Data Processing Addendum

For website visitor data, enquiry data and business content processed on your behalf, you are the controller and we are the processor. For account and billing data about your own users, we are the controller.

We process data on your documented instructions, which are the configuration of your account: the site, the connected systems, the consent settings, the retention period and the automation level.

We do not process it for any other purpose, and we do not use it to train models made available outside your account.

Encryption in transit and at rest. Tenant isolation between accounts. Credentials for connected systems held only by the services that require them, never exposed to a browser and never written to logs.

Access to production restricted, logged and reviewed. Every automated action recorded with its actor, its inputs and its result.

We use the sub-processors listed on the subprocessors page. We give notice before adding one, and each is engaged under terms no weaker than these.

We assist with data subject requests, impact assessments and incident notification within the timelines your agreement sets.

Because consent state and automated actions are both recorded, most audit questions about a specific visitor or a specific change can be answered from the record rather than by investigation.

On termination, data is returned or deleted at your election within the period your agreement sets. Your domain and your published content are exportable throughout.