Data processing practices

About this page

AutoSugges is an online-only service. This page describes how data you entrust to the service — including personal data of your own end users, if any list you author contains it — is processed. It is not a countersigned Article 28 data processing agreement, and one is not available today.

Scope of processing

Processing is limited to: storing the rows you author in your isolated tenant, publishing them as versions, serving those versions from the edge in response to a query, and recording aggregate selection signal (which canonical item was shown and picked, tied to a request id rather than an end-user identity) to improve future ranking.

Sub-processors

The following sub-processors are engaged, each for the purpose stated:

• Supabase — Database for account and tenant data, and authentication for sign-in.
• Cloudflare — Edge hosting and storage of published versions, and bot/abuse challenge (Turnstile) at sign-up and key provisioning.
• Stripe — Payment processing and subscription billing.
• Bird — Delivery of transactional email (e.g. account and billing notifications).

Isolation and access controls

Your data is isolated from every other tenant's. Autocomplete never queries your database — it serves only your verified, published versions. Credentials and billing records are stored separately from your list data.

Retention and deletion

The active published version of a list plus the five most recently superseded versions are retained; a superseded version's retention policy targets deletion from the edge 30 days after it is deactivated. Requesting deletion of a list or an account removes the corresponding control-plane rows.

Requests

For a sub-processor list update or a data-subject request, email support@autosugges.com.