Data Processing Agreement

1. What we process, and for whom

This agreement covers the personal data Promvia processes on your behalf: what the snippet collects from visitors to your website, and what our servers see while handling those requests. It does not cover your own account data — your email, your sites, your billing — for which we are the controller and the privacy policy applies. Annex I sets out the subject matter, duration, nature, purpose, data types and categories of data subject.

2. We act only on your instructions

We process the data only on your documented instructions, including for transfers to other countries. Your instructions are these terms, the DPA, and what you configure in the product — the sites you add, the queries you track, the integrations you turn on. If we ever believe an instruction breaks data protection law we will tell you rather than quietly carry it out. If law requires us to process for another reason, we will tell you first unless that law forbids it.

3. Confidentiality

Access is limited to the people who need it to run the service, each bound by confidentiality obligations that survive the end of their engagement. Promvia is operated by a small team; the list of people with production access is short and is available on request.

4. Security

We take the measures required by Article 32, described concretely in Annex II. They are stated as what the system actually does rather than as a category, so you can check them.

5. Other processors we use

You give us general authorisation to use the sub-processors listed in Annex III, each engaged under a written contract imposing the same obligations we owe you. We stay responsible to you for their performance. Before adding or replacing one we will give you at least 14 days' notice by email; if you object on reasonable data-protection grounds within that period, you may terminate the affected part of the service and receive a refund of anything paid for a period not yet served.

6. Helping you answer your visitors

If one of your visitors asks to see, correct, export or delete their data, that request is yours to answer — you are the controller. We assist you with appropriate technical measures: your dashboard, the export in Settings, and site deletion cover the ordinary cases, and where they do not, we help on request. If a request reaches us directly we will not answer it ourselves; we will pass it to you.

7. Breaches, and helping you assess risk

If we become aware of a personal data breach affecting your data we will notify you without undue delay and in any event within 72 hours, with what we know: what happened, which data and roughly how many people are affected, the likely consequences and what we are doing about it. If we do not know everything at first we will send what we have and follow up rather than wait. We also assist you, taking account of what we know, with data protection impact assessments and prior consultation.

8. What happens to the data when you leave

You choose: on termination we delete the data or return it to you. Deleting a site removes that site's data; deleting your account removes your information from active systems immediately, and the export in Settings gives you everything as JSON beforehand. Backups roll off on their own schedule within 30 days. We keep nothing afterwards except where law requires it, in which case we keep it only for as long as that law requires and go on protecting it.

9. Showing our work

We make available the information you need to show that these obligations are met, and we allow for and contribute to audits. In practice that means documentation and answers to your security questionnaire, which is what almost every request needs. Where documentation genuinely will not do, you may inspect — once a year, with 30 days' notice, at your cost, by you or an auditor we both accept, without disrupting the service or exposing another customer's data. A supervisory authority may audit at any time without those limits.

10. International transfers

The application and database run in the EU. Some sub-processors are in the United States; Annex III says which. Data reaches them under their own data processing agreements, which incorporate Standard Contractual Clauses or their EU–US Data Privacy Framework certification. We do not transfer your data anywhere else on our own initiative.

11. Precedence and liability

Where this agreement conflicts with the Terms of Service on the processing of personal data, this agreement wins. Everything else — including the limitation of liability — is governed by the Terms. Nothing here limits either party's liability under data protection law towards a data subject or a supervisory authority.

12. Changes

We may update this agreement to keep it accurate or to meet a legal requirement. Material changes are announced in the product at least 14 days in advance, and the date above always reflects the version in force.

Annex I — Details of the processing

Subject matter

Providing the Promvia AI-visibility and traffic attribution service to you.

Duration

For as long as you have an account, plus the deletion window in clause 8.

Nature of the processing

Collection, storage, structuring, analysis and display; deletion on your instruction.

Purpose

Showing you which AI assistants send you traffic, whether they cite you, and what to change — for your purposes only.

Types of personal data

A first-party pseudonymous visitor identifier; the page visited and the referring source; conversion values you choose to send; IP addresses, seen transiently for rate limiting and when fetching a page you asked us to audit, and not stored against a visitor.

Categories of data subject

Visitors to the websites you add to Promvia.

Special category data

None. Promvia is not designed to process it and you should not send it.

Retention

As set out in the privacy policy's retention table, which reflects what the code actually prunes.

Frequency

Continuous, for as long as your site sends events.

Annex II — Security measures

Stated as what the system does, so each line can be checked rather than taken on trust.

• Traffic to the application and to the database is encrypted in transit; the database is encrypted at rest by the provider.
• Passwords are stored only as salted hashes, never in a recoverable form, and new passwords are checked against known breach corpora.
• The application and the database run in the EU.
• Every read and write is scoped by account, enforced in the data layer rather than in the interface, and covered by tests.
• Public endpoints are rate limited; the limiter sees counters keyed to an address, not content.
• Outbound fetches made on your behalf go through a guard that refuses private and link-local addresses, so an audited URL cannot be used to reach internal systems.
• Error monitoring is configured not to send IP addresses, cookies or request headers, and to redact email addresses out of error text.
• Production access is limited to named people using individual credentials with two-factor authentication.
• Backups are managed by the database provider with point-in-time recovery, and inherit the same EU location and encryption.
• Sessions expire after 30 days and are cleared on a schedule.

Annex III — Sub-processors

Everyone who can see personal data processed on your behalf. Providers marked optional are reached only if you turn on the feature that uses them.

Contact

Questions about this agreement, or want a signed copy? Email support@promvia.app.