Data processing agreement (DPA)

1. Subject and parties

This agreement supplements the terms and applies between the customer as controller and Loaded AG, Klostergutstrasse 4, 8252 Schlatt TG, Switzerland, UID CHE-413.943.367, VAT no. CHE-413.943.367 MWST, as processor. It governs the processing of personal data on the customer’s behalf under art. 9 of the Swiss Federal Act on Data Protection (FADP) and, where it applies, under art. 28 of the General Data Protection Regulation (GDPR). The German version prevails.

Data we process as controller in our own right is not covered by this agreement but by the privacy notice for the app: the account and sign-in, billing, protection against abuse and operations.

2. Nature, purpose and duration of the processing

We process the data only to run the dashboard for the customer: asking the customer’s questions on AI engines, storing and analysing the answers, showing the results in the dashboard, through the API and the MCP connection, and managing access for the people in the customer’s organisation.

The processing lasts as long as the contract and after it until the data is deleted under section 10.

3. Data and data subjects

• People in the customer’s organisation: email address (when signing in with Google or Microsoft also the provider’s profile details, such as the name), role, invitations, the first characters and the hash of their API keys, their connections with tools and their use per day.
• Project content: website, questions, brands and competitors with spellings and websites, facts and actions. They contain personal data where they name people, for example in a company name.
• Texts the dashboard reads or collects: the home page and imprint of the customer’s website, public websites for actions, the AI engines’ answers with their sources and searches. They can contain names of people, for example owners or employees of the customer or its competitors.

The dashboard does not deliberately process sensitive personal data. The customer words their questions so that they do not ask for such data.

4. Instructions

We process the data only on the customer’s instructions. These follow from the terms, this agreement and the settings the customer makes in the dashboard. The customer gives further instructions in writing or by email. If we consider an instruction unlawful, we tell the customer.

5. Our duties

• We bind everyone with access to the data to confidentiality.
• We support the customer when data subjects exercise their rights, and with data protection impact assessments as far as our processing is concerned.
• We report a data security breach affecting the customer’s data as soon as possible, with what we know about its nature, consequences and measures.
• On request we give the customer the information they need to check compliance with this agreement. We agree on-site audits with reasonable notice; the customer bears their cost.

6. Technical and organisational measures

We protect the data appropriately under art. 8 FADP and art. 32 GDPR. This is how the dashboard is built today:

• Location: the database, sign-in and files are at Supabase in the Zurich region. The application runs at Vercel in the Frankfurt region. Every connection is encrypted (HTTPS).
• Separation of customers: every table is protected by row level security. A person sees only the data of the organisations they belong to; automated tests check this for every table.
• Roles: owner, admin, member and view only have only the rights they need. What a person reads or changes in the dashboard, the server reads and changes with that person’s rights. The server works with wider rights only to run the service: collecting answers, imports and scheduled jobs.
• Sign-in: Supabase Auth manages passwords; we never see them. Sessions sit in cookies only the server can read. Cloudflare Turnstile protects sign-up.
• Keys and tokens: we store API keys, invitation links and connection tokens only as a SHA-256 hash. A key is shown once, can be revoked at any time and stops working as soon as its person leaves the organisation. Connections use OAuth 2.1 with PKCE; an access token lasts an hour, a refresh token 30 days and is replaced at every use.
• Abuse: sign-in, sign-up and the interfaces are limited per time window, per minute, per quarter hour or per hour depending on the case. For this we keep IP addresses and email addresses only as a pseudonymised value (HMAC) and delete it at the next clean-up once it is older than one day.
• Logs: we store errors without email addresses, keys and tokens. We count page views with a short hash of the person instead of their identifier, without the IP address, and delete them after 30 days. The dashboard loads no advertising or analytics scripts.
• Raw provider responses are kept in private file storage. When the owner deletes the organisation, we delete its rows and its files.
• Operations: a check every five minutes reports outages. Code changes pass automated tests; test environments hold no customer data. Credentials for services are never in the code.

We keep the measures up to date with the state of the art without lowering the level of protection.

7. Subprocessors

The customer allows us to engage the providers in the list of subprocessors. We bind them by contract to data protection equivalent to this agreement.

We announce a new or replaced subprocessor at least 30 days ahead by email to the owner and on the list. The customer can object for good reason; if we find no solution, they can end the contract as of the change.

The AI engines themselves (ChatGPT, Gemini, Google AI Overview, AI Mode, Perplexity) receive, through our data providers, only the wording of the questions with country and language, no details of the customer’s people.

8. Transfers abroad

Some subprocessors are based in the USA or process data there. We transfer data abroad only where the country offers adequate protection or appropriate safeguards exist: for the USA the Swiss-U.S. Data Privacy Framework or the EU-U.S. Data Privacy Framework where the provider is certified, otherwise the European Commission’s standard contractual clauses with the adjustments for Switzerland (art. 16 f. FADP, art. 44 ff. GDPR).

9. Data subjects’ rights

The customer answers requests from data subjects. Much of it they can do themselves in the dashboard: remove people from the team, archive questions and brands, download data, delete the organisation. If a data subject contacts us, we refer them to the customer.

10. Return and deletion

The customer can download their data at any time as CSV, through the API and the MCP connection. When the owner deletes the organisation, we delete its data in the database at once and its files in file storage; what file storage does not accept at once we delete afterwards.

After the contract ends the data stays stored until the owner deletes the organisation or asks us to delete it. We confirm a deletion on request in writing. Data we must keep as controller in our own right, such as accounting records, is kept under the privacy notice.

11. Liability and final provisions

Liability follows the terms. Where personal data is concerned, this agreement prevails over the terms in case of conflict. Swiss law and the jurisdiction of the terms apply, unless the GDPR mandatorily provides otherwise.

We answer questions about this agreement at bw@anewera.ch.