Processing agreement

Version of 25 October 2026

• 1. Who and when
• 2. What data, and why
• 3. Only on your instructions
• 4. Confidentiality
• 5. Security
• 6. Other companies we use
• 7. Where the data is
• 8. Helping you
• 9. Data breaches
• 10. Checks
• 11. When the service ends
• 12. Liability
• 13. Duration and the rest

1. Who and when

This agreement is part of our terms and conditions and applies when we run a website for you on a subscription and, in doing so, handle personal data on your behalf. You accept it together with the terms and our privacy statement, by ticking the box in the onboarding form. You decide what is on your website and why: you are the controller. We handle it only for you: we are your processor (article 28 of the GDPR). Where this agreement and the terms differ about personal data, this agreement wins.

Some data is ours rather than yours: your account and your team's accounts in the panel, the sign-in codes, the record of each request and its AI cost (not the messages and photos in it), the record of who published which change, and payments and invoices. For those we are the controller, and our privacy statement applies.

2. What data, and why

We put no cookies and no tracking scripts on your website: the visitor statistics we show you are counted from those access logs.

AI. We use AI only to carry out the changes you ask for, never to train AI models. Your request, its photos and the parts of your website it concerns are read by Mistral AI's models, through Mistral's EU service, to prepare the change, and automated rules check the result. AI can make mistakes, so you see every change in a preview first, and nothing goes live until you click Publish. Training is switched off in our account with Mistral. We have asked Mistral to keep nothing at all (zero data retention); unless it grants that, it may keep what we send and what its models return for up to 30 days, to detect abuse.

Only put people's names and photos on your website, and send them to us, when you are allowed to — for example because the people shown agreed. If what you send us includes special data, such as health details about a client, tell us first: it needs extra care, and you remain responsible for being allowed to use it. We don't use the personal data we handle for you for anything else: not for our audits, not to train AI models, and we never sell it.

How long we keep what

3. Only on your instructions

We handle the data only as this agreement says and as you instruct us. Your instructions are the change requests you start in the panel, your click on Publish to put a change live, and what you ask us in writing (an e-mail is enough). Instructions from the people you let use the panel count as yours; you decide which of them may publish. If we think an instruction breaks the law, we tell you and may refuse it. If the law forces us to hand data to an authority, we tell you first, unless we are not allowed to.

4. Confidentiality

Everyone who can reach the data for us is bound to keep it confidential, and only gets the access the work needs.

5. Security

We protect the data with measures that fit the risk, including:

• encrypted connections (HTTPS) for every website, with certificates renewed automatically;
• your website stored with Amazon S3 in the EU and served through Amazon CloudFront, a content delivery network with built-in protection against attacks that try to overload a website;
• previews that are not public: they open only from the panel or through a personal link that expires;
• sign-in to the panel with a one-time code sent by e-mail, so there is no password to steal, and a notice e-mail when someone signs in from a new device; you decide who may publish;
• the AI can only change your website's own files, automated rules check its work, and nothing goes live until you click Publish; any published version from the last 3 months can be restored;
• our own systems (the panel, onboarding and our admin) hosted in a data centre in the EU, on a hardened Kubernetes platform (Talos Linux: a minimal operating system without remote login);
• every part of those systems reaches only the services it needs: network traffic is denied unless it is explicitly allowed;
• stored data and backups encrypted;
• passwords and keys kept encrypted, in a vault, never as plain text in code;
• malicious traffic to our systems blocked automatically (CrowdSec), and the systems monitored, with alerts;
• security updates applied regularly;
• daily database backups, with a copy kept off-site at another provider (see section 6);
• the management systems of our own servers (cluster, databases) reachable only by us, over a private network (VPN) with strong authentication — never from the open internet.

We may change these measures, as long as the protection stays at least as good.

6. Other companies we use

You allow us to use other companies (sub-processors) for the service. We bind them to the same data protection duties as this agreement. Today these are:

We tell you at least 30 days before we add or replace one. If you have a good reason to object, you may end the service from that date, and we refund the unused months.

Services from other companies that you ask us to add to your website, such as an embedded map or video, are your own choice: they are not our sub-processors, your arrangement with them applies, and your website's privacy statement should name them.

7. Where the data is

We store and process the data in data centres in the European Economic Area (EEA), with two exceptions that come with how the service works:

• Serving your website. Amazon CloudFront delivers your website to each visitor from the nearest of its more than 750 locations worldwide. Your website's public pages may therefore be cached, and visitors' requests (with their IP address) handled, at locations outside the EEA.
• Version history. GitHub, in the United States, keeps the version history of your website's files and builds the website from them.

Both happen under the safeguards the GDPR requires: the EU standard contractual clauses and, for the United States, the EU–US Data Privacy Framework. By this agreement you instruct us to use the sub-processors in section 6 in this way, including any access from outside the EEA by their staff under those same safeguards. Any other transfer outside the EEA happens only on your written instruction, with those safeguards.

8. Helping you

If someone asks us to see, correct or delete their data on your website or in what you sent us, we pass the request to you: you decide, and tell us what to do. We then carry it out, usually as a change to your website, and help where the service makes that possible. Data you have removed disappears from older published versions within 100 days and from our backups within 90 days.

If you ask, we also remove it from the version history, so earlier versions that contain it can no longer be restored.

We also give you the information you reasonably need for your own duties, such as a data protection impact assessment. For help that goes beyond the normal service we may charge reasonable costs; we tell you the cost before we start.

9. Data breaches

If personal data we handle for you is lost, leaked or reached by someone who shouldn't have it, we tell you without undue delay — we aim for within 24 hours of finding out — with what we know at that point. You then decide whether to report it to the Autoriteit Persoonsgegevens (within 72 hours) and to the people involved; we help you with that.

10. Checks

On request we give you the information you need to see that we keep to this agreement. If that is not enough, an independent expert bound to confidentiality may check it, at most once a year, with four weeks' notice and without disrupting our work. You pay for the check, unless it finds that we broke this agreement in a significant way.

11. When the service ends

This section also applies when we suspend your website for abuse or persistent unfair use, as the terms allow: we then refund the unused months, and you get your data so you can take it with you.

• Your website goes offline. We delete its published and unpublished versions and its previews. Your domain stays yours, so you can point it elsewhere.
• A copy for you. You can have a copy of your website's content, such as its texts and images, within 30 days after the service ends.
• Then we delete the rest: your website's stored files, including older stored versions, its version history at GitHub, your requests and their photos, and anything left of the onboarding form — unless the law requires us to keep it.
• Logs and backups run out by themselves, within the periods in section 2: the access logs within 35 days, anything Mistral may keep within 30 days, and our backups within 90 days.

Our own records, such as invoices and the record of each request and its AI cost, follow our privacy statement.

12. Liability

The liability limits in our terms and conditions also apply to this agreement. We remain responsible towards you for the work of our sub-processors as if it were our own. Each of us is responsible for its own duties under the GDPR; fines or claims that follow from your duties as controller are yours — for example when a photo of someone is on your website without their permission.

13. Duration and the rest

This agreement lasts as long as we handle personal data for you, and its duties on confidentiality and deletion continue after that. We may change it as described in the terms. Dutch law applies, and disputes go to the court named in the terms.