Data processing. When your decks hold other people's data.

Roles

You are the controller of the personal data in your decks, and we are your processor. This covers what your decks contain: text, notes, code, images, video and other media, and the names and e-mail addresses in their commits.

For everything else, such as your account and payments, we are the controller ourselves (privacy policy).

What we do with it

We store, back up, check and compile your decks, and show them to you and to anyone who opens a deck link, for as long as you use Tobos. That is the whole purpose. The people concerned and the kinds of data are whoever and whatever you put in your decks. Don't put special categories of personal data (Art. 9 GDPR) in them.

Your instructions

We process the data only on your instructions: our terms, and what you do in Tobos. We also follow instructions you send to hey@tobos.ai, unless they would change the service; then we tell you. If we think an instruction breaks data protection law, we tell you. If the law requires us to process the data otherwise, we tell you first, unless the law forbids it.

Handling reports of illegal content and orders from authorities is our own duty under the Digital Services Act and Regulation (EU) 2021/784; for that, we are the controller (see the privacy policy).

Confidentiality and security

Only our managing director has access to the data; anyone we let work on Tobos later is bound to confidentiality first. We protect the data with these measures and keep them up to date:

• our server, object storage and backups are at Hetzner, in Germany;
• every connection is encrypted (HTTPS with HSTS);
• login codes, sessions and tokens are stored only as hashes;
• decks are shown from a separate domain, without cookies and with a strict content security policy, and we never run deck code on our servers;
• only our managing director can reach the server, by SSH key;
• backups are kept for 30 days.

Sub-processors

We use Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, to host the data in Germany, under a data processing agreement with the same duties as this one. You agree to this. We tell you by e-mail at least 30 days before we add or replace a sub-processor. You can object for an important reason; if we can't meet your objection, you can end the contract before the change.

We store and process the data only in the EU or the EEA. Showing a deck to whoever opens its link, wherever they are, is on your instruction.

Helping you

We help you, as far as we can, to answer requests from the people concerned and to meet your duties under Art. 32–36 GDPR. If someone asks us directly, we pass the request on to you. We tell you without undue delay, and within 48 hours of finding out, of a personal data breach affecting your decks, with what we know.

Deletion and proof

When the contract ends, you choose whether we return the data or delete it. To have it returned, clone your decks and ask us for their media files within 30 days; we send them to you. We delete the data 30 days after the contract ends, or sooner if you ask, and from backups within another 30 days, unless EU or member state law requires us to keep it.

On request, we give you the information you need to show that we keep to this agreement, and answer your questions in writing. If that isn't enough, you, or an auditor bound to confidentiality, may inspect our compliance once a year, or more often after a personal data breach or if a supervisory authority asks, with 30 days' notice, or sooner after a breach.

Everything else

Our terms apply, including their limits of liability. Where this agreement and the terms disagree on data protection, this agreement prevails.

Version 1, in force since 12 October 2026.