access to your personal data and a copy of it
- Correct inaccurate information
- Request deletion or restriction of processing
- Receive data you provided in a portable format where the right applies
- Object to processing based on legitimate interests or to direct marketing
- Withdraw consent at any time where we rely on it
We do not make decisions with legal or similarly significant effects on people based solely on automated processing.
Send requests to humans@daaam.app or Bruno Afonso, our data-protection contact. We may ask for information reasonably needed to verify your identity and authority.
We respond without undue delay and normally within one month of receiving your request. Complex or multiple requests may take up to two additional months; we will explain any extension within the first month.
Stopping onboarding emails
Use the unsubscribe link in an onboarding email to stop those emails. To object to onboarding-data processing or request deletion, contact us. Unsubscribing alone does not erase records or stop onboarding-progress updates. Necessary account and security messages continue separately.
Account deletion procedure
Account and Workspace deletion is handled by request:
- Email humans@daaam.app from your account address. Tell us whether you want to delete your account, a Workspace, waitlist data, or other data you control.
- We verify your identity and authority. If you are the only Workspace owner, tell us whether to delete it or transfer ownership. Shared or organisation-controlled content may require another owner’s approval.
- We delete the approved data, end the relevant access, and arrange deletion with our providers where needed.
- We confirm what was deleted and explain any retained data, the reason, and how long it will remain.
There is no self-service account-deletion control. Moving an asset to Trash does not permanently delete it or start an automatic deletion period. You can permanently delete assets or empty Trash using the available Workspace controls.
Data that may remain after a request
Shared Workspace content may remain under its customer’s control. We may retain limited information where required by law, needed for legal claims, or necessary to protect another person’s rights.
Deleted data may remain temporarily in isolated backups until the applicable backup cycle expires. It is not used for normal operations, and deletion requests are reapplied if a backup is restored. Copies held by customers, connected sites, or recipients are outside our deletion process.
Service providers and international processing
Assets are stored in Europe. We use the following providers; the Privacy Policy explains the data involved.
| Provider | Purpose | Location and provider terms |
|---|---|---|
| Supabase | Database and authentication | Database in Europe. DPA |
| Backblaze | Asset storage | Storage in Europe. DPA |
| Cloudflare | Application hosting on edge workers, CDN, security, email, AI search and analysis, and usage accounting | Global network. DPA · Sub-processors |
| Modal | Compute and media processing | Europe and United States. DPA |
| Loops (Astrodon Corp.) | Waitlist and onboarding emails | United States. DPA · Sub-processors |
| DiceBear (Florian Körner) | Default avatars | Germany. Privacy Policy |
| Automattic (Gravatar) | Blog author avatars | Privacy Policy |
| PostHog EU Cloud | Optional analytics, error reporting, and feedback | Europe. DPA and sub-processors |
Providers and customer-selected destinations may process personal data outside the EEA. International transfers subject to GDPR require applicable safeguards, such as adequacy decisions or Standard Contractual Clauses, with supplementary measures where required. Contact our data-protection contact for current transfer details or a copy of the relevant safeguards.
Customer-controlled disclosures
Workspace customers control invitations, sharing, downloads, and connected sites or integrations. These recipients are selected by the customer and are not our sub-processors. The customer is responsible for permissions, privacy notices, and any transfers to those destinations.
Breach notification
If a personal-data breach occurs, we assess and contain it. Where GDPR requires it, we notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. We notify affected people without undue delay where required because the breach presents a high risk, and notify affected customers under the applicable Data Processing Agreement.
Data Processing Agreements
Workspace customers can request a DPA at humans@daaam.app. It sets out processing instructions, data categories, security, assistance with rights requests, deletion or return of data, and applicable transfer safeguards.
Data-protection contact
Bruno Afonso — bruno@wearesingular.com
Contact Bruno about rights requests, provider processing, or complaints. You can also contact humans@daaam.app.
Data Protection Impact Assessments
Before introducing processing likely to present a high risk to individuals, we assess whether a Data Protection Impact Assessment is required and complete it before that processing begins.
AI analysis and search help organise and find assets. We do not use Workspace content for model training, facial recognition, biometric identity matching, or automated decisions with legal or similarly significant effects on people. See How we use Workspace content.
Complaints
You may complain to Portugal’s CNPD (Comissão Nacional de Proteção de Dados) or the applicable authority where you live or work in the EU/EEA. You can contact us first so we can investigate, but this does not limit your right to complain directly to an authority.