Data processing agreement
Effective date: 25 October 2026
This agreement is part of the Loonis Terms of service. It applies when Loonis processes personal data for you as part of your site. It meets article 28 of the GDPR. In it, "you" are the controller and Loonis (Loonis | Karyna Movsha, al. Kijowska 5/22, 30-079 Kraków, Poland, NIP 9542796135, REGON 540625012) is the processor.
1. What Loonis processes for you
| Subject | Hosting and running your site, its forms and your Leads inbox |
| Duration | As long as you have an account, then deletion as in section 9 |
| Nature and purpose | Storing, showing, sending by email, backing up and deleting data, and using AI to write and edit your site |
| Types of data | Contact details and messages visitors send through your forms (name, email, phone, budget, message); people named or shown in content you add (staff, clients, partners) |
| Data subjects | Visitors to your site, your staff, clients and other people in your content |
You must not collect special categories of data (such as health data) or data about criminal convictions through your site.
2. Your instructions
Loonis processes the data only to provide Loonis as described in the Terms and as you set it up in the app. These are your documented instructions. If Loonis thinks an instruction breaks data protection law, it will tell you. Loonis will not use the data for anything else, unless the law requires it, in which case it will tell you first where allowed.
3. Confidentiality
Everyone at Loonis who can access the data is bound to keep it confidential.
4. Security
Loonis protects the data with measures suited to the risk, including:
- encrypted connections (HTTPS) and encrypted storage at our providers;
- access rules in the database so each owner reaches only their own data;
- hashed passwords and optional two-factor login;
- access for Loonis staff only when needed to run or support the service;
- daily database backups and weekly file backups in the EU;
- logs of errors and failures, reviewed by the team.
5. Sub-processors
You allow Loonis to use the sub-processors below. Loonis binds each one to data protection duties at least as strict as these. Loonis will tell you by email at least 30 days before adding or replacing one; you may object in that time, and if we cannot solve it, you may end your plan with a pro rata refund.
| Sub-processor | Service | Location | Transfer safeguard |
|---|---|---|---|
| Supabase Inc. | Database, storage, login | EU (Ireland) | Not needed for storage; standard contractual clauses for support access |
| Vercel Inc. | Hosting | EU (Dublin), global delivery | EU-US Data Privacy Framework and standard contractual clauses |
| Anthropic PBC | AI that writes and edits your site | USA | Standard contractual clauses |
| Resend (Plus Five Five Inc.) | Lead and notification emails | EU (Ireland) | Standard contractual clauses |
| Cloudflare Inc. | Backups of photos and logos | EU | EU-US Data Privacy Framework |
| GitHub Inc. | Running the backup job | USA | EU-US Data Privacy Framework |
6. Helping you
Loonis will help you, as far as it reasonably can:
- answer requests from people using their GDPR rights. You can also export or delete leads yourself in the app;
- meet your duties on security, breach notices, impact assessments and consulting the authority.
If a visitor writes to Loonis directly, Loonis will pass the request to you.
7. Data breaches
Loonis will tell you without undue delay, and within 48 hours of finding out, about a breach affecting your data. It will give you what you need to report it: what happened, what data and people are affected, the likely effects and what we are doing.
8. Audits
Loonis will give you the information you need to show this agreement is followed. You may ask for an audit once a year, at your cost, with 30 days' notice, in a way that protects other owners' data. A written answer to your questions comes first.
9. When the agreement ends
When you delete your site or account, Loonis deletes the data within 30 days. Copies in backups are deleted when the backups roll over, within 4 weeks. Before you delete, you can download your leads from the app.
10. Liability and order
The liability rules in the Terms apply, except where the GDPR does not allow a limit. If this agreement and the Terms differ on data protection, this agreement applies.