Data processing terms

These terms are part of the terms of service between Chill Studio (“we”, the processor) and the business that holds the Acraft account (“you”, the controller). They meet Article 28 of the UK GDPR and of the EU GDPR. They apply to the personal data of your clients, contacts and team that you put into Acraft.

They apply automatically when you accept the terms of service; nothing needs signing.

• Subject matter and purpose: running Acraft for you: enquiries, clients, jobs, schedules, quotes, invoices, emails to your clients, and AI drafting and assistance.
• Duration: while your account is open, then until deletion as set out below.
• People concerned: your clients and their contacts, people who send you enquiries, your team members.
• Data: names, contact details, addresses, site details, notes, photos, documents, voice and video recordings, quote and invoice contents, online acceptance details (signature, time, IP address).
• Special category data: not needed by the service. Do not enter health or similar data unless you must, for example access needs for a job.

• We process the data only on your documented instructions, which are these terms and your use of the service, unless the law requires otherwise; we tell you if an instruction seems unlawful.
• Everyone who can access the data is bound by confidentiality.
• We keep appropriate security measures: encryption in transit, account separation, hashed passwords, access limited to named staff and logged, regular backups.
• We help you answer your clients’ requests (access, correction, deletion, export) and with security and impact assessments, where reasonable.
• We tell you without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting your data, with what we know.
• We give you the information needed to show compliance and answer reasonable audit questions in writing, once a year or after a breach.

You authorise the providers on our sub-processor list. We bind each one to data protection duties at least as protective as these terms and remain responsible for them. We announce new providers on that page at least 30 days ahead; you can object, and if we cannot address the objection you can close your account with a refund of the unused part of your subscription.

Your data is stored in France. Where a sub-processor is outside the UK and the EEA, the transfer relies on the UK–US data bridge or the UK International Data Transfer Addendum to the EU standard contractual clauses.

AI providers process data only to answer the request and may not train on it or keep it.

You instruct us to keep anonymised copies of AI-drafted quotes to improve our models, as described in the terms. Anonymised data is no longer personal data. You can withdraw this instruction at any time in your workspace settings.

You can export your data at any time from the settings. When you delete your workspace or the agreement ends, we delete your data from the live service straight away and from backups within 30 days, unless the law requires us to keep it.

You make sure you have a lawful basis for the data you put into Acraft and that your clients are told about it, for example in your own privacy notice, which can mention that you use Acraft (Chill Studio) to run your quotes, jobs and invoices.