Data Processing Agreement
| Version | 1.0 |
| Effective Date | 2026-10-11 |
| Applicable to | aiput.site, REST API and MCP interface of the service |
The primary version of the document is in English. Texts in other languages are provided for convenience; in case of discrepancies, the primary version shall prevail, except where mandatory provisions require interpretation in the language of the consumer.
This Data Processing Agreement (the "DPA") is part of the Terms of Service and meets the requirements of Article 28 of the GDPR. It applies whenever we process personal data on your behalf — in practice, the personal data contained in the websites you publish through the service. You do not need to request or sign it: it is concluded when you accept the Terms of Service and applies for as long as we process such data.
If you use the service purely for personal or household purposes, the GDPR does not apply to that use (Article 2(2)(c) GDPR), and this DPA has no effect for you.
1. Roles
1.1. For the content of your websites, you are the controller and we are the processor (Section 2 of the Privacy Policy). For the data of your account — email address, sessions, payments — we are the controller, and the Privacy Policy, not this DPA, applies.
1.2. If you publish a website for your own client and act as its processor, we are your sub-processor. You are responsible for passing the information in this DPA on to your client.
2. What we process
| Subject matter | Hosting and publishing the static websites that you or your AI agent upload |
| Nature of processing | Storing the files, including up to ten recent versions of each website; delivering them to visitors over the internet; deleting them |
| Purpose | Only to provide the service under the Terms of Service |
| Duration | For as long as the website exists, plus the deletion periods in Section 8 |
| Categories of personal data | Whatever personal data you include in your websites — for example, names, photographs, contact details, texts about people. When visitors open a website, their IP address and request data are processed in transit to deliver the page; we do not keep logs of these requests (Section 3 of the Privacy Policy) |
| Data subjects | People mentioned or shown in your websites — your employees, clients, and other third parties — and visitors to your websites |
The service is not intended for special categories of personal data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR). If you publish such data, you are responsible for the legal basis for it.
3. Your instructions
3.1. We process personal data only on your documented instructions. Your instructions are the Terms of Service, this DPA, and the actions you or your AI agent take through the service: uploading, publishing, updating, rolling back, and deleting websites.
3.2. We will inform you without delay if, in our opinion, an instruction infringes data protection law.
3.3. We process personal data otherwise only where required by the law of the European Union or a Member State. In that case we will inform you before processing, unless that law prohibits it.
3.4. We do not read, analyze, or use the content of your websites for our own purposes. We look at a website only to review a report of illegal content or a breach of Section 7 of the Terms of Service (Sections 8 and 9.7 of the Terms of Service).
4. Confidentiality
Access to the content of your websites is limited to the people who operate the service, and only to the extent necessary to provide it. They are bound by an obligation of confidentiality.
5. Security
We take the technical and organizational measures required by Article 32 of the GDPR, appropriate to the risk. Among them:
- websites and the service are served only over encrypted HTTPS connections, with HSTS;
- each website runs as a separate program on the infrastructure, isolated from other customers' websites;
- AI agent access keys are stored only in hashed and encrypted form, and each key gives access only to the websites of its own account;
- access to the infrastructure is limited to the people who operate the service and protected by individual credentials;
- version history allows a website to be restored after an erroneous update.
6. Sub-processors
6.1. You give us general authorization to engage sub-processors. At present, website content is processed by the cloud infrastructure provider that hosts the service and your websites (Section 7 of the Privacy Policy). An up-to-date list of sub-processors with their names is available on request at pavel.knx@gmail.com.
6.2. We will inform you by email at least 30 days before we add or replace a sub-processor that processes the content of your websites. You may object within this period. If we cannot resolve the objection, you may cancel your subscription and delete your account before the change takes effect.
6.3. We impose on each sub-processor, by contract, data protection obligations that are no less protective than those in this DPA. We remain liable to you for the performance of their obligations.
7. Transfers outside the EEA
The infrastructure delivers websites from data centers in the European Union and in other regions, so the content of your websites and visitors' request data may be processed outside the European Economic Area, including in the United States. Such transfers rely on the safeguards described in Section 8 of the Privacy Policy: certification of the recipient under the EU-U.S. Data Privacy Framework and/or the standard contractual clauses approved by the European Commission.
8. Deletion
8.1. When you or your AI agent delete a website, we delete its files, including all saved versions.
8.2. A website suspended for exceeding the plan limits, for non-payment, after the subscription has ended, or following a report of illegal content keeps its files for 30 days, after which they are deleted (Sections 2, 8.2, and 9 of the Purchase Policy).
8.3. When you delete your account, all your websites are deleted at once.
8.4. You keep the original files you upload, so returning the data is done by your own copies. On request at pavel.knx@gmail.com, before the website is deleted, we will send you the files of its current version.
8.5. After deletion, we keep no copies of the content of your websites, except where the law of the European Union or a Member State requires it. The record that a website existed at a given address, without its content, is kept for the period stated in Section 6 of the Privacy Policy.
9. Assistance
9.1. You can change or delete the content of your websites at any time through your AI agent, which is how you respond to requests from data subjects. If a data subject contacts us about your website, we will forward the request to you without undue delay and will not respond to it on your behalf, except to confirm receipt.
9.2. Taking into account the nature of the processing and the information available to us, we will assist you in meeting your obligations under Articles 32 to 36 of the GDPR: security, notification of breaches, data protection impact assessments, and prior consultation.
10. Personal data breaches
We will notify you without undue delay, and where possible within 48 hours, after becoming aware of a breach affecting the personal data in your websites. The notification goes to the email address of your account and describes, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed.
11. Audits
11.1. On request, we will make available to you the information necessary to demonstrate compliance with Article 28 of the GDPR.
11.2. You may audit our compliance with this DPA yourself or through an auditor bound by confidentiality, with at least 30 days' written notice, no more than once a year unless a breach has occurred, and at your own expense. The audit must not give access to other customers' data. We may meet an audit request by providing documentation and the audit reports or certifications of our sub-processors.
12. Final provisions
12.1. Liability under this DPA is governed by Section 11 of the Terms of Service.
12.2. In the event of a conflict between this DPA and the other documents concerning the processing of personal data on your behalf, this DPA prevails.
12.3. This DPA is changed in the same way as the Terms of Service (Section 13 of the Terms of Service) and ends when we no longer process personal data on your behalf.
13. Contacts
pavel.knx@gmail.com