Data Processing Addendum

1. Scope and roles

The customer is controller/business and SiteAirbag is processor/service provider for customer personal data in runtime operations and deliberate rescue requests. Each party is independently responsible for processing it determines for its own account, security, billing, legal or support purposes. Terms such as controller, processor, personal data, processing and data subject have the meanings in applicable data protection law.

2. Instructions and purpose limitation

SiteAirbag processes customer personal data only to provide, secure, support and improve the contracted service under documented instructions in the Terms, configuration and support requests. SiteAirbag will notify the customer if an instruction appears unlawful, unless prohibited by law. SiteAirbag will not sell customer personal data, share it for cross-context behavioral advertising, or combine it with unrelated personal data except as permitted for a service provider.

3. Processing details

Subject matter: configured website-action observation, controlled detection-quality evaluation and optional rescue requests. Duration: the contract plus documented deletion periods. Data subjects: customer account users and visitors using protected sites. Data: minimized technical event and versioned decision data, explicit owner quality labels, contact details and approved business-safe rescue details. Detection-quality records exclude raw form data, full URLs and error text. Frequency: as visitors interact with configured actions or customers use the service. Sensitive data is prohibited.

4. Confidentiality and security

Personnel with access must be bound by confidentiality and receive access only as needed. Verified technical and organizational measures include tenant isolation with Row Level Security, scoped and short-lived credentials, encrypted transport, secrets management, signature verification, audit records, rate limiting, secure development checks and incident response. The production Supabase Free plan does not currently include managed backups; a backup-enabled plan and periodic external logical backups are planned but are not contractual recovery commitments. The customer remains responsible for account access, site configuration, legal notices, safe rescue-field choices and maintaining its own source records.

5. Subprocessors

The customer gives general authorization for the listed subprocessors. SiteAirbag remains responsible for imposing materially equivalent data-protection obligations. SiteAirbag will publish material changes on the Subprocessors page and email workspace owners at least seven days before the change where reasonably practicable. Earlier notice may be impossible for security, law, vendor discontinuation, emergency infrastructure problems or matters outside SiteAirbag's reasonable control; notice will then be provided as soon as reasonably practicable.

A customer may object within 14 calendar days on legitimate data-protection grounds. The customer has no unrestricted veto over SiteAirbag's infrastructure. The parties will seek a reasonable alternative, and if none can be provided SiteAirbag may terminate the affected service or customer relationship.

6. Assistance

Taking account of the processing and information available, SiteAirbag will reasonably assist with data-subject requests, security assessments, breach obligations and data-protection impact assessments. The customer is responsible for responding as controller. SiteAirbag may charge reasonable costs for exceptional assistance beyond the service's standard controls where permitted by the contract.

7. Security incidents

SiteAirbag will notify the customer without undue delay after confirming a breach of customer personal data and will provide available information about nature, likely consequences, affected data and mitigation. Notification is not an admission of fault. The customer is responsible for regulator and data-subject notifications unless law assigns that duty otherwise.

8. Deletion and return

During the service, customer data can be exported through the documented workflow. At the end of the service, SiteAirbag will delete or return customer personal data on the customer's verified request, which the customer makes by email to support@siteairbag.com; deletion is on request and is not automatic. Deletion follows the retention schedule, except where law requires retention. If managed or external backups are enabled later, they must remain isolated from ordinary use and age out under the recorded lifecycle.

9. Audits

SiteAirbag will provide current security and subprocessor information reasonably necessary to demonstrate compliance. No more than once annually, unless required by a regulator or confirmed incident, the customer may request additional evidence. Audits must protect other customers, security, confidentiality and service availability; independent reports and remote evidence are preferred before an on-site review.

10. Transfers

No Standard Contractual Clauses, UK Addendum or IDTA are incorporated merely by this public text. Before a restricted transfer, the parties must complete and execute the mechanism required for the actual exporter, importer, modules, regions and governing choices, together with any required transfer assessment. Contact privacy@siteairbag.com to complete the appropriate transfer terms before covered processing begins.

11. Conflict and contact

This DPA prevails over conflicting Terms for its subject matter. Mandatory law prevails over both. Data-protection contact: privacy@siteairbag.com.