Data Processing Agreement
Last updated: July 10, 2026
1. Parties and incorporation
This Data Processing Agreement ("DPA") is entered into between the customer using the AppIn service (the "Customer", acting as controller) and ISAP OÜ, Narva mnt 5, 10117 Tallinn, Kesklinna linnaosa, Harju maakond, Estonia, Estonian registry code 16838751 (the "Processor", "we", "us").
This DPA forms part of, and is incorporated by reference into, the Terms of Service (the "Terms"). It applies automatically to every Customer whose Customer Content contains personal data — no separate signature is required. In the event of a conflict between this DPA and the Terms, this DPA prevails with respect to the processing of personal data.
This DPA constitutes a data processing agreement within the meaning of Article 28(3) of Regulation (EU) 2016/679 ("GDPR"). Customers who require a countersigned copy for their records may request one at [email protected].
2. Definitions
- "Personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given to them in the GDPR.
- "Customer Content" — the content the Customer submits to the service for indexing and search (product catalogs, pages, documents and similar content), together with the search queries and chat messages submitted by End Users on the Customer's sites.
- "End User" — a visitor, shopper or other person who uses the search or chat functionality on a Customer's site.
- "Sub-processor" — a third party engaged by the Processor to process personal data contained in Customer Content on the Customer's behalf.
3. Subject matter, duration, nature and purpose of processing
Subject matter. The processing of personal data contained in Customer Content in the course of providing the AppIn service under the Terms.
Nature and purpose. Hosting and storage of Customer Content; indexing and embedding of content into vector representations; index-time content enrichment (LLM-generated search synonyms); execution of semantic search queries; conversational chat responses; routing of conversations to the Customer's own support agents (human handoff), including agent notifications; and display of usage analytics in the Customer's dashboard.
Duration. For the term of the Terms, plus the deletion window described in Section 11.
4. Categories of data subjects and personal data
Data subjects
- The Customer's End Users (site visitors, shoppers)
- The Customer's staff, to the extent their personal data appears in Customer Content
Categories of personal data
- Search query text submitted by End Users
- Chat messages submitted by End Users
- Standard HTTP request metadata (IP address, user agent, referrer)
- Any personal data incidentally contained in indexed Customer Content
Special categories of data
The service is not designed for, and must not be used to submit, special categories of personal data within the meaning of Article 9 GDPR (such as health data, biometric data, or data revealing racial or ethnic origin, political opinions, religious beliefs, or sexual orientation). The Customer shall not include such data in Customer Content.
5. Processor obligations
The Processor shall:
- Process personal data only on the Customer's documented instructions, including with regard to transfers to a third country, unless required to do so by EU or Estonian law — in which case the Processor will inform the Customer of that legal requirement before processing, unless the law prohibits such disclosure. The Terms, this DPA, and the Customer's configuration of the service via the API and dashboard constitute the Customer's complete documented instructions.
- Ensure that all personnel authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
- Immediately inform the Customer if, in the Processor's opinion, an instruction infringes the GDPR or other EU or member state data protection provisions.
6. Security (Art. 32 GDPR)
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, the Processor implements and maintains appropriate technical and organizational measures, including:
- Encryption in transit — TLS/HTTPS for all connections
- Encryption at rest — customer LLM API keys and other secrets encrypted at rest
- Credential protection — secret API keys stored SHA-256 hashed, never in plain text
- Tenant isolation — Customer Content stored in dedicated vector collections, per site or per shared data source where the Customer's sites share one catalog
- Access controls — API-key authentication and least-privilege administrative access
- Abuse prevention — per-plan rate limiting and anomaly monitoring
- EU hosting — application data hosted in EU data centers (Germany/Finland)
- Monitoring and logging — security logging and error monitoring of the service
7. Sub-processors
The Customer grants the Processor general written authorization to engage sub-processors for the processing of Customer Content. The Processor currently engages the following sub-processors:
| Sub-processor | Location | Purpose | Transfer mechanism |
|---|---|---|---|
| Hetzner Online GmbH | Germany/Finland (EU) | Cloud hosting of all application data | n/a (EU) |
| Cloudflare, Inc. | US/global (EU endpoints) | DNS, CDN, DDoS protection, widget delivery | EU–US Data Privacy Framework + SCCs |
| Google (Gemini API) | US/global | LLM processing (platform keys) | SCCs (in the provider's DPA) |
| OpenAI, L.L.C. | US | LLM processing (platform keys) | SCCs (in the provider's DPA) |
| Anthropic, PBC | US | LLM processing (platform keys) | SCCs (in the provider's DPA) |
| Mistral AI | France (EU) | LLM processing (platform keys) | n/a (EU) |
| Functional Software, Inc. (Sentry) | US | Error monitoring | EU–US Data Privacy Framework + SCCs |
| Microsoft (Azure OpenAI) | per configuration | LLM processing only where configured for a site | SCCs (in the provider's DPA) |
LLM sub-processors process data only when the Customer uses platform keys. Where the Customer configures its own LLM provider API key (BYOK), that provider is engaged directly by the Customer under the provider's own terms and is not a sub-processor of the Processor. The same applies to messaging channel operators (Telegram, WhatsApp, Facebook Messenger) the Customer chooses to connect to the chat assistant. Revolut processes payment data as an independent controller and is not a sub-processor of Customer Content.
The Processor will notify the Customer of any intended addition or replacement of sub-processors by email or via the dashboard, giving the Customer a 30-day window to object on reasonable data protection grounds. If the objection cannot be resolved, the Customer may terminate the affected part of the service in accordance with the Terms. Where a sub-processor fails to fulfil its data protection obligations, the Processor remains fully liable to the Customer for the performance of that sub-processor's obligations. The Processor imposes on each sub-processor, by contract, the same data protection obligations as set out in this DPA (in particular those of Article 28(3) GDPR), in substance.
8. International transfers
Customer Content is processed primarily within the European Union — hosting, storage, embedding, vector search and reranking take place on the Processor's own EU infrastructure (Hetzner, Germany/Finland). Personal data is transferred to sub-processors located outside the European Economic Area only where a valid transfer mechanism under Chapter V GDPR is in place, namely the European Commission's Standard Contractual Clauses and/or, where the recipient is certified, the EU–US Data Privacy Framework, as listed for each sub-processor in the table in Section 7.
For Customers subject to the Swiss Federal Act on Data Protection (FADP) or the UK GDPR, references in this DPA to the GDPR, the Standard Contractual Clauses and the EU–US Data Privacy Framework are read to include, so far as applicable, their Swiss and UK equivalents (the revised FADP, the SCCs as recognised by the Swiss FDPIC, the Swiss–US Data Privacy Framework, and the UK International Data Transfer Addendum / UK Extension to the EU–US DPF).
9. Assistance to the controller
Data subject requests
Taking into account the nature of the processing, the Processor shall assist the Customer by appropriate technical and organizational measures, insofar as this is possible, in fulfilling the Customer's obligation to respond to requests by data subjects exercising their rights under Chapter III GDPR (access, rectification, erasure, restriction, portability, objection). If the Processor receives a request from an End User directly, it will forward the request to the Customer without undue delay and will not respond on the Customer's behalf except as instructed.
Articles 32–36 GDPR
Taking into account the nature of the processing and the information available to it, the Processor shall assist the Customer in ensuring compliance with the Customer's obligations regarding security of processing (Art. 32), personal data breach notification (Arts. 33–34), data protection impact assessments (Art. 35) and prior consultation with supervisory authorities (Art. 36).
10. Personal data breach
The Processor shall notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Content. The notification will include, to the extent available, the information reasonably required to enable the Customer to comply with its own notification obligations under Articles 33 and 34 GDPR — including the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects. The Processor will provide further information as it becomes available and will cooperate with the Customer's reasonable investigation efforts.
11. Deletion and return of data
Upon termination of the Terms, or at the Customer's request during the term, the Processor shall, at the Customer's choice, delete or return all Customer Content, and delete existing copies. Residual copies are removed from the Processor's systems within 90 days, unless EU or Estonian law requires further retention of specific data. Token usage and billing logs are retained as billing records for as long as required for accounting and tax purposes under applicable law.
12. Audits
The Processor shall make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR, and shall allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, subject to the following conditions:
- No more than once in any 12-month period, unless required by a supervisory authority or following a personal data breach
- On at least 30 days' prior written notice
- During normal business hours and without unreasonable disruption to the Processor's operations
- At the Customer's cost
- Under appropriate confidentiality obligations covering the auditor and any findings
The Customer agrees to first review the written information, documentation, and any available third-party certifications or audit reports the Processor makes available, and to request an on-site audit only where these do not reasonably demonstrate compliance.
13. Liability and order of precedence
The liability of each party under this DPA is subject to the limitations and exclusions of liability set out in the Terms, which apply in aggregate across the Terms and this DPA. Nothing in this DPA limits either party's liability where such limitation is not permitted by applicable law.
In the event of any conflict between this DPA and the Terms or any other agreement between the parties, this DPA prevails with respect to the processing of personal data.
14. Governing law and venue
This DPA is governed by the laws of the Republic of Estonia, without prejudice to mandatory provisions of the GDPR and other applicable EU data protection law. Disputes are subject to the same venue as the Terms: Harju County Court (Harju Maakohus), Tallinn, Estonia.
15. Contact
ISAP OÜ
Narva mnt 5, 10117 Tallinn, Kesklinna linnaosa, Harju maakond, Estonia
Registry code: 16838751
Legal inquiries and countersigned copies: [email protected]
Privacy and data protection matters: [email protected]