SiteSignal
Book a Demo Start Free

Data Processing Agreement

Last updated

1. Scope and Purpose

This Data Processing Agreement (DPA) supplements the SiteSignal Terms of Service and reflects the parties' agreement with regard to the Processing of Personal Data under the GDPR and other applicable data protection laws. DreamCore 360 LLC acts as processor; the customer acts as controller.

2. Personal Data and Data Subjects

SiteSignal processes a limited set of personal data: the names and email addresses of account users, team members and alert recipients the customer adds, and billing contact details. SiteSignal monitors publicly available websites and AI answers. It does not install tracking code on monitored sites and does not collect data about their visitors. Public AI answers and web pages it checks may contain the names of people (for example a company's founders), which are processed only to check the accuracy of those answers.

3. Technical and Organizational Measures

  • Encryption: the database and file storage are encrypted at rest with AES-256. Data in transit is encrypted with TLS 1.2 or 1.3; older protocols are refused.
  • Hosting: data is hosted in the United States, in AWS us-east-1.
  • Access control: access to production systems is limited to the staff who need it to run and support the service.
  • Edge protection: the app and API are served through Cloudflare, which filters malicious traffic.

4. List of Sub-processors

To provide the service, we engage the following sub-processors:

  • Amazon Web Services (AWS): application servers and file storage (US, us-east-1).
  • Supabase: managed database (hosted on AWS, US, us-east-1).
  • Cloudflare: DNS, traffic filtering, DDoS protection and CAPTCHA.
  • Stripe: payment processing (PCI-DSS compliant).
  • OpenAI, Google (Gemini and PageSpeed Insights), Perplexity, Anthropic and xAI: AI and analysis APIs that answer monitoring questions and analyse public website content.
  • SerpApi: retrieves Google AI Overviews results for monitoring questions.
  • Brevo: email delivery for account, alert and report emails.

On plans where you bring your own AI provider keys, requests to those providers are made under your own account with them.

5. Data Retention

Data is retained while your subscription is active. If a trial ends without a plan, monitoring pauses and data is kept for 30 days. Upon account deletion, all personal data associated with your account is deleted from our production databases within 90 days, except where retention is required by law.

Need a Signed Copy?

If you need a signed version of this agreement, email hi@sitesignal.app and we will send one for signature.