Data processing
Data processing
On this page
This page sets out how SaaS Pro Max processes the application data your applications send, in one place. It does not add terms of its own: each commitment below is already part of the Terms or the Privacy document, and those documents decide if anything here reads differently.
Roles#
For application data — the events, person records, errors, metrics and other records your applications send — you are the controller and Make Agent Fast (메이크에이전트패스트), which operates SaaS Pro Max, is your processor.
For console data — your name, email, organization and application names, key metadata and audit trail — we are the controller. The Privacy document covers it.
Instructions#
We process application data only on your documented instructions. Those instructions are the settings you choose in the console and the Management API: which applications and environments collect, what each module records, the retention window, allowed origins, exports and deletions. We access application data only to run the service, to prevent abuse, to comply with the law, or when you ask us to look at something. We never sell it and never share it with a third party for that party's own purposes.
Sub-processors#
These providers process data so that the service can run:
| Sub-processor | What it does | Where |
|---|---|---|
| Google Cloud (Cloud Run, Cloud SQL) | Runs the service and the Postgres database that holds console and application data | asia-northeast3 (Seoul) |
| Google Cloud Vertex AI (Gemini) | Answers the in-console AI assistant (Pilot), only when a member asks it something and your organization has not stored its own model credential | Google's global Vertex AI endpoint |
| Polar | Takes payment for paid plans as the merchant of record | Polar's own infrastructure |
Signing in uses your Google account, so Google sees the sign-in itself. No email delivery provider is in use: the service does not send email at present.
The public website, not the console, offers an optional support chat run on
makeagent.fast; the Privacy
document describes what it loads once you open it. It never receives application
data.
If the way we process application data changes in a way that affects you as a controller, you will have the chance to export your data and leave before the change takes effect.
Security#
The measures are listed in Privacy → Security: Google identity plus a passkey on every sign-in, server-side authorization on every request, envelope encryption for stored secrets, an append-only hash-chained audit ledger, IP addresses hashed at ingest, and HTTPS with a nonce-based Content Security Policy.
If we learn of a breach affecting your data we will tell you, and where the law requires it we will notify the regulator.
Requests from the people in your data#
When a person asks about data your application sent, they should ask you. We help you answer: the Management API and the CSV export read the data back, retention and application deletion remove it, and we act on a documented instruction from you about a specific record.
Deletion and export#
Your data leaves with you: read all of it back through the Management API or the CSV export at any time. Events older than your retention window are deleted. Deleting an application deletes its events, people and issues; deleting an organization removes every application, key and record it owns. Deleted records can survive in a database backup until that backup is rotated out of use.
Signed copy#
If your organization needs a data processing agreement signed by both parties, write to hello@saaspro.dev with your organization's legal name.