Skip to content
siter.io home
Start free

Data Processing Addendum

Last updated: October 21, 2026

This Data Processing Addendum ("DPA") forms part of the Terms and Conditions between Designmodo Inc. ("Siter.io", "We", "Us" or "Our") and the customer that has agreed to them ("Customer", "You" or "Your"). It applies when We process Personal Data on Your behalf while providing the Service, and it takes precedence over the Terms where the two conflict on the protection of Personal Data.

You accept this DPA by agreeing to the Terms. It needs no signature, and We do not countersign separate copies.

1. Definitions

Words defined in the Terms have the same meaning here. In addition:

  • Data Protection Laws means all laws that apply to the processing of Personal Data under this DPA, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it forms part of UK law with the UK Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended ("CCPA").
  • Customer Personal Data means Personal Data that We process on Your behalf as part of the Service, as described in Annex 1.
  • Controller, Processor, Data Subject, Personal Data, Processing and Personal Data Breach have the meanings given in the GDPR. Business, Service Provider, Sell and Share have the meanings given in the CCPA.
  • Subprocessor means a third party We engage that processes Customer Personal Data.
  • Standard Contractual Clauses or SCCs means the clauses annexed to European Commission Implementing Decision (EU) 2021/914, and UK Addendum means the International Data Transfer Addendum issued by the UK Information Commissioner.

2. Roles of the Parties

For Customer Personal Data, You are the Controller and We are Your Processor. Where You act as a Processor for someone else, We are Your Subprocessor, and You confirm that Your instructions are authorized by that Controller.

This DPA does not cover Personal Data We process as a Controller for Our own purposes, such as Your Account details, billing information and how You use the Service. Our Privacy Policy covers that data.

3. Processing on Your Instructions

We process Customer Personal Data only on Your documented instructions, unless the law requires otherwise; in that case We will tell You first, unless the law forbids it. The Terms, this DPA and Your use and configuration of the Service, such as publishing a form, adding a recipient for form notifications, connecting Zapier or using Siter AI, are Your complete instructions.

We will tell You if We believe an instruction infringes Data Protection Laws.

You are responsible for having a lawful basis for the Personal Data You collect through Your websites, for the notices You give Your visitors, and for the third-party services You choose to add to Your websites, such as Google Analytics, Facebook Pixel, reCAPTCHA, YouTube, Vimeo, Unsplash photos or Google Maps. Those providers act under their own terms with You or Your visitors, not as Our Subprocessors.

4. Confidentiality

We make sure that everyone We authorize to process Customer Personal Data is bound by an obligation of confidentiality, and that Our staff access it only as needed to provide the Service, support You, prevent abuse and meet legal obligations.

5. Security

We implement the technical and organizational measures described in Annex 2, appropriate to the risk of the processing. We may update them, provided the overall level of protection does not decrease.

6. Subprocessors

You give Us general authorization to engage Subprocessors. The current list is in Annex 3.

We will notify You of any new Subprocessor at least 30 days before it starts processing Customer Personal Data, by email to the Account owner and by updating Annex 3. You may object on reasonable data protection grounds within that period. If We cannot address the objection, You may terminate the affected Subscription and receive a refund of prepaid fees for the remaining period.

We impose on each Subprocessor data protection obligations that are no less protective than this DPA, and We remain liable to You for its performance.

7. Data Subject Requests

The Service lets You find, export and delete the Personal Data in Your websites yourself: form entries can be searched, exported as CSV and deleted one by one, websites can be deleted with their form entries, and files can be deleted from the File Manager. If We receive a request from one of Your Data Subjects, We will refer them to You and will not respond ourselves, unless the law requires it. Where You cannot answer a request with the Service, We will give You reasonable help.

8. Assistance

Taking into account the nature of the processing and the information available to Us, We will give You reasonable help with Your obligations on security, Personal Data Breach notification, data protection impact assessments and prior consultation with supervisory authorities.

9. Personal Data Breaches

We will notify You without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice will describe the breach, the categories and approximate number of Data Subjects and records concerned where known, the likely consequences, and the measures taken or proposed. Where information is not yet available, We will provide it as it becomes available.

Our notice is not an admission of fault or liability.

10. International Transfers

We are based in the United States. Customer Personal Data is stored and processed in the United States, and backups of it are also kept in Germany. Where Customer Personal Data subject to the GDPR, UK GDPR or Swiss law is transferred to a country without an adequacy decision, the parties agree that the transfer is governed by:

  • the SCCs, Module 2 (controller to processor), or Module 3 (processor to processor) where You are a Processor, which are incorporated by reference, with the optional docking clause 7 included, option 2 of clause 9(a) with the notice period of section 6, the option in clause 11(a) not included, clauses 17 and 18 governed by and decided in the courts of Ireland, and Annexes I to III completed by Annexes 1 to 3 of this DPA;
  • for transfers from the United Kingdom, the UK Addendum, completed with the same information; and
  • for transfers from Switzerland, the SCCs with the references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority.

11. Return and Deletion

While Your Subscription is active, You can export Your form entries as CSV and delete Your websites, pages, form entries and files at any time. Deleted websites and pages can be restored for 14 days from Recently deleted, and Our support can restore deleted files for 30 days; after that they are deleted.

When You delete Your Account, We delete it at once, together with Your websites, pages, form entries, collaborators, Siter AI chats and analytics, except where the law requires Us to keep data. Deleted files stay recoverable in Our storage for 30 more days, and the database stays in Our daily backups for 7 days; after that they are gone.

Account deletion includes the images You uploaded to the image library, page screenshots and page version history.

12. Audits

We will make available the information reasonably necessary to demonstrate compliance with this DPA. You may audit that compliance, by written request and on at least 30 days' notice, no more than once a year unless a supervisory authority requires it or after a Personal Data Breach. Audits happen during business hours, at Your cost, under confidentiality, and in a way that does not compromise the security of Our other customers. We will first try to answer an audit request with documentation and written answers.

13. CCPA

Where the CCPA applies, You are a Business and We are Your Service Provider. We will not Sell or Share Customer Personal Data; retain, use or disclose it for any purpose other than providing the Service, or outside Our direct business relationship with You; or combine it with Personal Data We receive from others, except as the CCPA permits. We will notify You if We can no longer meet these obligations.

14. Siter AI

When You or Your collaborators use Siter AI, the content of Your requests, including a copy of the page You are editing or the text You selected, is sent to Anthropic for text, and image descriptions are sent to OpenAI for image generation. Logos and images You upload are not sent to either provider. Under their commercial API terms, these providers do not use this content to train their models, and may keep it for a limited time for safety and abuse monitoring. We keep AI chats until You delete them, or until the website or Your Account is deleted, and delete a copy of a page sent with a request one day after the request finishes.

You should not include special categories of Personal Data in Siter AI requests. Siter AI can be turned off for an Account in Account → Privacy → Siter AI.

15. Liability and Term

Each party's liability under this DPA is subject to the limitations of liability in the Terms. This DPA lasts as long as We process Customer Personal Data, and the provisions that by their nature should survive termination survive it.

16. Changes to this DPA

We may update this DPA to reflect changes in Data Protection Laws or in the Service. We will notify You of a material change at least 30 days before it takes effect, by email to the Account owner and a notice on this page. No change will reduce the protection of Customer Personal Data.

Annex 1: Details of the Processing

  • Data exporter: the Customer, as Controller (or Processor), using the Service.
  • Data importer: Designmodo Inc., 169 Madison Ave, #79627, New York, NY 10016, United States, as Processor. Contact: [email protected].
  • Subject matter and duration: providing the Service under the Terms, for as long as You use it and until Customer Personal Data is deleted under section 11.
  • Nature and purpose: hosting and publishing Your websites; receiving, storing and emailing form submissions to the recipients You choose; storing and serving files You upload; counting visits to Your published websites with Siter Analytics; running Siter AI requests You make; making the data available to Your collaborators and to integrations You connect, such as Zapier.
  • Categories of Data Subjects: visitors to Your published websites; people who submit Your forms; people whose Personal Data appears in Your content, files or Siter AI requests; Your collaborators.
  • Categories of Personal Data: whatever Your forms ask for, such as names, email addresses, phone numbers and messages; Personal Data in Your website content, uploaded files and Siter AI requests; the IP address of each person who submits a form, kept with the form entry; technical data of website visitors, such as IP addresses and browser user agents, processed to deliver and protect Your websites. Siter Analytics does not store IP addresses: it counts visitors with a hash that changes daily, and keeps only the country. Server logs contain IP addresses and request contents, and are deleted after one year. The access logs of Our file delivery network record no IP addresses and are deleted after 35 days. A form entry's IP address, and the approximate city derived from it, are kept with the entry until the website or Your Account is deleted.
  • Special categories: none are intended. You should not collect them with the Service unless You have assessed that it is appropriate.
  • Frequency: continuous, for as long as the Service is used.

Annex 2: Technical and Organizational Measures

  • Encryption in transit: every published website, on name.getsiter.com or a custom domain, is served over HTTPS with an automatically issued certificate; the Service itself is served over HTTPS.
  • Encryption at rest: files and assets in Amazon S3 are encrypted with server-side encryption (SSE-S3), and passwords are stored as bcrypt hashes. The database server's disk and its backups are encrypted.
  • Access control: each website has its own team with Owner, Admin and Member roles, and only its team can see its form entries, files and analytics. Our staff access Customer Personal Data only as section 4 allows, through an admin area on its own subdomain, and staff access to Customer Personal Data is logged and the log kept for 12 months.
  • Form protection: forms can use Google reCAPTCHA v3 with Your own keys, and published websites are rate limited per visitor.
  • Availability and recovery: page version history for 30 days, 14 days to restore deleted websites and pages, restorable form entries, deleted or overwritten files recoverable for 30 days, and daily backups of the database server, the last 7 kept.
  • Data minimization: Siter Analytics sets no cookies; Siter AI sends a provider only what a request needs and never Your uploaded images.
  • Monitoring and incident response: the Service, published websites and scheduled jobs are monitored with Pulsetic, which alerts Our team to downtime and to jobs that stop running; automatic health checks restart failed services; and traffic and spending alarms at AWS, and the Service's own traffic alerts, email Our team. Incidents are handled under section 9.
  • Subprocessor management: as section 6.

Annex 3: Subprocessors

We use these Subprocessors for Customer Personal Data:

  • Amazon Web Services, Inc.

    Storage and delivery of website assets and uploaded files (Amazon S3 and CloudFront). Location: United States (us-east-1), with CloudFront delivering copies from locations near visitors.

  • Hetzner Online GmbH

    Servers that run the Service and published websites, their database and its backups. Location: United States (Ashburn, Virginia); backups also in Germany (Falkenstein).

  • Cloudflare, Inc.

    Delivery and protection of the Siter.io app and its API, through which form submissions and other requests pass. Location: global network, United States company.

  • Postmark

    Sending form submission notifications, invitations and other Service emails. Location: United States.

  • Anthropic, PBC

    Text generation for Siter AI, only when Siter AI is used. Location: United States.

  • OpenAI, L.L.C.

    Image generation for Siter AI, only when an image is generated. Location: United States.

  • Help Scout PBC

    Customer support, only for Personal Data You share with Us in a support request. Location: United States.

Published websites also load some resources from third parties, so their visitors' browsers send those providers their IP address and browser details: fonts and script libraries from Google (Google Fonts and Google Hosted Libraries) and jQuery from code.jquery.com. Videos You embed load from YouTube or Vimeo, and maps from Google Maps.

Tools that measure visits to siter.io itself, such as Google Analytics, Plausible and Pulsetic, process data of Our own visitors, not Customer Personal Data, and are described in the Privacy Policy.

Payment providers such as Stripe and PayPal process Your billing data with Us as Controller, and are described in the Privacy Policy.

Contact Us

For questions about this DPA or to exercise Your rights under it, You can contact us: