Version v1 · Effective 15 July 2026
For nearly everything on Panoply, we are the controller. We decide what data is collected and why, and we answer for it. The Privacy Policy covers that, and no agreement between us is needed.
This agreement is for one situation: you are a business, you use an app on Panoply, and you put your own customers' or staff's personal data into it. Then you are the controller of that data, we process it for you, and Article 28 of the GDPR says we need this in writing.
If that is not you, you do not need this. Ask at support@panop.ly if you are unsure.
You, the customer, as controller.
Packaging Solved Kft. (registration number 01-09-441011, seat 1092 Budapest, Kinizsi utca 11. 3. em. 19., Hungary), trading as Panoply, as processor.
This sits alongside the Platform Terms of Service and the Buyer Terms. On anything about processing your data, this wins.
Subject matter: hosting an app you use, and storing what you put into it.
Duration: for as long as you use the app, plus the deletion period in section 9.
Nature and purpose: storing, retrieving and displaying the data your app holds, so the app works.
Types of data: whatever you put in. We do not choose it and we do not look at it.
Categories of people: whoever you put in. Your customers, your staff, your contacts.
You decide all of it. We just hold it.
We process your data only on your instructions. Using the app is the instruction.
We do not look at it, mine it, sell it, or use it for anything of our own. We do not train AI on it.
If a law forces us to process it some other way, we tell you first, unless the law forbids us from saying.
If you instruct us to do something we think breaks data protection law, we will tell you.
Anyone with access is bound to keep it confidential. That is a small number of people and it is limited to what is needed to run the platform and fix faults.
Encrypted in transit and at rest. Access controlled and limited. Backups. Every app reviewed before it is listed.
We keep this proportionate to the risk, and we will tell you what we do if you ask.
We use these to run the platform, and they may hold your data:
| Who | What for | Where |
|---|---|---|
| Supabase | Database and sign-in | EU |
| Cloudflare | Runs the apps | US |
| Vercel | Runs the website | US |
They are bound by terms no weaker than these.
If we add or change one, we will tell you at least 30 days before, and you can object. If you object and we cannot resolve it, you can stop using the app and we will refund you for what you have not used.
Some of the above are in the United States.
Where data goes there, we rely on the European Commission's standard contractual clauses, and on the EU-US Data Privacy Framework where a company is certified under it. Ask and we will show you.
If someone asks you for their data, or to delete it, and you cannot do it yourself in the app, tell us and we will help.
If there is a breach that touches your data, we tell you without undue delay, with what we know: what happened, who is affected, what we are doing.
If you need a data protection impact assessment or have to talk to a regulator, we will give you what you need.
If you want to check us, ask. We will answer, and where a real audit is needed we will arrange one, once a year, at reasonable notice, at your cost unless we have got something wrong.
Tell us to delete it or return it. We will do whichever you say.
If you say nothing, we delete it 30 days after you stop using the app.
We keep nothing, unless a law makes us, in which case we tell you what and why.
Each of us is responsible for our own compliance.
Our liability under this agreement is capped as set out in the Buyer Terms. Nothing here limits what you or a person whose data it is can claim under Article 82 of the GDPR.
Hungarian law and EU law. Hungarian courts.
Email support@panop.ly and ask. We will countersign and send it back.
Questions: support@panop.ly
Packaging Solved Kft., 1092 Budapest, Kinizsi utca 11. 3. em. 19., Hungary. Registration number 01-09-441011.