GDPR & Data Processing

How ScreenLast Cloud is built to satisfy the GDPR: EU data residency, a signable DPA, a short subprocessor list, and documented technical measures.

DPA versionv2.1 — July 2026

Data residencyEU — Frankfurt & ViennaAll primary storage and render workers run in EU data centers

DPA / AVVRequest the DPA (PDF) Pre-signed Art. 28 GDPR agreement, countersign digitally

EncryptionTLS 1.3 + AES-256 at restPer-organization encryption keys, rotated automatically

Data protection contactinfo@screenlast.comAnswers within one month, usually much faster

01Our role as processor

For content you bring into ScreenLast Cloud — flows, recordings, voice-over scripts, rendered videos — your organization is the controller and PLANFRED GmbH acts as processor under Art. 28 GDPR. For account and billing data we act as controller; see the privacy policy.

02Data processing agreement

Every paid organization can sign our standard DPA directly in the organization settings. It covers instructions, confidentiality, subprocessor changes with objection rights, deletion deadlines, and audit support.

The DPA download and digital countersigning live in the Cloud dashboard under Settings → Compliance.

03Subprocessors

We keep the list deliberately short. Current subprocessors:

Hetzner Online GmbH (DE) — primary hosting and render workers.
Bunny.net (SI) — video delivery CDN, EU PoPs preferred.
Postmark / ActiveCampaign Inc. (US) — transactional e-mail, SCCs in place.
Stripe Payments Europe Ltd. (IE) — payment processing.
Voxtral SAS (FR) — hosted voice synthesis, only when Managed AI is enabled.

04Technical and organizational measures

Isolation: each organization renders in dedicated, short-lived runner sandboxes.
Access control: role-based access, SSO and 2FA, least-privilege for operators.
Logging: administrative access to customer content is logged and reviewed.
Backups: encrypted, EU-located, tested restores; 35-day rolling window.
Deletion: organization deletion propagates to backups within 65 days in total.

05AI features and your data

Managed AI (narration drafts, translations, voices) processes content only to produce the requested output. Nothing is used for model training. If you bring your own model keys in the desktop app, prompts go directly from your machine to your provider — our cloud never sees them.

06Data subject requests

If you receive a request from a data subject that concerns content stored in ScreenLast Cloud, we assist with export, rectification, and deletion tooling. Send requests concerning ScreenLast itself to info@screenlast.com.