Data processing agreement
Version of Nov 7
Draft pending legal review: this text describes how Sotance actually works, but has not yet been checked by a lawyer.
Parties and scope
This agreement is part of the terms between your organization (the controller) and Altis Koten SRL (the processor), under article 28 of the GDPR. It covers the personal data in your account: the users you invite, and any personal data you enter in brands, facts or questions.
What we do with it
We process it only to run Sotance for you, on your documented instructions (using the service is one), and never for our own purposes. We tell you if an instruction seems to break the law.
Security
- Encryption in transit everywhere, and at rest at our hosting providers.
- Sign-in with Google, or by email and a password stored only as an Argon2id hash; sessions capped at 30 days.
- Each organization's data separated in every query; access is checked on every request.
- Staff access on a need-to-know basis, under confidentiality.
Subprocessors
You authorize the subprocessors below. We give you 30 days' notice of any new one, and you may object; if we can't meet the objection, you may end the contract.
| Service | What for | Where | Personal data |
|---|---|---|---|
| Google Cloud (Cloud Run) | Hosting and page rendering | Belgium (Google Cloud europe-west1) | Yes |
| Neon | Database | European Union | Yes |
| Vercel | Hosting and page rendering | France (Paris region), for rendering pages | Yes |
| Vercel (Web Analytics, Speed Insights) | Visit and page-speed measurement | [to be completed] | Yes |
| Resend | Email delivery | [to be completed] | Yes |
| Stripe | Payments and invoices | Ireland (Stripe Payments Europe) | Yes |
| DataForSEO | AI answers we measure | – | No |
| cloro | AI answers we measure | – | No |
| Anthropic | AI answers we measure | – | No |
| OpenAI | AI answers we measure | – | No |
| Google (Gemini API) | AI answers we measure | – | No |
Breaches, help and audits
We notify you of a personal data breach without undue delay, and within 48 hours of becoming aware of it. We help you answer data subjects' requests and with impact assessments, and give you the information needed to show compliance, including an audit once a year on reasonable notice.
End of the contract
When the contract ends you can export your data; we then erase it within 30 days, backups included, unless the law requires us to keep it.