1. Role Under GDPR
For customer-controlled data processed via the Stackmint platform, Stackmint typically acts as a processor, and the customer acts as the controller.
As a processor, Stackmint processes personal data only on documented instructions from the customer, primarily through:
- Configuration of Branches and Buds
- Activation of integrations and model providers
- API calls and runtime execution requests
- Settings applied in the admin console
2. Data Processing Agreement
Stackmint offers a Data Processing Agreement (DPA) that incorporates the obligations required by GDPR Article 28, including:
- Processing limited to customer instructions
- Confidentiality obligations for authorized personnel
- Appropriate technical and organizational security measures
- Conditions for engaging subprocessors
- Assistance with data subject requests and incident response
- Deletion or return of personal data at end of engagement
The current DPA is available at /dpa.
3. International Transfers
When Stackmint processes personal data subject to EU, UK, or Swiss data protection laws and such data is transferred to a country without an adequacy decision, Stackmint will implement appropriate safeguards — such as Standard Contractual Clauses or equivalent mechanisms.
4. Data Subject Rights
Customers remain responsible for managing data subject requests related to their own users and data. Where a request relates to personal data processed by Stackmint on behalf of a customer, Stackmint will provide reasonable assistance in line with the DPA and applicable law.
5. Contact
For GDPR-related questions: