RetainQ

LEGAL

GDPR Commitment

Last updated: August 2026

Our Commitment

RetainQ, a product of Webriy, is committed to handling personal data responsibly and in accordance with the General Data Protection Regulation (GDPR). This page outlines how we approach data protection for users in the European Economic Area (EEA).

Data Controller vs Data Processor

You are the Data Controller for your end customers' personal data collected through RetainQ flows. You determine what data to collect and how it is used.

RetainQ (Webriy) acts as a Data Processor when handling your end customers' data on your behalf. We process this data only as instructed by you and in accordance with our Data Processing Addendum.

Lawful Basis for Processing

We process personal data under the following legal bases:

  • Contract performance - To provide the RetainQ service you signed up for
  • Legitimate interest - For security, fraud prevention, and service improvement
  • Consent - Where required, such as for optional communications

Data Subject Rights

Under GDPR, individuals have the right to:

  • Access - Request a copy of personal data we hold
  • Rectification - Correct inaccurate personal data
  • Erasure - Request deletion of personal data ("right to be forgotten")
  • Portability - Export data in a machine-readable format (CSV export available)
  • Restriction - Limit how their data is processed
  • Objection - Object to data processing based on legitimate interest

As the Data Controller, you are responsible for responding to data subject requests from your end customers. RetainQ provides tools (CSV export, customer deletion) to help you fulfill these requests.

Data Security Measures

  • Row-level security (RLS) on all database tables for workspace isolation
  • API keys hashed with SHA-256 (never stored in plaintext)
  • SSRF protection on webhook endpoints
  • Google reCAPTCHA v3 on authentication flows
  • Rate limiting via Upstash Redis to prevent abuse
  • HTTPS encryption for all data in transit

Sub-Processors

We use the following sub-processors to operate RetainQ:

  • Supabase (US/EU) - Database and authentication infrastructure
  • Amazon Web Services (AWS SES) - Email delivery
  • Upstash - Redis for rate limiting
  • Vercel - Application hosting and edge network
  • Google - reCAPTCHA bot protection

Data Breach Notification

In the event of a personal data breach, we will notify affected data controllers within 72 hours of becoming aware of the breach, as required by GDPR Article 33.

Contact Our Data Protection Team

For GDPR-related inquiries, contact us at info@retainq.com.

RetainQ is a product of Webriy.