Data Processing Terms

Last updated: 28.10.2026

This page applies when we host a site for you and process personal data of that site’s readers and members on your behalf. You are the controller; we are the processor (GDPR Article 28). It is part of the Terms of Service.

1. Subject and duration. We host your Ghost site and process its data for as long as the agreement lasts.
2. Nature and purpose. Storage, backup, delivery of the site and of email. Nothing else.
3. Types of data and people. Member names and email addresses, comments and subscription status of your readers and members.
4. Your instructions. We process data only on your documented instructions (these terms and your use of the service), and tell you if we think an instruction breaks the law.
5. Confidentiality. Everyone with access to the data is bound to confidentiality. Only me
6. Security measures. The measures listed in the Privacy Policy.
7. Sub-processors. You give general permission for the providers listed in the Privacy Policy. We tell you 30 days before adding or replacing one, and you may object.
8. Helping with requests. We help you answer access, deletion and similar requests from your members, for example by exporting or removing a member.
9. Breach notice. We tell you without undue delay, aiming for within 24 hours, after we learn of a breach affecting your data.
10. Deletion or return. When the agreement ends we return the data (an export) and delete it, including backups after 30 days.
11. Audits. We give you the information needed to show compliance and allow reasonable audits.

If you connect your own Mailgun account for newsletters, that provider works for you directly, not through us.