Last updated 5 November 2026
For customers who put other people's personal information into a workspace: their clients, the people they invite, the names on their invoices. It sets out what we may do with that information, as Article 28 of the GDPR requires. It forms part of the terms of service; there is nothing separate to sign.
You are the controller of what you put into your workspace. count23 OÜ (registry code 16892779) is your processor for it, and acts on your instructions.
We are a controller in our own right for the account and billing data we need to run the service. The privacy policy covers that part, not this agreement.
If one of your own clients asks what you hold about them, that is your question to answer. We will help you answer it.
Subject matter and purpose: providing time tracking, reporting, invoicing, the API and AI-assistant access, and the page annotator, as described in the terms of service.
Duration: as long as your account is open. This agreement ends when the account does.
Types of personal data: names and contact details of your clients and the people you invite; billing details you enter on an invoice, including legal names, addresses, registry and VAT numbers; task, project and time records that may name people; and the contents of any web page you ask the annotator to capture, which we cannot see in advance.
Data subjects: your clients and their staff, the colleagues and collaborators you invite, and anyone identifiable on a page you capture.
We process your workspace data only on your documented instructions. Using the product is the instruction: creating an invoice tells us to store it, capturing a page tells us to render and keep the picture, connecting a tool tells us to answer it.
We will tell you if we think an instruction breaks data protection law, and we may decline it.
If a law obliges us to process your data for something else, we will tell you first, unless that law forbids it.
Everyone with access to your data is bound to keep it confidential. Today that is one person, the owner of the company.
In place: encryption in transit; passwords and API tokens stored only as hashes; nightly backups encrypted before they leave the server; uploaded files and captured pages served only through expiring links; a strict content security policy; access to a workspace limited to its members; and separate rights for administrators and collaborators, including who sees money.
You give us general permission to use the subprocessors below. We will tell you before adding or replacing one, and you may object. If we cannot resolve your objection, you may end the agreement by closing your account.
Zone Media OÜ, Estonia: hosting and email.
Cloudflare: encrypted database backups, and private storage for annotator pictures.
ScreenshotOne: rendering a page you asked to capture.
Stripe handles payments as a controller in its own right, not as our subprocessor. Google is involved only in sign-in, if used, and in analytics where a visitor opted in; neither touches workspace data. An AI provider you connect with your own key acts under your own agreement with it.
Where a subprocessor is outside the European Economic Area, the transfer relies on the EU–US Data Privacy Framework or the standard contractual clauses.
Rights requests: the product already lets you see, correct, export and delete what is in your workspace. Where that is not enough, write to us and we will help, free of charge, in time for your own deadline.
If someone contacts us directly about data in your workspace, we will not answer for you. We will refer them to you and tell you it happened.
Breaches: if one affects your data, we will tell you without undue delay after we learn of it, with what we know, so that you can notify in time.
We will also help, as far as reasonable and with the information we hold, with your security obligations and any impact assessment you must carry out.
While the account is open, your profile gives you a full export as a JSON file.
When you close the account, everything in a workspace only you belong to is deleted, invoices included. We keep no copy. Export first if your own rules require you to keep anything.
Backups are the one delay: deleted data can remain in an encrypted nightly backup for up to 14 days before it is overwritten.
Ask, and we will give you the information needed to show we meet this agreement: what is in place, which subprocessors are involved, and where data sits.
We hold no security certification and will not pretend otherwise. If you need an audit, write to us and we will agree something reasonable and proportionate that does not disrupt the service for other customers.
We will tell you in the app before this agreement changes in a way that matters to you, and the date above will change. Questions go to info@minuaeg.ee.