Data processing
Data processing agreement
This agreement covers the personal data we handle on your behalf when you use the push relay and Shorthop Watch. For that data you are the controller and we are your processor under Article 28 of the GDPR. It takes effect when you accept the terms of service; no signature is needed. If you need a signed copy, write to privacy@shorthop.io.
Data we hold about you as our customer (your account, invoices) is not covered here: for that we are the controller, as the privacy policy explains.
What we process for you
| Whose data | The people in your organisation whose phones are signed in to your installation, and anyone you name in a Watch check. |
|---|---|
| What data | Each phone's push token, platform and the label your team gave it (often a person's name), when it signed in and out and was last heard from; when each page was sent to which phone and whether it was accepted; the names of your Watch checks, the short notes your jobs send with a ping, and their history. Never the content of your alerts. |
| Why | To deliver pages from your Shorthop to those phones, to page them when a Watch check stops, to count phones and checks for your bill, and to sign out phones that have stopped being used (always with a warning first). |
| For how long | For as long as you use the services, then as the privacy policy says: deleted within 30 days of closing your account, and Watch ping history after 30 days. |
What we commit to
- Only on your instructions. We process this data only to run the services as the terms describe and as you configure them (which phones you sign in, which checks you create). If the law ever requires anything else of us, we will tell you first unless the law forbids it.
- Confidentiality. Only the people who run the service can reach the data, and only to run it.
- Security. What we do today:
- every connection to the relay, Watch and the account pages is encrypted (TLS);
- installation keys and Watch ping tokens are stored only as one-way hashes;
- we keep as little as the services need — no alert content, no push payloads, no IP address or headers of a Watch ping;
- staff access to the data is through a back office that requires a named Google account on an allowlist, and every action there is logged;
- requests are rate-limited, and an installation can be disabled at once if its key is misused.
- Sub-processors. The providers listed below. We will tell you by email at least 30 days before adding or replacing one; if you object and we cannot resolve it, you can close your account before the change.
- Helping you. We will help you answer requests from the people whose data this is. Most you can handle yourself: signing a phone out of your Shorthop stops its use at once, and deleting a Watch check stops it being processed.
- Breaches. If a personal data breach affects your data, we will tell you without undue delay and no later than 48 hours after we become aware of it, with what we know and what we are doing.
- At the end. When your account is closed we delete this data within 30 days. Nothing of it is kept for billing: invoices record counts and amounts, not your phones' labels or tokens.
- Showing compliance. On request we will give you the information you need to check we keep to this agreement, and answer reasonable questions. If that is not enough, an audit can be agreed in writing, at your cost, with reasonable notice.
Sub-processors
| Provider | Why | Where |
|---|---|---|
| Google Cloud | Hosting for the relay, Watch and their database. | EU (Finland) |
| Expo | Forwards each page to Apple or Google. | United States |
| Apple (APNs), Google (FCM) | Deliver the notification to the phone. | United States |
| Amazon Web Services (SES) | Watch alert emails. | EU (Frankfurt) |
| Cloudflare | Carries every connection to the services (encryption, flood protection). | Global |
Transfers outside the EU
Expo, Apple and Google receive a phone's push token and the notification itself. For an ordinary page that is generic text and an opaque id; for a Watch page it is the check's name and state. Where a provider is outside the EU, the transfer relies on the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.
If this and the terms disagree
For personal data, this agreement wins. Liability under it is subject to the limits in the terms of service, except where the law does not allow that.