Data Processing Agreement (summary)

Last updated October 29, 2026

This is a summary of our Data Processing Agreement. The full DPA, including Standard Contractual Clauses where needed, is available on request at hello@northlogic.co.

Topic	Summary
Roles	You (the customer) are the controller. BurnGuard is the processor.
Purpose	Detecting fraudulent, abusive or duplicate signups, logins and trial starts in your project.
Data subjects	Your end users who sign up, log in or start a trial.
Data categories	Email address, IP address, opaque device token, user agent, your user id, usage amounts you report. No special-category data.
Instructions	We process data only on your documented instructions: your API calls and project settings.
Retention	Raw records are deleted after your plan's history window (7, 30 or 90 days). Aggregates without personal data are kept.
Subprocessors	Hosting provider, Stripe (billing data only), Resend (account emails only). Notice before changes.
Security	Encryption in transit, hashed credentials and API keys, least-privilege access, logging.
Confidentiality	Personnel with access are bound by confidentiality.
Assistance	We help you answer data subject requests and with security and impact assessments.
Breach notice	We notify you without undue delay, and within 72 hours, of a personal data breach affecting your data.
Deletion	On termination we delete your project data within 30 days, unless law requires otherwise.
Cross-customer use	Your end users' data is never used to score another customer's signups.