Data Processing Agreement
Last updated: October 4, 2026
This agreement is part of the Terms of Service between you (the site owner, “controller”) and [COMPANY NAME] (“processor”). It applies to personal data of your site’s visitors that we process for you. You accept it when you sign up.
1. What we process
- Purpose: hosting your site and providing its features (lead forms, newsletter sign-ups, the AI chatbot, visit statistics).
- People: your site’s visitors, leads, and subscribers.
- Data: names, email addresses and messages they submit; chatbot questions; pseudonymous visit statistics (after consent).
- Duration: while your account is active, then until deletion as set out below.
2. Our commitments
- We process the data only on your instructions, which are these terms and how you set up your site.
- People with access to it are bound by confidentiality.
- We use appropriate security: encryption in transit, access controls, rate limits, and optional two-factor sign-in.
- We help you answer data-subject requests; you can also export or erase data yourself in the admin panel.
- We tell you without undue delay after becoming aware of a personal-data breach affecting your data.
- On request we provide information reasonably needed to show compliance with this agreement.
3. Sub-processors
You authorise the sub-processors below. We give notice on the sub-processors page before adding or replacing one, and you may object by contacting us; if we can’t resolve it, you may cancel. Each sub-processor is bound by data-protection terms no less protective than these.
| Provider | Purpose | Location |
|---|---|---|
| Vercel | Hosting | USA (global edge) |
| MongoDB Atlas | Database | Cloud region chosen by us |
| Stripe | Payments | USA |
| Resend | Email delivery | USA |
| Cloudflare | Image storage and bot protection | Global |
| Upstash | Security (rate limiting) | Cloud region chosen by us |
| AI model providers: one or more of Anthropic, OpenAI and DeepSeek | AI assistant and AI editing features | USA, China |
| Google Analytics | Visit statistics, on sites that turn it on | USA |
4. International transfers
Some sub-processors are outside your country. Where the law requires it, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses.
5. End of service
When you delete your site, or within 30 days of your account closing, we delete the personal data we process for you, except where the law requires us to keep it.
6. Your responsibilities
You make sure you have a legal basis to collect visitor data, show an accurate privacy notice on your site, and don’t ask visitors for special-category data (such as health details) through the forms or the chatbot.
7. Contact
[COMPANY NAME], [COMPANY ADDRESS]. Email: [LEGAL EMAIL].