Who's responsible for what
Under data-protection law such as the GDPR, the personal data you put into your documents — your clients' names, contacts and project details — belongs to your relationship with those people. You are the data controller; you decide what's collected and why.
waxTable, as a product of Buzzi AI, acts as a data processor: we process that data on your behalf, under your instructions, to provide the service. We don't decide what you collect or how you use it with your clients.
| Role | Who | Responsible for |
|---|---|---|
| Controller | You | Deciding what personal data is collected and why, and your lawful basis |
| Processor | Buzzi AI (waxTable) | Processing that data securely on your behalf to run the service |
| Sub-processor | Our vendors | Specific functions we rely on — see sub-processors |
What we process, and why
We process the data you give us to do the job you've asked for: drafting, designing, storing and sending your documents, and running your account.
- Account data — your name, email and workspace settings — to give you access.
- Document and project data — the briefs, content and client details you provide — to generate and store your documents.
- Billing data — to manage your plan and credits; see how credits work.
- Usage and security data — to keep the service reliable and secure, including the audit log.
Data subject rights
The people whose data you hold have rights — to access, correct, export and erase their personal data. Because you're the controller, those requests come to you, and we help you act on them.
- Access and export — produce a copy of the data you hold; see data export & erasure.
- Correction — edit documents and account details directly.
- Erasure — delete documents, projects or account data on request.
- Portability — take a print-ready copy via export and download PDFs.
Signing a Data Processing Agreement
A Data Processing Agreement (DPA) is the contract that sets out how we process personal data on your behalf, our security commitments, the use of sub-processors and how international transfers are handled. Many businesses need one on file for their own compliance.
Read the DPA
Our DPA is available from the legal pages on the marketing site. Review it alongside the privacy policy and terms.
Request execution
If you need a counter-signed copy, email support with your company details.
Keep it with your records
Store the signed DPA where your compliance team can find it, and note the sub-processor list referenced within it.
International transfers and sub-processors
Running a modern service means relying on infrastructure and tooling vendors, some of which may operate across borders. Where personal data is transferred internationally, we rely on appropriate safeguards as set out in the DPA.
The vendors we use to deliver the service are our sub-processors. We keep a list and describe what each one does — see sub-processors.