GDPR processing matrix
The purposes, legal bases, recipients, retention windows, and rights that apply to European personal data.
Account and identity
Purpose: authentication, workspace access, and fraud prevention. Legal bases: contract and legitimate interests. Data: name, email, session and security events. Recipients: Cloudflare and authorized Sansa Vision personnel. Retention: account life plus up to 30 days, with security logs normally kept 12 months.
Projects and feedback
Purpose: provide the requested build, proof, collaboration, release, and support functions. Legal basis: contract; the customer determines the basis for personal data it uploads. Recipients: Cloudflare, scoped OneClient services, and customer-authorized members. Retention: customer-controlled, then deletion within 30 days and backup aging within 90 days.
Billing
Purpose: subscription, entitlements, fraud, tax, and accounting. Legal bases: contract and legal obligation. Recipients: Stripe and Link. Retention: up to 7 years where required. One Studio does not store full payment card data.
Rights and requests
Data subjects may request access, correction, deletion, portability, restriction, or objection, withdraw consent, and complain to a supervisory authority. Requests are normally answered within one month. Automated decisions with legal or similarly significant effects are not used for One Studio accounts.
Transfers and processors
Transfers outside the EEA rely on adequacy decisions or approved safeguards such as standard contractual clauses. Our DPA lists processor obligations and subprocessors. Customers must configure their projects lawfully and provide notices to their own end users.