GDPR and customer data processing terms for Masto Control.
For customer production and business data stored in a tenant workspace, the customer is the controller and Masto Control acts as processor. For account, billing, and operational data, Masto Control may act as controller.
Masto Control processes customer data to provide inventory, BOM, production, support, billing, security, backup, and operational services.
Masto Control applies access controls, tenant isolation, authenticated file access, backups, audit logs, and production security settings. Customer media should be stored in private S3-compatible storage in production.
Production deployments may use hosting, database, object storage, email, error monitoring, and Paddle payment providers as sub-processors. A current list should be maintained before launch.
Upon termination, customer data can be exported or deleted according to the agreed retention period and applicable legal obligations.