Data Processing Agreement
How CoreTech processes personal data on behalf of publishers who host with us.
Effective September 30, 2026
1. Roles
This Data Processing Agreement (DPA) forms part of the Terms of Service. For personal data about your readers and members that you store in your CoreTech-hosted site ("Customer Data"), you are the controller and CoreTech is your processor.
2. What we process
| Data subjects | Your site's visitors, members, subscribers, staff users and commenters. |
| Types of data | Names, email addresses, membership and subscription status, newsletter engagement, comments, and technical data such as request logs. |
| Purpose | Hosting, backing up, securing and delivering your publication and newsletters, and providing dashboard analytics. |
| Duration | For as long as you use the Service, plus the deletion period in section 8. |
3. Our commitments
- We process Customer Data only on your documented instructions, which are the Terms, this DPA and your use of the Service.
- Everyone at CoreTech with access to Customer Data is bound by confidentiality.
- We apply appropriate technical and organisational security measures (section 5).
- We help you respond to requests from individuals exercising their rights, as far as the Service allows.
- We tell you without undue delay, and within 72 hours where possible, after becoming aware of a personal data breach affecting your Customer Data.
4. Sub-processors
You authorise CoreTech to use the following sub-processors. We'll give notice of any new sub-processor at least 14 days before it starts processing Customer Data, and you may object.
| Sub-processor | Purpose |
|---|---|
| Mailgun Technologies, Inc. | Newsletter and transactional email delivery |
| Stripe, Inc. | Payment processing for members' paid subscriptions (when you connect Stripe in Ghost) and CoreTech billing |
| Cloudflare, Inc. | DNS, secure connections and traffic protection |
5. Security measures
- Encryption of data in transit (HTTPS/TLS).
- A separate database for every hosted site.
- Encryption of sensitive credentials and payout details at rest.
- Nightly backups with retention according to your plan.
- Continuous uptime monitoring and access limited to authorised CoreTech staff.
6. International transfers
Where Customer Data is transferred to a country without an adequacy decision, the transfer is covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard.
7. Audits
On reasonable request, we'll provide the information you need to show compliance with this DPA.
8. Deletion
When your account closes you have 30 days to export Customer Data. After that we delete it from live systems, and backups containing it expire within the retention period of your plan.
Change history
- September 30, 2026: First version.