Last updated: 7 June 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between drop (neuronik.io) ("drop", the "Processor") and the customer using the service (the "Controller"). It applies automatically, without signature, whenever the Controller's use of drop involves the processing of personal data subject to the GDPR or equivalent data-protection laws. In case of conflict with the Terms, this DPA prevails for data-protection matters.
Subject matter & purpose — hosting and serving web pages and files published by the Controller's users, and operating the related workspace features.
Duration — the term of the Controller's use of the service, until deletion of the account or content.
Nature — storage, encryption, transmission and display of content; account management; transactional email delivery.
Categories of data subjects — the Controller's workspace members, and any individuals whose personal data the Controller chooses to include in published content.
Categories of personal data — account data (name, email, profile picture), workspace content, and technical metadata. drop is not intended for special categories of data (e.g. health data) and the Controller agrees not to publish them.
drop will: (a) process personal data only to provide the service and on the Controller's documented instructions, including with regard to international transfers, unless required otherwise by law; (b) ensure persons authorised to process the data are bound by confidentiality; (c) implement the technical and organisational measures described below; (d) assist the Controller, insofar as reasonably possible, in responding to data-subject requests (access, rectification, erasure, portability, objection); (e) assist the Controller with its obligations regarding security and data-protection impact assessments, taking into account the information available to drop; (f) delete or return all personal data at the end of the provision of services, at the Controller's choice (content can be deleted in-app at any time; account deletion can be requested by email); and (g) make available the information necessary to demonstrate compliance with Article 28 GDPR.
The Controller gives general authorisation to the following sub-processors: Cloudflare (hosting, storage, networking), Google (authentication), Resend (transactional email), and Amazon Web Services (transient page-thumbnail rendering, EU region). drop will inform the Controller of intended changes to this list — by updating this page and, for material changes, by email — giving the Controller the opportunity to object on reasonable data-protection grounds. drop remains liable for its sub-processors' performance.
Encryption in transit (TLS) for all traffic; encryption at rest for stored content, with per-workspace data keys wrapped by a master key; access to private content restricted to authenticated workspace members; signed, expiring URLs for private media; HttpOnly signed session cookies; infrastructure hosted on Cloudflare with no customer data on developer machines.
drop will notify the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller's data, with the information reasonably required for the Controller to meet its own notification obligations.
Data is primarily processed within Cloudflare's network and AWS EU regions. Where a transfer to a third country subject to the GDPR occurs, it is covered by the European Commission's Standard Contractual Clauses entered into with the relevant sub-processor, or another valid transfer mechanism.
drop will make available information reasonably necessary to demonstrate compliance with this DPA (including summaries of third-party audits or certifications of its sub-processors, where available). Where the Controller requires an audit under Article 28(3)(h) GDPR, the parties will agree on its scope, timing and conditions; audits are satisfied by written responses and documentation wherever reasonably sufficient.
Questions about this DPA, or account/data deletion requests: contact@neuronik.io.