Last updated 2026-04-01 · version 2.0. Forms part of the Terms when you process personal data through Misano.
You (the customer) are the data controller for any personal data you upload to Misano. We (Point FM Services s.r.o.) are the data processor.
This DPA applies to the extent you process personal data subject to GDPR (or equivalent EU/EEA, UK, or Swiss law) through Misano.
We process the personal data you upload — names, contact details, beneficial-owner data extracted from registries, financial filings, KB notes — solely to provide the Misano product to you.
We do not process your data for our own purposes, for marketing, or for any third party. We do not use your data to train AI models.
We use Supabase (database), Anthropic and OpenAI (LLM inference), Exa (web search at your direction), Stripe (payments), and Resend (transactional email). The current list is published at /legal/sub-processors and updated whenever it changes.
We give you 30 days’ notice of any new sub-processor. If you object, you may terminate the affected service for cause.
Encryption at rest (AES-256) and in transit (TLS 1.3). Per-tenant isolation at the database (row-level security). Access logging with audit trail. Backup retention 30 days. Yearly third-party penetration test.
See /security for the operational detail.
Customer data is stored in the EU (Supabase Frankfurt). Where any sub-processor (notably Anthropic) operates infrastructure outside the EU, transfers are made under EU Standard Contractual Clauses (SCCs) and supplementary measures as required by the EDPB.
We assist you in responding to access, rectification, deletion, and portability requests from your data subjects, within the timelines required by GDPR.
We notify you of a personal data breach without undue delay and at the latest within 48 hours of becoming aware, with all the information required under GDPR Art. 33.
Once per year, you may request a written audit of our security practices. We respond with our current trust report, sub-processor list, and an answered security questionnaire within 30 working days.
This DPA runs for the duration of your subscription. On termination, we delete your personal data within 90 days, except where retention is required by law (notably for invoicing under Czech accounting law).
Data protection questions: founder@misano.ai. Formal notices: legal@misano.ai.