Data Processing Agreement

This Data Processing Agreement (“DPA”) is between you, the Liite account holder (“Customer”), and [Company legal name], [Registered address] (“Liite”). It is part of our Terms of Service and applies automatically to every account; there is nothing to sign. If you need a countersigned copy for your records, email hi@liite.co.

It applies wherever Liite processes personal data on your behalf and data protection law such as the EU GDPR, the UK GDPR or the Swiss FADP applies to that data. Terms like “controller”, “processor”, “personal data” and “data subject” have the meanings those laws give them.

Liite handles two kinds of personal data, in two roles:

• Your account data (name, email, billing status, what you create): Liite is the controller. Our Privacy Policy governs this; the DPA does not.
• Data your visitors give you through a site built with Liite (form messages, email sign-ups, reviews, RSVPs, orders, audit-report readers): you are the controller and Liite is your processor. This DPA governs that data (“Customer Data”).

Subject matter

Hosting pages and uploaded sites, and storing and delivering what their visitors submit.

Duration

For as long as you have an account, plus the deletion period in section 10.

Nature and purpose

Storing, displaying to you, emailing you about, exporting and deleting submissions; sending broadcasts and confirmations to subscribers on your instruction; counting visits in aggregate.

Data subjects

Visitors to your sites: people who fill in a form, sign up for emails, leave a review, RSVP, place an order, or read a report you share.

Categories of data

Whatever your form fields ask for (typically name, email, message), email addresses and confirmation status, review text and ratings, RSVP answers, order details, and daily-salted hashes of IP addresses kept only for spam control. Liite's own analytics hold no personal data.

Special categories

None by design. The Acceptable Use Policy forbids collecting health data, government ID numbers, passwords or card numbers through forms without a lawful reason and the visitor's clear understanding.

Liite processes Customer Data only on your documented instructions. Your instructions are: this DPA, the Terms, and what you do in the product (which blocks you add, what fields you ask for, which broadcasts you send, what you export or delete). We will tell you if we believe an instruction breaks data protection law.

You are responsible for having a lawful basis to collect what your forms ask for, for telling visitors how you use it (for example with a privacy notice linked from your page), and for answering their requests about it.

Only people who run Liite can access Customer Data, and only when needed to run the service, fix a problem you report or investigate abuse. They are bound by confidentiality obligations. Liite does not read your form messages or use Customer Data for its own purposes, including advertising or training AI models.

Liite takes the technical and organisational measures described on our Security page, including encryption in transit and at rest, hashed credentials, separation of user code from the dashboard, rate limits and access controls. We may improve these over time but will not reduce the overall level of protection during the term.

You authorise Liite to use these sub-processors. Each receives only what its job needs and is bound by data protection terms at least as protective as this DPA.

Vercel

Hosting, content delivery, serverless functions, custom domains and certificates. Every request to liite.co, liite.site and connected domains (IP address, headers), and the app's logs.

Amazon S3 (AWS)

File storage, in a private bucket in the United States (us-east-1). Published pages, uploaded files, media, print-drop files, audit screenshots and PDFs.

MongoDB Atlas

Database (hosted on AWS in the United States). Accounts, sites, links, collections, form submissions, subscribers, reviews and aggregated analytics.

Amazon SES (AWS)

Email delivery, including bounce and complaint notices so we stop emailing addresses that reject mail. Recipient address and the email's content (account email, notifications, broadcasts to subscribers).

Polar

Payments, as merchant of record (handles tax, invoices and refunds). Name, email, billing address and payment details, which Polar collects directly.

Anthropic

AI features on Liite credits, and website audits. Your prompt and the content needed for the task (page text, photos for Snap, captured pages for an audit).

Google PageSpeed Insights

Speed measurements in website audits. The public web address being audited.

Cloudflare

Browser Rendering for website audits. The public pages of the website being audited.

Google Safe Browsing

Checking links for phishing and malware. Web addresses in uploads, pages and short links.

VirusTotal

Malware checks on paid-plan uploads. A fingerprint (SHA-256 hash) of uploaded files, never the files themselves.

Before adding or replacing a sub-processor that will handle Customer Data, we will update this list and email account holders at least [sub-processor notice period, e.g. 30 days] in advance. If you object on reasonable data protection grounds and we cannot resolve it, you may end your account; section 10 then applies. Liite remains responsible for its sub-processors' performance.

Most requests from your visitors you can handle yourself, straight away:

• Access and portability: form messages, subscribers, reviews and orders are visible in your dashboard and included in Account settings → Your data (JSON).
• Erasure: delete any message, subscriber, review or order in the dashboard; it is removed immediately.
• Objection to email: every broadcast carries a one-click unsubscribe, and subscribers can also be removed by you.

If a visitor contacts Liite directly about data on your site, we will point them to you and, where we can identify the site, tell you. For anything you cannot do yourself, email hi@liite.co and we will help within the time the law requires.

If Liite becomes aware of a breach affecting Customer Data, we will notify you without undue delay, and in any case within 72 hours of becoming aware, at your account email, with what we know about its nature, the data and people likely affected, the likely consequences and the measures taken or proposed. We will keep you updated as we learn more and cooperate with you on any notification you must make.

• You can export all Customer Data at any time from Account settings → Your data.
• Form messages are deleted automatically at the end of your plan's retention period, as listed in the Privacy Policy.
• When you delete a site, or your account, the Customer Data held for it is deleted immediately. Copies in backups expire within [backup retention period, e.g. 30 days].
• We keep nothing afterwards except what the law requires us to keep, which stays confidential and is processed for no other purpose.

We will make available the information reasonably needed to show we meet this DPA: this page, the Security page, our sub-processor list and, on request, the summaries or certifications our providers publish. If that is not enough to meet a legal obligation, you may audit Liite once a year, on at least 30 days' notice, at your cost, during business hours and without disrupting the service, through written questions or, if the law requires, a mutually agreed independent auditor bound by confidentiality.

Our database runs in the United States and our hosting is global, so Customer Data may be processed outside the country where you or your visitors are. Where the law requires a safeguard for such transfers, we rely on [Transfer safeguard, e.g. the EU Standard Contractual Clauses], which is incorporated into this DPA, and on the UK Addendum or Swiss adjustments where those laws apply. If a safeguard stops being valid, we will work with you on a replacement.

Each party's liability under this DPA is subject to the limits in the Terms, except where data protection law does not allow that. This DPA is governed by the same law and courts as the Terms. If it conflicts with the Terms on a data protection matter, this DPA wins; if it conflicts with a transfer safeguard, the safeguard wins. We may update this DPA to reflect changes in law or in the service; material changes are emailed to account holders before they apply.