# Data protection and compliance When you send content to CalmLens, you are the controller of any personal data in it and CalmLens processes it on your behalf under the [Data Processing Addendum](/dpa) (DPA). Read this page alongside the DPA, the [Privacy Policy](/privacy-policy) and the [Trust page](/trust) when you assess CalmLens for UK GDPR, EU GDPR, COPPA or a procurement review; if this page and those documents differ, the documents apply. ## Data Processing Addendum The [Data Processing Addendum](/dpa) forms part of the [Terms of Service](/terms) and applies automatically to every organisation, on every plan, with no separate signature. It covers: | Topic | What the DPA sets out | | -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Roles | You are the controller, or a processor acting for one; CalmLens is your processor or subprocessor. Account, billing and support records are covered by the Privacy Policy instead. | | Instructions | CalmLens processes content only on your instructions: the Terms, the DPA and your configuration, such as your moderation policy, retention settings and webhook destinations. | | No training or advertising | Customer content is never sold, used for advertising or used to train models. | | Subprocessors | General authorisation, with 30 days' notice of new subprocessors (see below). | | Personal data breaches | Notification without undue delay, with the information CalmLens reasonably can provide for your own obligations. | | Assistance | Help with data subject requests, data protection impact assessments and prior consultations. | | International transfers | The EU Standard Contractual Clauses (Module 2 or 3), the UK International Data Transfer Addendum and Swiss transfer terms, incorporated by reference. | | Audits | Answers to a security questionnaire once a year, and audits where that information isn't enough. | | Deletion | Deletion of customer content when the Terms end or the account is deleted. | Annex 1 describes the processing, Annex 2 lists the technical and organisational measures and Annex 3 lists the subprocessors. Before you rely on the transfer clauses, email your organisation's legal name, address, privacy contact and supervisory authority to [contact@calmlens.com](mailto:contact@calmlens.com); those details complete the clauses' annexes. ## Subprocessors The [subprocessor list](/trust#subprocessors) on the Trust page names every provider that may process account data or customer content and what each one does. The same list appears in Annex 3 of the DPA and section 5 of the Privacy Policy, with the date it last changed. ### Change notices At least **30 days** before a new subprocessor starts processing customer personal data, CalmLens emails your organisation's owners and members and updates Annex 3. You can object on reasonable data protection grounds within **14 days** of the notice by replying to it or writing to [contact@calmlens.com](mailto:contact@calmlens.com). If an objection can't be resolved, the DPA lets you stop using the affected services and end the Terms without penalty, with a refund of prepaid fees for the unused period. ## Retention Your settings decide how long content is kept: | Content | How long it is kept | | ----------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | Uploads through the API or SDKs | Deleted once processing finishes, whatever the decision, because `keepContentAfterProcessing` defaults to `false`. The asset record and its report remain. | | Uploads in the portal | Kept by default; switch off **Keep content after processing** to delete them after moderation. | | Kept content | Until you remove it, a purge action deletes it, or the account is deleted. | | Content that fails processing | Kept so the asset can be retried. | | Events | 90 days. | | Webhook and connector delivery logs | 30 days. | Content under a safety hold, a report of suspected illegal material, can't be deleted while the report is handled. Copies in caches and queues expire through normal operation. You can find, export, remove and delete content yourself, so you can answer data subject requests without contacting CalmLens. [Retention and visibility](/docs/guides/asset-lifecycle#retention-and-visibility) and [Deletion choices](/docs/guides/asset-lifecycle#deletion-choices) explain the asset states, and section 7 of the Privacy Policy covers account, billing and support records. ## Processing and storage regions CalmLens Ltd is based in the United Kingdom. Kept content is stored in one of three regions, chosen when it is uploaded from where the upload comes from: | Upload from | Storage region | | --------------------------------------- | -------------- | | Asia and Oceania | Asia | | North and South America | America | | Everywhere else, or an unknown location | Europe | Content derived from yours, such as extracted text, captured website pages and converted documents, is stored in Europe. Account, project, asset, usage and billing records are held in databases in Singapore, London, Frankfurt and Ohio (US). Projects can't choose a region, so EU-only storage isn't available, and the regions are location hints from the storage provider rather than strict residency guarantees. Moderation, transcription and text recognition happen wherever the provider doing them operates, which can be outside the storage region, including in the United States. Transfers out of the UK and EEA rely on adequacy decisions or the contractual clauses in the DPA. [Data storage and regions](/trust#data-storage-and-regions) on the Trust page has the full detail. ## Content from children You can use CalmLens to moderate content that children create or that shows or names children, such as posts on a school forum for under-13s. You remain the controller of that content, or the operator of the service under COPPA, and CalmLens processes it on your instructions under the DPA, the same way as any other content. The CalmLens portal and its accounts are for adult business users. The Privacy Policy's section on children is about who can hold an account, not about the content you submit. As the controller, you are responsible for the lawful basis, notices, parental consent and safeguards that children's data needs where your service and your users are. These choices help you limit what CalmLens holds: - **Moderate with the [Kids](/docs/guides/built-in-policies/kids) policy.** It blocks anything a parent wouldn't expect a child to see or share, including a child's own private details such as an address or phone number. - **Keep only what you serve.** Leave `keepContentAfterProcessing` off for content you store yourself, so CalmLens deletes it once it is moderated. - **Send only what moderation needs.** Leave names, account identifiers and other personal data out of file names, descriptions and metadata unless your app needs them back. - **Put people in the loop.** Automated moderation makes mistakes; give children and their parents a way to report content and ask for a decision to be reviewed. Every policy, including Kids, applies the [mandatory rules](/docs/guides/mandatory-rules) that block sexualised content involving children and content that seeks, offers or promotes child sexual abuse material. ## Security - **Private by default.** Assets are private unless you make them public. Private content needs an authorised session, an API key with download permission or a signed URL, which lasts at most 24 hours. - **Scoped credentials.** API keys work only for their own project, are stored hashed and can be revoked. Webhook signing secrets are stored encrypted. - **Encryption.** Data is encrypted in transit with TLS and at rest by the storage and database providers. - **Logs.** Request logs remove credentials, cookies and authentication headers. - **Staff access.** Limited to accounts with system permissions, used only for support, security, safety and legal reasons. CalmLens doesn't hold SOC 2 or ISO 27001 certification. The DPA commits to answering a reasonable security questionnaire once a year; send yours to [contact@calmlens.com](mailto:contact@calmlens.com). [Security](/trust#security) on the Trust page and Annex 2 of the DPA list the measures in full. ## Service status and reliability The [status page](https://status.calmlens.com) shows the current state of the website, the API and CDN delivery, with each one's daily history and any downtime. The portal shows the same overall state next to the logo. No service-level agreement or uptime commitment applies unless an order sets one. When part of the service is unavailable, CalmLens holds content back rather than publishing it unchecked: - **Moderation retries, then fails closed.** Temporary failures are retried automatically for about 15 minutes, using another moderation service when one is unavailable. If processing still can't finish, the asset fails with [`asset.failed`](/docs/api/events#event-asset-failed) and is never served. See [Recover from processing failure](/docs/guides/asset-lifecycle#recover-from-processing-failure). - **Unfinished moderation isn't delivered.** [Block assets until moderation finishes](/portal/proj_current/settings#block-unmoderated-assets), on by default, stops the CDN serving an asset until its moderation finishes. - **Missing evidence isn't treated as safe.** A category CalmLens couldn't assess is reported as `not-evaluated`, never as a zero score. - **Webhooks are retried for about 20 hours.** A failed delivery is retried up to 7 times, and you can redeliver it from the portal afterwards. See [Deliveries and retries](/docs/guides/notifications#deliveries-and-retries). - **The events feed is the backstop.** Every event stays in the [events feed](/docs/api/events#reading-the-feed) for 90 days, so your app can read from a saved cursor to catch up on decisions it missed while your endpoint was down. - **Retries don't create duplicates.** Send an `Idempotency-Key` with uploads so a retried request returns the first response; see [Retrying requests safely](/docs/guides/error-handling#retrying-requests-safely). [Availability and incidents](/trust#availability-and-incidents) on the Trust page explains how maintenance, changes and security incidents are communicated.