Data Processing Agreement

Last updated: August 7, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Customer," the Fyrro account holder) and Beveled Edge AB, org. no. 559089-2559 (VAT no. SE559089255901), Fiskare Glans gata 5, 193 41 Sigtuna, Sweden ("Fyrro," "Processor"). It applies whenever Fyrro processes personal data on your behalf as part of the Service — most commonly, the name, email, comments, and attachments your reviewers enter on a Pinpoint or Studio link you shared with them. You are the data controller for that data; Fyrro is your processor.

1. Subject matter and duration

Fyrro processes personal data on your behalf for as long as your account is active and the relevant project exists, in order to provide the Service described in the Terms of Service.

2. Nature and purpose of processing

Storing, displaying, and transmitting the data your reviewers submit through a share link you create; sending notification emails you've configured (feedback submitted, version approved, and similar); and generating exports (e.g. an annotated PDF) at your request.

3. Categories of data subjects

The clients and reviewers you invite to a Pinpoint or Studio review link.

4. Categories of personal data

Name, email address (optional, at the reviewer's choice), free-text comments and replies, uploaded attachments, and (for Studio) a recorded color/font selection. We don't ask reviewers for any special category data (health, biometric, etc.), and you shouldn't direct them to submit it through a comment or attachment either.

5. Processor obligations

Fyrro will:

  • Process personal data only on your documented instructions (which, in practice, means: only to run the Service the way you've configured it).
  • Keep the data confidential and ensure anyone with access to it is under a confidentiality obligation.
  • Apply appropriate technical and organizational security measures — see the Security section of our Privacy Policy.
  • Assist you in responding to data subject requests (access, deletion, etc.) concerning your reviewers' data.
  • Notify you without undue delay if we become aware of a personal data breach affecting your data.
  • Delete or return personal data at the end of your engagement with us, other than what we're legally required to retain.
  • Make available the information reasonably necessary to demonstrate compliance with this DPA.

6. Sub-processors

Fyrro uses the following sub-processors to provide the Service, each limited to the role described (kept in sync with the equivalent list in our Privacy Policy):

  • Vercel — application hosting and file storage (images, screenshots, attachments).
  • Neon (or equivalent managed PostgreSQL provider) — database hosting.
  • Resend — transactional email delivery.
  • A browser-automation provider — used to capture a screenshot of a URL you submit, and to generate PDF exports.

We'll update this list and, where required by law, give you a reasonable opportunity to object before adding a new sub-processor that will process your data.

7. International transfers

Where personal data is transferred outside the EEA/UK, we rely on an appropriate safeguard (such as Standard Contractual Clauses) with the relevant sub-processor.

8. Contact

Questions about this DPA: [email protected].

© Fyrro