Data processing agreement

Last updated 22 October 2026

This agreement (in Dutch: verwerkersovereenkomst) is part of the terms (version 2026-10-22) between you, the customer, and Site Assistant. It applies when we process personal data for you through your assistants, as required by article 28 of the GDPR. You are the controller; we are the processor.

1. What we process

• Purpose: answering your website visitors' questions with your assistant, showing you the conversations, and keeping the service secure.
• Data subjects: visitors who chat with your assistant, and people named in the information you add.
• Personal data: what visitors write (which may include names, contact details or other details they choose to share), the page they were on, timestamps, and personal data in your own website or notes. Card numbers, bank account numbers and Dutch BSNs are removed automatically before storage. We don't ask for or intend to process special categories of data.
• Duration: for as long as you have an account. Conversations are deleted automatically after the period you choose per assistant (7, 30 or 90 days, or 1 year).

2. Our obligations

• We process the data only on your documented instructions: these terms and your settings. If we believe an instruction breaks the law, we tell you.
• Everyone with access to the data is bound to confidentiality.
• We take the security measures in annex 1.
• We help you respond to requests from data subjects. You can download and delete conversations yourself; for anything else, contact us.
• We help you with data protection impact assessments and prior consultations where needed.
• We tell you about a personal data breach without undue delay, and at the latest within 48 hours of discovering it, with the information you need to notify the authority and the people involved.
• When your account ends we delete the data immediately; copies in backups are overwritten within 30 days. You can download the conversations before that.
• We give you the information you need to show compliance. You can have an audit done once a year at your own cost, with 30 days' notice and under confidentiality.

3. Subprocessors

You give general permission to use the subprocessors in annex 2. We bind each of them to obligations at least as strict as these. We announce new subprocessors at least 30 days in advance by email; if you object on reasonable grounds and we can't solve it, you may end the agreement before the change.

4. Outside the EU

Where data is transferred outside the European Economic Area, it's protected by an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses.

5. Liability

The liability rules in the terms apply to this agreement.

Annex 1: Security measures

• All connections use HTTPS; strict transport security and a content security policy are enforced.
• Conversations are encrypted with AES-256-GCM before storage, with a key kept separately from the database.
• Card numbers, bank account numbers and Dutch BSNs are removed before they reach the AI or storage.
• Automatic deletion of conversations after the chosen retention period, checked daily.
• Passwords hashed with bcrypt; protection against password guessing; sessions end on password change.
• Rate limits on sign-in, sign-up and chat, with hashed keys (no IP addresses stored).
• Assistants only work on the websites the customer allows. Customers only see their own data.
• Hosting and database in the EU (Frankfurt); access limited to what's needed to run the service.
• Dependencies kept up to date and checked for known vulnerabilities.

Annex 2: Subprocessors

• Vercel Inc.: Hosting of the app. Servers in Frankfurt, Germany (EU). Company in the US: EU-US Data Privacy Framework and Standard Contractual Clauses.
• Neon Inc. (Databricks): Database. Frankfurt, Germany (EU). Company in the US: Standard Contractual Clauses.
• OpenAI: Writing answers and reading meaning from text (embeddings). US, or the EU where OpenAI's European data residency is enabled. Standard Contractual Clauses. API data isn't used for training.
• Mollie B.V.: Payments (customer data only, no visitor data). Amsterdam, the Netherlands (EU).
• Resend Inc.: Service emails to customers, such as confirming their address, password resets and usage warnings (customer email addresses only, no visitor data). Company in the US: Standard Contractual Clauses.

Site Assistant · hi@alfred-polycarpe.com