Data processing addendum
Proposed effective date: 26 August 2026
Draft, not yet in force. Published for review, not reliance. It has not been reviewed by a lawyer, and values marked “to be confirmed” are not filled in.
The controller/processor terms for customers whose imagery is personal data or commercially sensitive. Written to be read, not to be survived.
Roles
You are the controller of the imagery and site data you upload. CelesticLabs Private Limited is the processor: we act on your documented instructions, which for this service means "reconstruct this flight and return the deliverables". We do not decide what you fly or why.
What we process, and where
| Category | Where it is processed | Why there |
|---|---|---|
| Flight imagery | AWS, us-east-1 | Reconstruction runs on ephemeral compute in that region |
| Deliverables | AWS, us-east-1 | Written next to the imagery that produced them |
| Account data | Application database, us-east-1 | Authentication, quota, billing state |
| Payment details | Dodo Payments (merchant of record) | Card data never reaches our systems |
If your data may not leave a particular jurisdiction, tell us before you upload. We would rather refuse the work than quietly process it somewhere you cannot accept.
Sub-processors
| Sub-processor | Purpose |
|---|---|
| Amazon Web Services | Compute, object storage, hosting |
| Dodo Payments | Subscription billing, merchant of record |
| Cloudflare | DNS and edge for the marketing site |
| Vercel | Marketing site hosting |
We will give notice before adding a sub-processor that touches customer imagery, so you have time to object.
Security
- Imagery travels browser-to-storage over TLS using short-lived signed URLs and never passes through our application servers.
- Object storage is encrypted at rest and blocks all public access.
- Every read is ownership-scoped: a job identifier is not an access token.
- Processing credentials are scoped to one bucket and to submitting jobs — nothing else.
Retention and deletion
Deliverables are retained for 90 days by default and you can shorten that. Deleting a flight removes its deliverables; deleting an account removes the account's data. Backups age out on their own schedule and are never restored selectively to recover deleted customer data.
Your imagery is not training data
We do not use customer imagery or deliverables to train models, and we do not sell, share or license them. There is no clause elsewhere in these documents that quietly says otherwise.
Breach notification
If we become aware of a personal data breach affecting your data we will notify you without undue delay and in any case within 72 hours of becoming aware, with what we know, what we do not yet know, and what we are doing. Write to privacy@celesticlabs.org.
Audit and assistance
We will answer reasonable written security questionnaires and provide the information needed for your own impact assessments. We are a small company: we would rather answer honestly than produce a certification we do not hold.
On termination
You can export your deliverables at any time while the account is live. After termination we delete customer data on the retention schedule above; ask and we will delete it sooner.