Data Processing Agreement
Between the Merchant (controller; the webshop operator who embeds the Configurator) and CutOptim (processor; the operator identified in the imprint). Reference: GDPR Article 28. It forms part of the Configurator terms. Published in English only, and the English text is the one that applies.
1.Subject matter, duration, nature, purpose
CutOptim hosts the Configurator service (cfg.cutoptim.com) that the Merchant embeds in its shop: it prices and plans a shopper's cut list, stores saved projects, quotes and orders on the Merchant's behalf, delivers the order to the Merchant (signed webhook, e-mail), and sends the shopper an order-status e-mail when the Merchant asks for it.
Duration: the term of the Merchant's account plus the retention in section 6. Instructions: the Merchant's published tenant configuration and console actions, plus this agreement.
2.Categories of data subjects and data
| Data subject | Data (as stored today) |
|---|---|
| Shopper (end customer) | Name, e-mail, phone and address (optional; only what the Merchant's order flow sends); an opaque customer reference issued by the Merchant's shop; a consent timestamp. |
| Shopper | Cut list and project content, and a project name the shopper typed (free text), in saved projects, quotes and the signed order document. The order document may carry shipping or delivery data, depending on what the Merchant's order flow sends. |
| Shopper | Order status history. |
| Shopper | Project token: stored only as a tenant-bound SHA-256 hash; the token itself lives in the shopper's browser. |
| Shopper | Recipient address of status e-mail: only its SHA-256 hash is queued; the address is read again from the customer record at send time. |
| Shopper | Order tracking link: a stateless HMAC-SHA256 token (tenant, order, expiry); nothing is stored; valid 365 days from order creation. |
| Merchant staff | Account e-mail, role, invitations and an audit trail of console actions. CutOptim is the controller of its own account data (see the Privacy Policy); listed here for completeness. |
| Technical | IP address in the web-server access log, truncated (/24 for IPv4, /48 for IPv6) on the Configurator hosts. Structured service logs have e-mail masked (a***@d***), carry no name, address or phone, no tokens or keys, and log the route template and tenant id, never the query string. |
| Usage | Per-tenant event counts (quote, final plan, order); no personal data. |
No special-category data is intended; the cut list is dimensional data. The Merchant must not enter special-category data in free-text fields.
3.Processor obligations (Article 28(3))
CutOptim processes shopper data only on the Merchant's documented instructions; ensures that persons authorised to process it are bound by confidentiality; assists the Merchant with data-subject requests, security and breach duties; returns or deletes the data at the end of the service; and makes available the information necessary to demonstrate compliance and contributes to audits on reasonable written request.
CutOptim notifies the Merchant of a personal data breach without undue delay after becoming aware of it.
4.Sub-processors
| Sub-processor | Role for the Configurator | Location |
|---|---|---|
| Hetzner Online GmbH | Hosts the whole stack: application, Configurator service, self-hosted Postgres database. | Nuremberg, Germany |
| Cloudflare, Inc. | DNS and proxy for the marketing site and app. cfg.cutoptim.com is not proxied, so shopper traffic to the Configurator does not pass the Cloudflare proxy. | Global network (DNS only for the Configurator) |
| Cloudflare R2 | Storage of encrypted database backups: daily kept 14 days, weekly expired after 90 days. Files are age-encrypted before they leave the server and the private key is kept off the server. | Not stated here |
| Resend | Sends the order e-mail to the Merchant and the optional status e-mail to the shopper (subject, body, PDF attachments). | Provider locations not stated here; Resend is a US company |
| Lemon Squeezy | Billing of the Merchant's CutOptim subscription only. Receives no shopper data. | n/a |
The self-hosted database software (Supabase, running on the Hetzner server) is not a third-party processor. This list is current as of the version date of this page. A new sub-processor for shopper data is added to this list, and the Merchant is informed before it is used.
5.Technical and organisational measures
- Tenant isolation by Postgres row-level security on every tenant table, verified by an automated isolation test suite; the service connects as a database role that cannot bypass row-level security.
- Secrets: API secrets are stored as a SHA-256 hash; signing keys are derived at runtime from a master secret held only by the Configurator container; no key material is stored in the database.
- Data minimisation: hash-only e-mail queue, hash-only project token, hash-only webhook delivery log; personal-data keys and quoted values are scrubbed from logs; error responses are opaque.
- Transport: HTTPS with automatic TLS; security headers; per-tenant and per-IP rate limits on public endpoints;
no-storeon price and customer responses. - Backups are age-encrypted before leaving the server.
- Access: the superadmin console requires multi-factor authentication; SSH access to the server has login alerting.
- Order events, audit and usage records are append-only (enforced by database triggers).
CutOptim does not hold ISO 27001 or SOC 2 certification.
6.Retention
The Merchant sets retentionDays (1 to 3650) in its published configuration; the default is 365 days if it was never published.
| Data | Rule |
|---|---|
| Quotes | Deleted retentionDays after creation, unless an order references the quote. |
| Saved projects | Deleted retentionDays after the last update. |
| Customer records | Deleted after retentionDays of inactivity, only if no order, quote or project still references the customer. A customer with an order stays until pseudonymised. |
| Orders and order events | Not deleted by retention; there is no delete path while the tenant exists. Kept as the law requires. |
| Webhook and e-mail delivery records | Finished records are deleted after retentionDays. |
| Quote replay nonces | 1 day after token expiry. |
| Invitations | 30 days after acceptance or expiry. |
| Daily usage counts | 800 days. |
| Usage events, audit trail, published configurations | Not purged by retention (append-only records; configurations are needed to reproduce quotes and orders). |
| Backups | Daily 14 days, weekly 90 days. Personal data deleted from the live database persists in backups until they expire. |
| Sandbox tenant | Can be deleted (with its data). A live tenant cannot be deleted by the Merchant; it is closed and keeps its orders. |
7.Data-subject requests
A customer record can be pseudonymised: name, e-mail, phone and address are removed. The e-mail worker already refuses to mail a pseudonymised customer, and members read customer data in the console according to their role.
A self-service export and erasure function in the console is not available at this time. Until it is, CutOptim handles access, export, erasure and pseudonymisation requests manually on the Merchant's written instruction sent to [email protected]. Requests that reach CutOptim directly from a shopper are forwarded to the Merchant.
8.International transfers
Primary processing is in Germany (European Union). Cloudflare and Resend are US companies. Where a sub-processor is established outside the EU, personal data is transferred only on the basis of a transfer mechanism under Chapter V of the GDPR (for example standard contractual clauses or an adequacy decision).
9.Liability, term and deletion on exit
Liability is governed by the Limitation of liability section of the Terms of Service. The agreement lasts as long as the Merchant's account. Self-service export and deletion on exit are not a console feature at this time; ask [email protected].
Version history
- 2026-10-20 — 20 October 2026 — First published version.
Questions: [email protected] · contact