Data processing agreement.
This agreement is part of our Terms. It applies when a check sees personal data in your app. For that data you are the controller and Vladislav Sorokin, who operates CheckMyApp, is your processor (GDPR Art. 28). For your own account, billing and analytics we are the controller, and our Privacy page applies instead.
6 November 2026
What we process
Subject: running the checks you ask for and keeping their results. Duration: as long as you use the service, and until deletion below. Data: whatever the pages you point a check at show, such as names, email addresses and account details, in page text and screenshots. Data subjects: your users and staff. Point checks at test accounts and test data wherever you can.
Your instructions
We process this data only to run the checks you start or schedule, under your limits and rules, and as the law requires. We tell you if we think an instruction breaks data protection law.
Confidentiality and security
Only people who need it can reach the data, and they are bound to keep it confidential. Stored logins and tokens are encrypted. Your team's pages are limited to your team. A screenshot is reached through an address that cannot be guessed and needs no sign-in, so anyone given that address can open it, including after they leave your team; it stops working when the screenshot is erased.
Subprocessors
You authorise the services listed on our Privacy page. We remain responsible for them, and that page says what we have confirmed about each. Before we add or replace one, we email your team's admins at least 14 days ahead. You can object by writing to us within that time; while we work it out we do not send your data to the new service, and if we cannot resolve it, you can end the service and we refund the unused part of what you paid.
Helping you
We help you answer requests from data subjects and meet your duties on security, breach notices and impact assessments. We tell you without undue delay after we become aware of a personal data breach affecting your data.
Transfers
Some subprocessors are outside the European Union. Our Privacy page names them and the transfer basis we have confirmed.
Deletion
When you stop using the service, you choose: we return your data or we delete it. Write to us and, within 30 days, we send you your checks and findings in a common format if you asked for them, and then delete them, with their screenshots and any copies we hold. Removing an app in the product is not this: it stops the app, and its checks stay with your team.
When a team is left with nobody, its data is erased 30 days after the last person leaves. Records the law requires us to keep stay for as long as it requires.
Audit
We give you the information you need to show this agreement is met, and allow and contribute to reasonable audits on notice.