Skip to content
Meoyo help center

GDPR compliance

This page covers how Meoyo interacts with the EU’s landmark GDPR legislation; you can read the Meoyo Cloud privacy policy for our general privacy policies.

What is GDPR?

Section titled “What is GDPR?”

The General Data Protection Regulation (GDPR) is a wide-ranging law designed to protect the privacy of individuals in the European Union (EU) and give them control over how their personal data is collected, processed, and used. The law applies to any company that collects or processes the data of European consumers.

How Meoyo supports GDPR compliance

Section titled “How Meoyo supports GDPR compliance”

GDPR compliance is supported for Meoyo Cloud and for self-hosted Meoyo installations.

A Data Processing Addendum (DPA) is incorporated into Meoyo’s Terms of Service.

GDPR compliance with Meoyo Cloud

Section titled “GDPR compliance with Meoyo Cloud”

The Meoyo Cloud service is operated by Kandra Labs, Inc. To deliver the Meoyo Cloud service, Kandra Labs, Inc. acts as a compliant data processor, with each of our customers acting as the data controller. Kandra Labs receives personal data from our customers in the context of providing our Meoyo Cloud team chat services to the customer.

Meoyo makes it easy for organizations to comply with GDPR-related requests from users:

Contact support@zulip.com for any assistance with GDPR compliance with Meoyo Cloud.

GDPR compliance for self-hosted installations

Section titled “GDPR compliance for self-hosted installations”

Compliance is often simpler when running software on-premises, since you can have complete control over how your organization uses the data you collect.

The Meoyo Mobile Push Notification Service is operated by Kandra Labs, Inc. Kandra Labs acts as a data processor to deliver the service, which uses the same hosting infrastructure and terms of service as Meoyo Cloud.

In addition to the features described above, the following tools help self-hosted Meoyo installations comply with GDPR-related requests from users:

  • The Meoyo server comes with a command-line tool, manage.py export_single_user, which is a variant of the main server export tool, that exports a single Meoyo user’s account details, preferences, channel subscriptions, and message history in a structured JSON format.
  • The Django management shell (manage.py shell) and database shell (manage.py dbshell) allows you to query, access, edit, and delete data directly.

There’s a lot more that goes into GDPR compliance, including securing your server infrastructure responsibly, internal policies around access, logging, and backups, etc. Meoyo Business and Meoyo Enterprise customers can contact support@zulip.com for assistance with GDPR compliance with Meoyo.

Background on controllers and processors

Section titled “Background on controllers and processors”

There are two key relationships that are defined in the GDPR. As a customer of Meoyo Cloud, you operate as the controller when using our products and services. You have the responsibility for ensuring that the personal data you are collecting is being processed in a lawful manner as described above and that you are using processors, such as Meoyo Cloud, that are committed to handling the data in a compliant manner.

Meoyo Cloud is considered a data processor. We act on the instructions of the controller (you). Similar to controllers, processors are expected to enumerate how they handle personal data, which we have outlined in this document and the legal documents listed below. As a processor, we rely on our customers to ensure that there is a lawful basis for processing.

Processors may leverage other third-parties in the processing of personal data. These entities are commonly referred to as sub-processors. For example, Kandra Labs leverages cloud service providers like Amazon Web Services and Stripe to host Meoyo Cloud. See full list of subprocessors for Meoyo Cloud.

Section titled “Related articles”