AWB Studio

Compliance & data protection

How AWB Studio handles personal data, which providers process it, and how to ask for an export or deletion of your data.

Where the service runs

Workspace data is held with Supabase (database, sign-in and private file storage), and the application runs on Vercel. Application hosting and third-party processing are not represented as EU-only. We will state the hosting region here once the production project is confirmed.

Each workspace is isolated at the database level, so other customers cannot see your shipments. Generated PDFs and attachments sit in private storage and open only through links that expire after 5 minutes.

Export or deletion

Contact us to request export or deletion of your data: ops@awbstudio.app. A self-service screen is not available yet. Certain provider or legally required records may be retained for the applicable period.

The public FWB validator

We don’t keep the message you paste into the public FWB validator. We log a one-way hash of it and the result codes, and the rate limiter stores a keyed hash (HMAC) of your IP address and the route. Validation logs are deleted after 30 days. Rate-limit counters older than a day are removed the next time the limiter runs.

Compliance documents

We maintain draft GDPR Art. 30 records, a draft Data Processing Agreement, a sub-processor inventory, a data-retention matrix, and an erasure runbook. They are available to customers on request via the contact address below:

  • Records of Processing (RoPA)
  • Sub-processor list
  • Data Processing Agreement (DPA)
  • Data-retention matrix
  • Erasure runbook

Sub-processors

AWB Studio is built on five sub-processors:

  • Supabasedatabase, sign-in and private file storage
  • Vercelhosting, functions and edge delivery
  • Stripepayments, once paid plans open
  • Resendtransactional email, once email sending is switched on
  • Labelaryrenders piece labels only, so it receives each label's content: AWB number, routing, piece and weight figures, goods description and the consignee's name, address and phone

Full details and transfer mechanisms are in the internal sub-processor register. Executed vendor DPAs, transfer mechanisms, and external legal approval remain launch prerequisites.

Contact

Data protection enquiries: ops@awbstudio.app