Data Processing Agreement

1. How this agreement is concluded

When you accept the terms of service (by creating an account or choosing a plan), you also accept this agreement on behalf of your organisation; you don't have to sign anything. It applies for as long as we process Customer Personal Data for you.

Need a signed copy for your records? Email [email protected] and we send you this same text as a PDF signed by us. Where this agreement and the terms of service say different things about personal data, this agreement applies.

2. Roles and scope

“Customer Personal Data” means the personal data described in section 3, which we process on your behalf. You decide why and how it is processed (the controller); we process it only to provide Duelpilot to you (the processor).

Not covered: the data of the people who use the app (their account, sign-in and the payment details of your plan). We process that as a controller, as described in our privacy policy.

If you use Duelpilot for a client (for example as an agency), you are their processor and we are your sub-processor; you confirm that your client has authorised this, and you pass on their instructions to us.

3. What we process, for whom and why

Visitors of your website, through the script:

• A random visitor id and the variant shown, in the visitor's browser storage (no cookies), so they see the same variant again. It stays in the browser: the script does not send it to us.
• Counting pings: which test and variant was shown, which goal converted (with the order value when a goal counts revenue), the device type and new or returning. They are added to daily totals; we keep no visitor-level records, profiles or session recordings. Each ping carries a random batch id that we keep for 24 hours to avoid counting it twice. On the Code plan, the pings your own servers send carry a batch id derived from a one-way hash of the visitor id, kept for the same 24 hours.
• Health pings, for about 1% of pageviews: the page path (without the query string), the device type, which analytics and consent tools were found, the script version and how fast the page was ready. Added to daily tallies.
• IP address: used in memory only, as a hash with a random salt that changes every day and is never stored, to limit how many pings one address can send. When a test targets countries and the network in front of our servers supplies the visitor's country, that country code is used to choose the variant. IP addresses are never stored with the counts.

People who appear in your own content:

• Page outlines, snapshots and screenshots of your own pages, taken when your agent inspects them and when we check variants or read your site's style: whatever your pages show, for example names in reviews or photos of your team.
• Brand files you upload (brand books, logos, fonts, images) and the links and rules you add: any personal data in them, for example photos of people.
• If you connect Google Analytics: the reports we read for your tests (visitors, conversions and revenue per variant and page).

Purpose: only to provide Duelpilot to you: serve your variants, count results, check variants on phones, tablets and desktops, show previews, apply your brand and report to you and your agent. We don't sell Customer Personal Data, don't use it for advertising and don't use it to train AI models. Please don't put special categories of personal data (such as health data) in your tests or brand files; the script is not built to collect them.

4. What we commit to

• We process Customer Personal Data only on your documented instructions: these terms and this agreement, your settings in the app, and what you or your AI agent ask for through your connection. If an instruction seems to us to break data protection law, we tell you. If the law requires us to process data otherwise, we tell you first unless the law forbids it.
• Everyone at our side who can access Customer Personal Data is bound to confidentiality.
• We protect it with the technical and organisational measures in Annex 2, and keep them at least at that level.
• We use sub-processors only as described in section 6.
• We help you answer requests from data subjects (section 8) and meet your duties on security, breach notification, impact assessments and prior consultation (GDPR articles 32–36), taking into account what we process and the information we have.
• We delete or return Customer Personal Data as described in section 9, and give you the information you need to show compliance (section 10).

5. What you commit to

• You have a lawful basis for the processing and inform your visitors, for example in your privacy notice.
• You set up consent as your law requires: the script follows the consent setup you configure (for example Google Consent Mode, TCF or your cookie banner), and whether it may run before consent is your decision.
• Your instructions to us, and to your AI agent, comply with data protection law.

6. Sub-processors

You authorise us to use the sub-processors listed in Annex 3. We bind each of them by contract to data protection obligations that offer the same level of protection as this agreement, and we remain responsible to you for their work.

We announce a new or replacing sub-processor at least 30 days before it starts processing Customer Personal Data, on our public updates page and by email to the owners of your organisation. You can object within those 30 days on reasonable data protection grounds by emailing [email protected]. We will then look for a solution with you in good faith; if we can't find one, you may end the affected subscription before the change takes effect.

7. Where the data is

We store and process Customer Personal Data on servers in the EU (DigitalOcean, Frankfurt). The visitor data from section 3 (counting pings, health pings, IP addresses) is handled only there and is never transferred outside the European Economic Area.

Only an email you send to our address may be handled by Cloudflare outside the EEA on its way to our inbox, under its data processing agreement with the EU Standard Contractual Clauses. Data your own AI agent reads through your connection goes to your AI provider at your request and under your agreement with it; Google Analytics is your own Google account. We make no other transfer, and will only make one with the safeguards Chapter V of the GDPR requires and after telling you as in section 6.

8. Breaches and requests from data subjects

If we become aware of a personal data breach affecting Customer Personal Data, we inform the owners of your organisation by email without undue delay, and in time for you to meet your own 72-hour duty to notify the supervisory authority. We tell you what we know, as far as available: what happened, the categories and approximate number of people and records concerned, the likely consequences, and what we did and propose to do about it. We add details as we learn them, and help you notify the authority and the people affected where needed.

If a visitor or another data subject contacts us about Customer Personal Data, we pass the request on to you and don't answer it ourselves unless you ask us to. We help you answer it. Because we keep no records per visitor, there is usually nothing about one visitor to find; a visitor can clear their browser storage at any time, after which nothing links them to earlier visits. Personal data in your files and snapshots can be removed by deleting the file (Settings → Brand) or the site (Settings → General), or by asking us at [email protected].

9. Deletion and return

• You can remove each uploaded brand file at any time (Settings → Brand).
• When you delete a site (Settings → General), we delete its data and files: counting totals, page snapshots, screenshots and the brand files you uploaded included. When you ask us to delete your account, we do the same for all of it.
• Copies in our nightly backups are deleted within 14 days.
• Want a copy first? Ask us at [email protected] before you delete, and we provide it in a common, machine-readable format.
• We keep Customer Personal Data longer only where EU or member state law requires it, and then only for that purpose.

10. Information and audits

On request we give you the information you need to show that this agreement is complied with, such as answers to your security questionnaire. If that is not enough, you, or an independent auditor you mandate who is bound to confidentiality, may audit our compliance with this agreement: with reasonable notice, during business hours, without access to other customers' data, and in a way that doesn't disrupt the service or put its security at risk. Each party bears its own costs.

11. Liability, changes and law

The limitations of liability in the terms of service apply to this agreement as far as the law allows.

We may update this agreement, for example when we add a sub-processor or the law changes; we tell you about important changes in advance and never lower the protection of Customer Personal Data without your agreement. This agreement is governed by the laws of the Netherlands. Questions: [email protected].

Annex 1: Details of the processing

Subject matter, nature and purpose, the categories of personal data and of data subjects: section 3. Duration: for as long as you use Duelpilot, until the data is deleted as in section 9. Special categories of personal data: none intended.

Annex 2: Security measures

The technical and organisational measures are the ones in our privacy policy under How we protect your data: encryption in transit (HTTPS with HSTS), encryption at rest for credentials, hashed tokens and sign-in codes, EU-hosted infrastructure with the database on a private network, role-based access per organisation, least privilege for Google data, nightly backups kept for 14 days, deletion, and incident handling. For Customer Personal Data in particular:

• IP addresses are hashed in memory with a daily random salt that is never stored; counts are daily totals without visitor-level records.
• Uploaded brand files are private and only reachable through signed links that expire (15 minutes for agents, 1 hour for people); text is read from PDFs on our own servers, without AI, in an isolated process.
• Our servers only fetch pages from your site's own domains, through a guard against requests to internal networks; brand reading never clicks, submits or opens account, cart or checkout pages.

Annex 3: Sub-processors

These providers do not process Customer Personal Data:

• Resend (email delivery): Sends our emails to your team: sign-in codes and notices about your sites and tests. It receives your team members' email addresses, the names of your sites and the titles of your tests, which we process as a controller under our privacy policy; never visitor data, page snapshots or brand files.
• Stripe (payments): Handles your plan's billing details, which we process as a controller. It receives no data about your website's visitors.
• Google (Google Analytics): Only if you connect it: Google Analytics is your own service. On your instruction we register custom dimensions in the property you chose and read reports from it; we send it no visitor data.
• Your AI provider (for example Anthropic or OpenAI): Your own agent runs there under your agreement with that provider. What it reads through your Duelpilot connection (results, page outlines, screenshots, brand files) goes to it at your request; if you set up a routine trigger, we call it with a short notice about the job.