Data Processing Addendum
Last updated 5 July 2026
This addendum applies where Vault Maagic processes personal data contained in your Salesforce records on your behalf. For that data you are the controller and Vault Maagic is the processor. It forms part of our Terms of Service.
1. Roles and scope
You determine what Salesforce objects are exported and where they are stored (your Google Drive). We process that data only to provide the backup service and only on your documented instructions, which are given through your use of the product.
2. Nature and purpose of processing
- Purpose: exporting selected Salesforce records and delivering them as CSV files to your Google Drive, on your schedule.
- Nature: reading changed records via the Salesforce API, assembling them into CSV in memory, and writing them to your Drive. Record contents are not stored on our systems or written to our logs.
- Duration: for the term of your use of the service.
- Data subjects and categories: determined by you, based on the Salesforce objects and fields you choose to back up (for example contacts, leads, accounts, and their fields).
3. Our obligations
- process personal data only on your instructions;
- ensure people authorised to process the data are bound by confidentiality;
- apply appropriate technical and organisational security measures (see our Security page);
- assist you, taking into account the nature of processing, with data subject requests and with your security, breach, and impact assessment obligations;
- notify you without undue delay after becoming aware of a personal data breach affecting your data;
- delete or return your data at the end of the service, as described below.
4. Subprocessors
You authorise us to use the subprocessors below. We impose data protection terms on each of them and remain responsible for their performance. We will give notice of any intended change so you can object.
| Subprocessor | Purpose | Region |
|---|---|---|
| Vercel | Application hosting and serverless compute | United Kingdom (London) |
| Supabase | Database, authentication, and encrypted secrets vault | United Kingdom (London) |
| Resend | Transactional email delivery | European Union (Ireland) |
Salesforce and Google are not our subprocessors: they are your own connected accounts, which you control directly.
5. International transfers
Where a subprocessor processes data outside the UK or EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and the UK International Data Transfer Agreement.
6. Return and deletion
Because your record data is never stored at rest on our systems, there is nothing for us to return or delete from CSV storage: your backups are already in your Google Drive. On termination we delete the operational data we hold about your account and connections, subject to any retention the law requires.
7. Audit
On reasonable written request, we will make available the information needed to demonstrate compliance with this addendum.
8. Contact
Data protection queries: vault@maagic.co.uk.