Data processing.
This page describes the processing arrangement offered with Plumb by Clap Digital, Co. It is a transparent summary, not a countersigned agreement. Customers who need a signed DPA or transfer terms should contact us before uploading regulated personal data.
Roles and instructions
For customer account content and scan instructions, the customer is controller and Plumb is processor. Plumb processes that data only to provide, secure, support and document the service, including scheduled scanning, notifications and customer-requested integrations. Plumb is an independent controller for its own account security, billing and first-party service analytics.
People and data
Data may concern account users and people whose details appear on a customer’s public business surfaces. Categories can include identifiers, contact details, public profile information, website content, customer-declared facts, usage records and scan evidence. Customers should avoid placing special-category or highly sensitive personal data in reference notes.
Confidentiality, security and assistance
Authorised personnel and subprocessors are bound to confidentiality. Plumb applies the controls on the security page, will assist reasonably with data-subject requests and incident investigation, and will notify affected customers without undue delay after confirming a breach of customer data.
Subprocessors
- Fly.io — application hosting, storage and network delivery.
- Resend — transactional email, when configured.
- Stripe — checkout, subscription and billing records, when configured.
- Google Identity Services — account authentication when a user chooses Google sign-in.
- Google Places and Meta public surfaces — only for the connected or configured checks a customer asks Plumb to perform.
Return, deletion and audit
Customers can remove properties and eligible accounts through the product and can request export or deletion by email. Backup copies expire through the normal snapshot lifecycle. On reasonable request, Plumb will provide current security and subprocessor information sufficient to assess the service; on-site audits require a separate written arrangement.
Transfers and signature
Processing may occur outside a customer’s country. Where the law requires a transfer mechanism, the parties will execute the applicable standard contractual clauses or another valid mechanism. Request a signed version at payments@clapdigital.co.