Data processing agreement

Messages sent through the forms on your site: the visitor's name, email, phone if your form asks for it, and the message. Visit counts per page, day, sending site and device, which hold no personal data.

We process the data only to store each message, forward it to the address you chose, and delete it after 30 days or when you delete the site. Your instructions are this agreement and the settings you make in the service; we follow no others.

Only the people who run the service can reach the data, and only when running it requires it. They are bound to confidentiality.

The data is encrypted in transit and at rest, kept in the European Union, reachable only through the service's own code, and deleted on time. A form accepts posts only from your own site's pages, at most five a minute from one address.

Cloudflare, Inc. hosts the service, the database, the picture store and the outgoing mail, under Cloudflare's own data processing addendum, with the data in its EU jurisdiction. We tell you thirty days before we add another sub-processor; if you object, you may end the service before it applies.

We help you answer a visitor who asks about their data, within the limits of what the service holds. If the data is breached, we tell you without undue delay, with what we know.

On request we give you the documentation needed to show that this agreement is kept, and answer your questions about it.

This agreement lasts as long as you have a site with a form on it. When it ends, the data is deleted; there is nothing to return, because the messages already reached you by mail.

Danish law applies, and GDPR article 28 governs this agreement.

Questions about any of this go to hey@sitemd.app.