GDPR
Answers to the questions we get most about the EU General Data Protection Regulation (GDPR), the UK GDPR and the Swiss Federal Act on Data Protection (FADP). The binding terms are in our DPA and privacy policy.
What personal data does Logo.dev process?
Logo.dev serves public brand data, so most data in the API is not personal data. We process:
- Account details: your name, email and organization.
- API request metadata: the IP address that sends a request, the domain or query it looks up, and a timestamp.
- Billing details, which Stripe collects and processes. We don't store full card numbers.
- Website and product analytics, through Fathom and PostHog.
We process no special-category data, and we never sell personal data.
Is Logo.dev a controller or a processor?
For personal data in your API requests, you are the controller and Logo.dev is your processor. If you are a processor for your own customer, Logo.dev is your sub-processor. For your account and billing details, Logo.dev is the controller; our privacy policy covers that data.
Do I need to sign a DPA?
No. Our DPA is part of our Terms of Service. It applies to every customer automatically when they accept the Terms, on every plan, with no signature.
If your records need a copy, sign in and open Billing in the dashboard to download it as a PDF.
Will you sign our DPA, or a country-specific one?
No. Our DPA covers the GDPR, the UK GDPR and the FADP, and the same terms apply to every customer. We don't sign customer-specific or country-specific DPAs. Changes to the DPA are available only on an Enterprise agreement; to ask about one, contact sales.
Where is my data stored?
In the United States. Our infrastructure runs on AWS, mainly in the us-west-2 (Oregon) region. The sub-processor list gives the location of each provider.
How do you transfer data out of the EEA, UK and Switzerland?
Under the EU Standard Contractual Clauses (Module Two for controller-to-processor, Module Three for processor-to-processor), the UK International Data Transfer Addendum, and the Swiss changes to the Clauses. All three are part of our DPA, so they apply without a signature too.
How long do you keep personal data?
| Data | Retention |
|---|---|
| API request logs (IP address, lookup, timestamp) | Deleted within 120 days |
| Security and audit logs | Deleted within 400 days |
| Account data | Until you delete your account |
| Database backups | 7 days (primary database) and 35 days (API key store) |
| Billing records | As tax and accounting law requires |
What happens when I delete my account?
We delete your account record and revoke your API keys at once. Copies in backups expire within 35 days, and request logs expire on the schedule above. See Delete your account.
Who are your sub-processors?
They are on our sub-processor list, with what each one does and where.
How will I know if a sub-processor changes?
We announce a new or replacement sub-processor in our changelog at least 14 days before it processes personal data. To object, email team@logo.dev within those 14 days.
How do I make a data subject request?
Email team@logo.dev. We support requests for access, correction, deletion, restriction, objection and portability. If a request about your own end users reaches us, we pass it to you and help you answer it, as the DPA describes.
What happens if there is a data breach?
We tell affected customers without undue delay, with what happened, what data it affected and what we are doing about it. We have a written incident response plan and test it every year.
Do you have a security certification?
We have a SOC 2 Type I report for the Security criteria. See our security page for our controls.