Data Processing Addendum
Draft for counsel review — not legal advice, not a binding agreement until executed. Last updated 2026-06-22.
The short version: your content stays in your cloud, so for almost everything that matters we are not in the data path at all.
Steamshovel is a control-plane / data-plane split. Your documents, spreadsheet contents, search queries, embeddings, model prompts, and analytical results are processed by Stratum — the analytical runtime that runs in your own cloud account. They never reach us. We process only a thin stream of structural control-plane data.
What we process (and our role)
- Telemetry — liveness, version, error/latency counters, cross-suite traffic counts. No document content. You are the controller; we are the processor.
- Feedback — text and screenshots you explicitly submit in-product (user-consented at submission).
- A salted, non-reversible user identifier (HMAC) where a per-user signal is needed — never a raw email or name.
What we never process
Document bodies, spreadsheet contents, search queries, embeddings, analytical results, and LLM prompts/outputs. These stay in your cloud (Stratum) and go to your own LLM provider — never to steamshovel.ai. For that data, we are neither controller nor processor.
Your LLM provider is not our sub-processor
Under bring-your-own-key, your LLM key dispatches direct to the provider from your own cloud. You contract the provider directly; we never hold the key or see the prompts.
Your rights, in-product
- Erasure (Art 17) — "Delete all my data" in the sidebar.
- Portability (Art 20) — "Export my data" downloads a machine-readable NDJSON copy.
Retention
Your captures, projects, citations, and embeddings live in your cloud — you keep them as long as you want and erase them on demand. The only data we hold — structural telemetry counters and the feedback you submit — is deleted on a 90-day schedule (the feedback after the reported issue is closed). The full per-category retention schedule is in our privacy policy.
Identifiers
Where a stable per-user signal is needed, we use a salted HMAC of your email — keyed by a secret held only in your own install and never sent to us — not a reversible hash. We never store your email or name.
Region (international transfers)
Your prompts go direct to the LLM provider you choose, from your own cloud — we are not in that path. You can pin a regional endpoint (e.g. an EU region) and the status bar attests the region your prompts go to. The only transfer involving us is the structural telemetry, under Standard Contractual Clauses. See our Transfer Impact Assessment for the full analysis.
Sub-processors for the structural control-plane data are listed at sub-processors. We give 30 days' notice of any change.