For a personal or family project, account and service data are processed under the privacy notice. If you use the service as a business and determine why other people’s project data are processed, you may be the controller; Casvilo may act as processor for that content.
Before uploading such content, request an Article 28 GDPR data processing agreement at info@casvilo.com. It must cover subject and duration, instructions, categories of data and people, confidentiality, security, subprocessors, transfers, help with rights and incidents, audits, and return or deletion at the end. Casvilo’s own account and statutory record purposes remain separate.
This page explains the process; it is not an automatically concluded data processing agreement. Upload only authorised content, inform the people concerned and set access correctly. Do not use private data as a public sample.