Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Sitesui Terms of Service between the customer (“Customer”, the controller) and Sitesui (“Sitesui”, the processor) and applies whenever Sitesui processes personal data on the Customer’s behalf in providing the Service. Where a signed copy is required, email hello@sitesui.app and one is returned within two business days.

1. Roles and scope

The Customer decides what personal data enters the Service — names and contact details of its team, vendors, residents, clients and inspectors; photographs, notes and voice recordings taken during inspections; addresses and access notes for properties. Sitesui processes that data only to provide, secure and support the Service, on the Customer’s documented instructions, which are the Terms, this DPA, and the Customer’s use of the product’s controls.

2. Sub-processors

Sitesui uses the following sub-processors, each under a written agreement with equivalent obligations. The current list — with what each one does, what personal data it can see and where it processes — is published and kept current at sitesui.com/legal/subprocessors, and that page governs if this summary falls behind it:

• Vercel, Inc. — Application hosting, the edge network that serves every page, and the privacy-preserving counts behind our own page analytics.
• Supabase, Inc. — The database of record, sign-in and session handling, and the private buckets holding photos, video, voice notes, signatures and documents.
• Stripe, Inc. — Subscriptions, checkout and invoices.
• Resend, Inc. — Sending every email the product sends — verification, report and signing links, work-order notices, lifecycle mail and founder notes — and receiving replies so they become tickets.
• Twilio, Inc. — Text messages to vendors, staff and pros who opted in by replying YES, and the phone line: calls to our number and the messages callers leave.
• Cloudflare, Inc. — The second copy: a nightly copy of the database and every stored file in R2 object storage, at a different company from the one holding the originals. The copy is encrypted at rest by Cloudflare's storage, not separately by us. Backup copies expire after 35 days.
• GitHub, Inc. — Source control and the scheduled job that runs the backup.
• X.AI LLC (xAI) — Optional model calls (Grok): triage of a resident's report into a trade and an urgency for a person to confirm, which is on for a workspace until an owner or admin turns it off under Settings → Workspace; a summary of feedback a Sitesui user sends us about the app; the three-sentence summary at the top of our own end-of-day business brief; and drafting our own blog posts and help answers. (optional; runs only while switched on — the sub-processor page says by whom)
• Anthropic, PBC — Fallback only: the same model calls — resident-report triage where the workspace has it on, app-feedback summaries, the end-of-day brief, and our own blog drafting — go to Anthropic's Claude when no xAI key is configured. (optional; runs only while switched on — the sub-processor page says by whom)
• OpenAI, L.L.C. — Turning a voice note into words, and only when the inspector's own browser could not do it and the key is configured. (optional; runs only while switched on — the sub-processor page says by whom)
• Mapbox, Inc. — Turning a property address into a map pin, and suggesting addresses as they are typed. (optional; runs only while switched on — the sub-processor page says by whom)
• Komoot GmbH (Photon) — The free address lookup used when no Mapbox token is configured, built on OpenStreetMap data.

Sitesui gives at least 30 days’ notice by email before adding a sub-processor that will process Customer personal data; the Customer may object in writing and terminate without penalty if the objection cannot be resolved. To receive that notice, ask at hello@sitesui.app.

3. Security measures

• Encryption in transit (TLS 1.2+), and at rest for the database, file storage and backups through each storage provider’s own encryption (AES-256).
• Tenant isolation enforced in the database with row-level security; every table is covered by an automated isolation test that runs in CI on every schema change.
• Access to production data limited to named Sitesui staff accounts, which must present two-factor authentication in the session: without it the staff area does not open and the database does not answer a staff-level query; support access to a workspace is read-only and written to that workspace’s audit log.
• Nightly backups to a second provider, encrypted at rest by that provider, and restores rehearsed into a fresh database; backup copies expire after 35 days.
• Content Security Policy, signed webhooks, rate limiting on every public write, and dependency review on every change.
• Customer-controlled roles (owner, admin, inspector, viewer, billing) and region scoping; optional two-factor for each user, with single-use recovery codes; owners and admins can require two-factor for the whole workspace and see who has it on.

4. Confidentiality and personnel

Sitesui staff with access to Customer personal data are bound by confidentiality and receive access only to the extent needed to operate and support the Service. Support access to a workspace is read-only and recorded in that workspace’s audit log.

5. Assistance and data-subject requests

The Customer can export, correct and delete personal data from within the Service. Where a data-subject request needs Sitesui’s help, Sitesui assists within five business days. Requests received directly by Sitesui about Customer data are forwarded to the Customer.

6. Breach notification

Sitesui notifies the Customer without undue delay, and in any case within 72 hours of confirming a personal-data breach affecting Customer data, with what is known at the time and updates as the investigation proceeds.

7. Return and deletion

At any time the Customer can export all workspace data from the product. On termination or on request, Sitesui deletes Customer personal data from production on the eighth day after the workspace is closed (the seven days before are the Customer's window to restore it) — within 30 days in every case — and from backups as their copies expire (backup copies expire after 35 days), except where retention is required by law.

8. Audit

On written request, no more than once a year, Sitesui provides its security documentation, the results of its automated isolation tests, and answers to a reasonable security questionnaire. The standard answers are published.

9. International transfers

The application, the database and stored files run in the United States. Three services on the sub-processor page choose their own location: the backup copy on Cloudflare R2 (we set no jurisdiction on the bucket), the GitHub-hosted machine that runs the nightly backup, and the address lookup, which sends address text only to Komoot’s Photon service, operated from Germany. For customers subject to GDPR or UK GDPR, the parties rely on the EU Standard Contractual Clauses (Module 2) and the UK Addendum, incorporated by reference; the Customer is the data exporter and Sitesui the importer.

10. Precedence

If this DPA conflicts with the Terms of Service, this DPA governs for the processing of personal data.