Data Processing Agreement
Last updated: 9 September 2026
This agreement covers the personal data FrameRewind processes on your behalf and forms part of the Terms of Service. It applies automatically to every paid subscription from the day it starts, so there is nothing to sign for it to be in force. If your organisation needs a countersigned copy for its records, e-mail support@framerewind.com with the legal entity name and address and we will return a signed PDF of this text.
Who is who
You are the controller. MDB Next (Netherlands), trading as FrameRewind, is the processor. Where your own customers' data ends up in a Framer CMS you back up, you may be a processor towards them and we are a subprocessor; this agreement is written so it works in both readings.
This agreement covers only the data we process on your instructions. The data we process as a controller in our own right, such as your billing address and account e-mail, is covered by the privacy policy instead.
What we process, and why
- Subject matter and purpose: taking backups of the Framer CMS collections in the projects you connect, showing you the difference against the live CMS, and writing content back when you ask.
- Duration: for as long as your subscription runs, plus your plan's retention window for snapshots already taken.
- Categories of data: whatever your CMS collections contain. We do not choose it and we do not inspect it. In practice that is usually published content, but a collection can hold names, e-mail addresses, photographs or anything else you put in it.
- Categories of data subject: determined by you. Typically the people your published content is about, such as authors, team members or customers.
- Special category data: FrameRewind is not designed for it. If your collections hold health, biometric or similar data under Article 9 GDPR, tell us before you connect the site so we can confirm whether we can support it.
Our instructions
We process your data only to run the service described above, and only on your documented instructions. Your instructions are these terms, the product's own settings, and anything you ask us in writing at support@framerewind.com. If the law requires us to process your data for something else, we will tell you before we do, unless that law forbids telling you. We do not sell your data and we do not use it to train models.
Confidentiality
Access to customer content is limited to the people who need it to run or support the service, each bound to confidentiality. FrameRewind is operated by one person; in practice that means one named individual has administrative access, and no third party is given a login.
Security measures
These are the measures in place today, not aspirations:
- All traffic to the service and to Framer runs over TLS.
- The Framer Server API key you provide is encrypted with AES-256-GCM before it is stored. The encryption key lives in the server environment, never in the database, and is never sent to the plugin.
- You enter that API key on our site in your own browser. The plugin never receives it, so it is not exposed to the Framer canvas or to anything else running there.
- Snapshot content is stored in an EU-region database and object store, reachable only with service credentials held by the application.
- Every API request is authenticated by licence key and scoped to the account that owns the row. Download links are single-use and expire in minutes, so no credential ever travels in a URL.
- Snapshots are deleted automatically when their retention window ends. Deletion removes the stored file as well as the database row.
- Backups of the platform itself are handled by our infrastructure providers under their own retention.
We review these measures when the service changes materially. We may replace a measure with an equivalent or stronger one; we will not lower the overall level of protection.
Subprocessors
You give general authorisation for the subprocessors below. Each is bound by data protection terms at least as protective as these.
- Supabase: database and file storage. EU region.
- Vercel: application hosting and privacy-preserving web analytics. United States.
- Stripe: payments and subscription management. United States and Ireland.
- Brevo: transactional e-mail. European Union.
- Framer: the source of the content we back up, accessed with the API key you provide. United States.
Before we add or replace a subprocessor we will announce it on this page and e-mail the address on your account at least 30 days in advance. If you object on reasonable data protection grounds within those 30 days, you may cancel your subscription and we will refund the unused part of the current period.
International transfers
Customer content is stored in the EU. Where a subprocessor listed above processes data outside the EEA, that transfer relies on the European Commission's Standard Contractual Clauses, incorporated by reference through that provider's own data processing terms, together with their supplementary measures. Copies are available from those providers and, on request, from us.
Helping you meet your obligations
- Data subject requests. If someone contacts us about data you control, we will not answer them directly. We forward the request to you without undue delay and help you answer it. Your snapshots, their content and the API keys we hold can be exported or deleted on request, and you can delete individual snapshots yourself in the plugin.
- Impact assessments. On request we provide the information we hold about the processing so you can complete a DPIA or a prior consultation.
Personal data breaches
If we become aware of a breach affecting your data, we notify you at the address on your account without undue delay and within 72 hours, with what we know at that point: what happened, which data is involved as far as we can tell, the likely consequences and what we are doing about it. We follow up as we learn more. Notifying your supervisory authority stays your decision.
Deletion and return
You can export any snapshot as JSON or CSV at any time while your subscription runs, which is how you get your data back. When your subscription ends you choose what happens: keep the account on the Free plan with Free retention, or have everything deleted. If you make no choice within 30 days, we fall back to the Free plan and delete nothing, because the alternative default destroys data on silence. On deletion we remove snapshots and their stored content, connected sites and the encrypted API keys. Backups held by our infrastructure providers age out on their own schedule.
The one thing kept is the billing record we are legally required to retain: the Stripe customer reference and subscription history, which contain no snapshot content, no API keys and no CMS data.
Audit
On request, and no more than once a year unless a regulator or a breach requires otherwise, we provide the information needed to demonstrate compliance with this agreement: a written description of our measures, and the compliance documentation our subprocessors publish. If that is not enough for your assessment, an on-site or remote audit can be arranged on 30 days' notice, during business hours, without disrupting the service and subject to confidentiality. We are a one-person operation and hold no SOC 2 or ISO 27001 certification; if your procurement process requires one, say so before you subscribe.
Liability and precedence
The liability limits in the Terms of Service apply to this agreement. Where this agreement and those terms conflict on the processing of personal data, this agreement wins. Where this agreement conflicts with the Standard Contractual Clauses, the Clauses win.
Governing law
Dutch law, the courts of the Netherlands, matching the Terms of Service.
Changes
If this agreement changes materially we update this page, note the date above and e-mail the address on your account. Questions: support@framerewind.com.