Trust

How we keep your data safe

Structural Content turns your company's data into campaign briefs for your marketing team. This page covers how we handle the data you send us.

Our commitments

Used for your briefs only

We use your data for one purpose: your company's briefs. Your data is never used to train any model.

It stays in the EU

Stored in Frankfurt and analyzed by AI in EU data centers.

You choose what we see

You pick the systems and the columns. Names, email addresses, phone numbers and your staff's fields stay in your systems, apart from what free-text fields hold if you choose to send them.

Zero retention at the AI

The AI service runs with zero data retention: it keeps your inputs and outputs only while it works on them.

Deleted when your contract ends

Your data and everything made from it is deleted within 30 days of your contract ending, with written confirmation.

A standard contract

The EU Commission's standard data processing clauses (Art. 28 GDPR), the form your privacy team already knows.

At a glance

CompanyStructural Content UG (haftungsbeschränkt), Kollwitzstraße 76, 10435 Berlin. HRB 291186 B, Amtsgericht Charlottenburg
ContractWe are your processor under a data processing agreement (Art. 28 GDPR) on the EU standard contractual clauses (Commission Implementing Decision 2021/915), unaltered, with the annexes filled in for your company. Your company remains the controller.
Data we receiveFile exports you create yourself, limited to the columns we agree with you for each system. Logins, API keys and connectors stay with you. Connecting your systems directly is a separate step, with its own agreement naming its hosting, regions and sub-processors.
StorageAmazon S3 in Frankfurt (eu-central-1). Private, encrypted at rest, TLS-only access.
LaptopYour files are handled on a company laptop with full-disk encryption, used within the EU.
AI modelClaude through Amazon Bedrock, EU regions only, with zero data retention. Your data is never used to train any model.
Sub-processorAmazon Web Services EMEA SARL, Luxembourg: storage and AI inference. The only one that receives your data.
AccessNamed Structural Content staff, bound to confidentiality. Today that is one person, the managing director.
EncryptionTLS on every connection; encrypted at rest in storage and on the laptop.
RetentionWhile your contract runs. Deleted within 30 days of your contract ending, with written confirmation.
Breach noticeWithin 24 hours of us becoming aware of a breach affecting your data.
CertificationsNone yet. The full data processing agreement and technical measures are available for your review, and you can audit us under the agreement.

Documents

Ask for these documents at sebastian@structuralcontent.com.

Data processing agreement

Art. 28 GDPR, on the EU standard clauses.

Technical and organizational measures

Art. 32 GDPR, annex to the agreement.

Sub-processor list

Annex to the agreement. One entry: AWS EMEA SARL.

Common questions

Is our data used to train AI models?

Your data is never used to train any model. Amazon Bedrock uses inputs and outputs only to produce the response, and our account runs with zero data retention.

Where is our data stored and processed?

In the EU only: storage in Frankfurt, AI inference in EU regions through AWS's EU cross-region profile, and processing on a company laptop that stays in the EU.

Who can see our data?

Named Structural Content staff bound to confidentiality, for your company only. Today that is one person, the managing director.

Which data do you use?

For each system we agree a column list with you. It includes business facts such as stages, amounts, dates and reasons, and leaves names, email addresses, phone numbers and your staff's fields (owner, assignee, created-by, team, agent) in your system. Free-text fields such as notes or transcripts are your choice per system and can contain names someone typed in. We treat everything you send as personal data, which is why the data processing agreement applies.

Does our works council need to be involved? (Germany)

Without free-text fields, your staff's data stays in your systems. In German companies, that usually keeps the exports outside the works council's co-determination right under § 87(1) no. 6 BetrVG. If you include free text such as call transcripts, we help you remove agent names first.

What happens to our data when our contract ends?

We delete it, and everything made from it, within 30 days of your contract ending, with written confirmation.

Do you hold ISO 27001 or SOC 2?

None yet. The full data processing agreement and technical measures are available for your review, and you can audit us under the agreement.

Contact

Security questions or concerns: sebastian@structuralcontent.com, the managing director, who handles them personally.