Legal menu

Data processing agreement

How Chartshot handles personal data in the charts you send, under UK and EU data protection law.

Last updated 25 Oct 2026

About this agreement

This agreement is part of the terms of service between you and Chartshot ("we"). It applies when the data you send to Chartshot includes personal data: names in chart labels, for example, or figures about a person. You accept it with the terms, so there's nothing to sign. If you need a signed copy for your records, email support@chartshot.dev.

It covers the UK GDPR, the UK Data Protection Act 2018, the EU GDPR and other data protection laws that apply to that data. Words such as "controller", "processor", "personal data" and "personal data breach" mean what those laws say.

Roles

For personal data in your chart specs, saved themes and stored charts ("your data"), you're the controller, or a processor for your own customer, and we're your processor. You're responsible for having a lawful basis to send it.

For your account data, such as your email address and usage, we're the controller, and the privacy policy applies instead.

What we do with your data

We process your data only to provide Chartshot under the terms: to draw, store, cache and serve your charts. Your use of the API and dashboard, and the settings you choose, are your instructions. If we think an instruction breaks data protection law, we'll tell you.

Annex 1 describes the processing.

Our people

Only people who need to work on Chartshot can reach your data, and they're bound to keep it confidential.

Security

We protect your data with the measures in Annex 2 and keep them up to date as risks and technology change.

Subprocessors

You authorise us to use the subprocessors on the subprocessors page. Each is bound by a written agreement with data protection terms at least as protective as this one, and we stay responsible for their work.

We email you at least 30 days before a new subprocessor starts handling your data. If you have a reasonable data protection objection, email us within that time and we'll work with you to resolve it. If we can't, you can end the affected service and we'll refund the unused part of your paid period.

Transfers outside the UK and EU

Your data is stored in the UK and the EU. Cloudflare also keeps cached copies of chart images at the location nearest each viewer, which can be outside them. Where a subprocessor handles it elsewhere, we rely on an adequacy decision, such as the EU-US Data Privacy Framework and its UK extension, or on the EU standard contractual clauses with the UK addendum.

We're in the UK, which the EU recognises as giving adequate protection, so sending your data to us from the EU needs no further safeguard.

Helping you

We'll help you, as far as we reasonably can given what we process:

• answer requests from people exercising their data protection rights; if one reaches us directly, we'll pass it to you
• with data protection impact assessments and consultations with regulators about Chartshot

Much of your data you can see and delete yourself: stored charts and saved themes in the dashboard or through the API.

Personal data breaches

If we become aware of a personal data breach affecting your data, we'll tell you without undue delay, and within 48 hours. We'll tell you what happened, what data and people it affects, and what we're doing about it, and keep you updated as we learn more.

Deletion

When your account closes, we delete your data within 30 days, and copies in backups expire within 5 weeks after that, unless the law requires us to keep it. Before you close your account, you can save stored chart images from their URLs and fetch your themes through the API, or email us and we'll send you your stored specs and themes.

Audits

We'll give you the information you reasonably need to show that we meet this agreement, and answer a reasonable security questionnaire once a year. If that isn't enough, or a regulator requires it, you may audit us, once a year at most, with 30 days' notice, at your own cost, and under a confidentiality agreement.

Liability

Each party's liability under this agreement is subject to the limits in the terms. If this agreement and the terms conflict on data protection, this agreement wins.

Annex 1: the processing

• Subject matter and purpose. Drawing, storing, caching and serving chart images from the specs you send.
• Duration. While you use Chartshot, and until deletion as described above.
• Nature. Receiving specs through the API, drawing them as images, storing the specs and images you choose to store, and caching images on Cloudflare's network.
• Types of personal data. Whatever you put in specs and themes. Chartshot needs none to work; it's typically names or labels and the figures charted against them.
• People it may be about. Your customers, users, staff or others you chart data about.
• Special category data. Chartshot isn't meant for health, biometric or other special category data, or data about criminal convictions. Don't send it.

Annex 2: security measures

• All traffic uses TLS. The API refuses requests that don't come through Cloudflare.
• Secret keys are stored only as SHA-256 hashes. Signing keys are encrypted with AES-256-GCM, with the encryption key kept apart from the database.
• The database and stored images are encrypted at rest by Neon and Cloudflare.
• API request logs hold the route, status, timings, the spec's size and hash, and which key was used, never the spec or IP addresses. Error reports leave out chart data.
• Specs are data only: no scripts, HTML or remote URLs. Charts draw in worker threads with a time limit for each chart, so a slow spec can't hold up others.
• Each account's data is reached only through checks that it belongs to that account.
• Only the people who run Chartshot can reach production systems, through accounts with two-factor authentication.
• The database has point-in-time restore for 7 days.

Annex 3: subprocessors

The subprocessors page lists them, with what each does and where.