Data Processing Agreement

Last updated October 13, 2026

This Data Processing Agreement (“DPA”) forms part of the SitePets Terms of Service. It applies whenever the SitePets Snippet runs on your Site and the GDPR, UK GDPR or Swiss data protection law applies to that processing. You (the website owner) are the controller. ManuSoft Inc, doing business as SitePets, is your processor. You accept this DPA by installing the Snippet.

1. What we process

• Subject matter and purpose: showing your Pet on your Site, and counting page loads on your Site so its Pet and your own statistics can reflect them.
• Nature of processing: on each page load, the visitor’s browser loads the Snippet files and your Pet’s appearance from cdn.sitepets.com and sends one request to b.sitepets.com carrying your Site Key. As with any web request, these requests carry the visitor’s IP address and browser headers in transit. We use them only to answer the request and to rate-limit abuse in memory. We don’t write them to disk, logs or backups. We store only a count of page loads per Site per hour.
• Data subjects: visitors to your Site.
• Personal data: IP address and request headers (such as user-agent and the Site’s origin), processed transiently only. No cookies are set, nothing is stored on the visitor’s device, and no identifier is created. No special categories of data.
• Duration: while the Snippet is on your Site.

2. Our commitments

• We process this data only on your documented instructions, which are these terms and how you configure the Snippet. If we think an instruction breaks data protection law, we will tell you.
• We use the data only to provide SitePets for your Site. We don’t combine it with data from other Sites, and we don’t use it for our own purposes. In particular, we don’t use it to measure our own marketing: we measure that only on sitepets.com.
• Everyone who can access the data is bound by confidentiality.
• We apply the security measures in section 5.
• We help you, as far as is reasonable, to answer data subject requests and with security, impact assessments and consultations with authorities. Since we store no per-visitor data, there is normally nothing to access or delete.
• We notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting your Site’s data.
• When you remove the Snippet or close your account, the only data left is aggregate counts, which contain no personal data.
• We make available the information you need to check that we meet this DPA, and allow reasonable audits, normally by answering a written questionnaire, at most once a year unless a breach or authority requires more.

3. Sub-processors

You authorise these sub-processors:

• Cloudflare, Inc. (USA, global network): content delivery, proxying and DNS for cdn.sitepets.com and b.sitepets.com.
• Hetzner Online GmbH (Germany): server hosting in the EU (Germany or Finland).
• Resend, Inc. (USA), sending from Amazon Web Services (SES) in the EU (Ireland): delivering sign-in and account emails to you. It never receives data about your Site’s visitors.

We bind each sub-processor to data protection terms at least as protective as this DPA. We will announce a new sub-processor on this page and by email to account holders at least 30 days before it starts. You can object on reasonable data protection grounds; if we can’t address the objection, you can stop using SitePets and we will refund the unused part of any paid Adoption.

4. International transfers

ManuSoft Inc, Cloudflare and Resend are US companies. Transfers to them rely on the EU-US Data Privacy Framework (and its UK and Swiss extensions) where the recipient is certified. Where that isn’t available, including if the Framework is invalidated, the European Commission’s Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor), apply between you and us and are incorporated into this DPA by reference, together with the UK International Data Transfer Addendum and the Swiss amendments where those laws apply. For those clauses: the optional docking clause (Clause 7) applies; sub-processors are authorised in general under Clause 9(a) with the notice period above; Clause 11’s optional language doesn’t apply; and the governing law and courts (Clauses 17 and 18) are those of the EU member state where you are established, or Ireland if you are established outside the EU. The annexes are completed by sections 1, 3 and 5 of this DPA.

5. Security measures

• All traffic uses HTTPS. Servers run in the EU behind Cloudflare, with access limited to named administrators using key-based login.
• No visitor IP address or other per-visitor identifier is written to disk, logs, databases, error tracking or backups.
• Rate limiting uses the Site Key, or the IP address in memory only.
• Page loads are stored only as hourly counts per Site.
• Backups are encrypted, and access to production data is logged.

6. Liability and order of precedence

Liability under this DPA is subject to the limits in the Terms, except where data protection law or the Standard Contractual Clauses don’t allow that. If this DPA conflicts with the Terms, this DPA wins. If it conflicts with the Standard Contractual Clauses, the Clauses win.

Questions: [email protected].