Every byte, accounted for.

Our role under GDPR

What we process

We do not sell personal data. We do not train AI models on customer content. We do not use your data to enrich any other product or service.

Your rights as a data subject

Anyone whose personal data Idukki holds can exercise the following rights at any time. Email privacy@idukki.io and we’ll respond within 30 days (usually 72 hours).

• Right of access

  Request a copy of every piece of personal data we hold about you.

• Right to rectification

  Have inaccurate or incomplete personal data corrected.

• Right to erasure

  Ask us to delete personal data — also known as the right to be forgotten.

• Right to data portability

  Receive your data in a structured, commonly used, machine-readable format (JSON).

• Right to restrict

  Limit the processing of your data in certain circumstances.

• Right to object

  Object to processing based on legitimate interests or direct marketing.

You also have the right to lodge a complaint with your supervisory authority — in the UK, that is the ICO. We’d ask you to talk to us first, but we’ll never get in the way of you exercising that right.

Sub-processors

The vendors below process personal data on our behalf. Each is bound by a written agreement that mirrors our own GDPR obligations. We notify customers at least 30 days before adding or replacing any sub-processor.

Subscribe to sub-processor updates at privacy@idukki.io.

International transfers

Our production environment is hosted in the EU (AWS Frankfurt + Ireland). Some sub-processors are based in the US. Where data leaves the EEA, we rely on the European Commission’s Standard Contractual Clauses (2021/914) as well as supplementary technical and organisational measures — encryption in transit and at rest, no-train commitments, audit rights and breach notification timelines tighter than the regulation requires.

For customers on our Enterprise plan, we offer EU-only data residency: all data — including derived AI embeddings — stays inside the EU at all times.

Retention + deletion

• Active accounts — we keep your data for as long as your account is active.
• Closed accounts — we delete or anonymise within 90 days of closure. You can also request immediate deletion.
• UGC + rights records — kept for the duration of your subscription, then exported to you on request and deleted.
• Logs + backups — application logs purged after 90 days, encrypted backups rolled off after 30 days.
• Legal hold — where law requires (e.g. invoices, tax records), we retain only what’s necessary.

Security measures

• TLS 1.3 in transit, AES-256 at rest
• SOC 2 Type II audited annually
• ISO 27001 certified
• Pen-tested quarterly by Cure53
• Bug bounty program with HackerOne
• Role-based access control + audit logs on every admin action
• Encrypted database backups, retained 30 days, geo-redundant
• Mandatory MFA for all employees + vendor access

Data Processing Agreement

Our DPA is pre-signed by Idukki and incorporated into every customer agreement. It includes the updated Standard Contractual Clauses (Modules 2 and 3) and the UK Addendum. No negotiation needed for the standard terms.