Data Processing Agreement (DPA)

“Customer” or “you”: the person or company with a Berse account who publishes sites with Berse and decides why and how their visitors’ data is processed. The customer is the controller.

“Berse” or “we”: whoever provides the service at berse.ai, which processes that data on the customer’s behalf. Berse is the processor.

“Customer personal data”: the personal data Berse processes on the customer’s behalf while providing the service, described in section 3.

“Data subjects”: the people that data relates to (for example, people who visit the customer’s sites or write to them through a form).

“Sub-processor”: a provider Berse engages to carry out part of the processing.

“Security breach”: a security incident leading to the unauthorized destruction, loss, alteration, disclosure of or access to customer personal data.

“Data protection law”: the CCPA/CPRA and other US privacy laws, Brazil’s LGPD and any other data protection law that applies to the processing.

This agreement applies when Berse processes personal data on the customer’s behalf. It doesn’t apply to the data of the customer’s own account, which Berse controls under the privacy policy.

It is part of the Terms of service. By using Berse to publish or host sites, you accept this agreement, which is legally binding between you and Berse. If you need a signed copy, write to us.

Order of precedence: for everything relating to the processing of customer personal data, this agreement prevails over the Terms, and the Terms over the privacy policy.

It applies to both kinds of Berse site: editable sites and sites made by Cortex.

Subject matter: providing the customer with the Berse service insofar as it involves third parties’ personal data.

Duration: while the customer has the site or project on Berse, and afterwards for the deletion periods in section 11.

Nature and purpose, by activity:

Hosting of published sites (editable and made by Cortex): serving the site and logging, for a limited time, the technical data of each request for security.

Audience measurement (Pulse): recording visits and what is done on the site without cookies, counting unique visitors with a code that changes every day (without storing the IP), detecting returning visitors with the berse:pulse local record (no identifier; Berse only receives ranges) and counting contacts (forms sent and clicks that lead to calling, writing, WhatsApp, directions, booking or paying), to show the customer aggregated figures and their weekly summary.

Forms: receiving the messages visitors send through the site’s forms (what they write, the page and the date), keeping them in the project so the customer and the project’s editors can read, sort, answer or download them, and emailing the project’s people the customer chooses, with the visitor’s email as the reply-to address. To curb abuse a short, keyed fingerprint of the visitor’s address is kept, never the address itself; messages that look like spam are set apart and nobody is emailed about them.

Managed email (“Berse handles it”): receiving the messages from the site’s forms and forwarding them by email to the project’s people, with the visitor’s email as the reply-to address, without keeping their content; they are only counted to enforce limits.

Media and files: storing the images and files the customer uploads or attaches, which may contain personal data (for example, photos of people), and their sites’ files and code.

Machines for the live preview and for sites made by Cortex: running the code of the customer’s site in an isolated machine to show its live preview and, for sites made by Cortex, building it and reviewing it with screenshots.

Cortex: reading and editing the content of the customer’s sites and files with AI models when the customer asks, which may include personal data that appears in them.

Daily check: opening each published site to tell the customer if it doesn’t load, without measuring that visit.

Types of personal data: technical connection data (IP address, which Pulse doesn’t store, browser, operating system, language); country and approximate city; browsing data on the site (pages, origin, sections, clicks, time, technical errors); the daily visitor code; name, email and message of whoever writes through a form; and any personal data the customer includes in their sites’ content, images and files. Berse doesn’t need special categories of data; if the customer includes them on their site, the customer is responsible for having a legal basis for it.

Categories of data subjects: visitors to the customer’s sites, people who write to them through their forms and people who appear in the content or images of their sites.

Not covered: payments on the customer’s site are processed by the customer’s own Stripe account, under the customer’s own contract with Stripe; Berse doesn’t see their buyers’ payment data and keeps that account’s keys only in hosting. Nor are the third-party services the customer adds to their site (fonts, maps, external images) covered; the visitor’s browser loads them directly.

Instructions: Berse processes customer personal data only to provide the service and according to the customer’s documented instructions, which are the Terms, this agreement and what the customer configures in Berse, unless the law requires otherwise (in that case we’ll tell you beforehand, if the law allows). If an instruction seems to us to infringe data protection law, we’ll tell you.

Confidentiality: only people who need it to provide the service, support you or keep things secure can access the data, under a duty of confidentiality, and that access is logged.

Cooperation: we help you, as far as it concerns us and taking into account the information available to us, to meet your obligations on security, breach notification, impact assessments and prior consultation with authorities.

US laws (CCPA/CPRA and similar): Berse acts as a “service provider” or “processor”. It doesn’t sell or share that data, doesn’t retain, use or disclose it outside the direct relationship with you or for purposes other than providing the service, doesn’t combine it with data from other sources except as the law allows, will tell you if it can no longer meet these obligations and lets you take reasonable steps to stop unauthorized use.

Brazil and other countries: in Brazil Berse acts as an operator under the LGPD, and in other countries as a processor or equivalent role.

We don’t use customer personal data to train AI models or for our own purposes, except aggregated figures about how the service works that don’t identify anyone.

Technical measures: encrypted connections (HTTPS); permissions checked in the database according to each person’s role in each project; Pulse without cookies, without storing the IP and with a daily key deleted the next day; nothing measured if the browser sends Global Privacy Control; text coming from visitors sanitized before use; keys for sites’ services kept only in hosting; machines for sites made by Cortex isolated, one per project, without Berse’s keys and without internet access except to the npm package registry and the allowed photo libraries; images attached in the chat kept in private storage with short-lived signed links; images stripped of location metadata; error reports without emails, keys or IP addresses; and automatic backups.

Organizational measures: internal access only for those who need it, and logged; usage and email sending limits to prevent abuse; review of providers before using them; and a procedure for responding to breaches.

Data location: the database and files are in Supabase (United States (east)); hosting, in Vercel (United States, with a global delivery network); the machines for sites made by Cortex, in E2B (United States); the other sub-processors, in the countries listed in section 6.

Images in the Media library are stored with a public link so they can be shown on sites: anyone with the link can see them. The customer decides which images to upload.

We may update these measures as long as they don’t lower the level of protection.

You authorize Berse to use these sub-processors for customer personal data:

Supabase (database, files and Media library): Pulse events, form messages, managed email counters, sites’ images, files and code; United States (east).

Vercel (hosting of Berse and the published sites, receiving Pulse events and forms, reading websites and design checks): technical data of each request (including the IP, in temporary logs) and the sites’ content; United States, with a global delivery network.

E2B (isolated machines for the live preview and for sites made by Cortex): the site’s files and code, the library images it uses and whatever the code does when it runs; United States.

Resend (Forms alerts and managed email): name, email and message of whoever writes through a form, and the email of the project’s people who receive it; United States.

OpenAI, Anthropic, xAI and Google (Cortex’s AI models): the content, code, images and screenshots of the sites and files the customer asks Cortex to work on, which may include personal data; they don’t receive Pulse data about individual visits (the weekly summary only uses aggregated figures) or form messages; United States (Google, also other countries where it has facilities). Under their business terms, they don’t use this data to train their models and keep it for a limited time (usually up to 30 days) to monitor abuse.

Sentry (technical error reports): technical data about the error, without emails, keys or IP addresses (removed before sending); incidentally it may include fragments of content; United States.

Stripe: not a sub-processor for this data. Payments on the customer’s sites are processed by the customer’s own Stripe account, under the customer’s own contract. Stripe only processes, as Berse’s provider, the payments for the customer’s Berse subscription (data Berse controls).

Unsplash and Pexels: they receive no personal data of the customer or their visitors from Berse; Berse only sends them search terms. The photos shown on a site are loaded directly by the visitor’s browser.

Google Maps, Google Fonts, Bunny Fonts and Picsum: not Berse sub-processors. If the customer’s site uses them, the visitor’s browser connects to them directly (with their IP address, and Google Maps may set its own cookies), and the customer must tell their visitors.

Obligations: each sub-processor is bound by contract to data protection obligations equivalent to those in this agreement. We are liable to you for our sub-processors as for ourselves.

Changes: we’ll email you and update this page before adding or replacing a sub-processor, at least 30 days in advance. You can object on reasonable data protection grounds within that period; if we can’t find a solution, you can cancel and we’ll refund the unused part of what you paid in advance.

The customer handles their visitors’ rights (access, erasure, objection…). They can do many things themselves in Berse: see Pulse figures (which are aggregated and identify no one), remove content or images from their site and from Media, unpublish the site or delete the project.

If a data subject writes to us about a site’s data, we won’t answer on the substance: we’ll pass the request on to the customer and help them answer it with the technical and organizational measures available to us.

If we become aware of a security breach affecting customer personal data, we’ll tell you without undue delay and in any case within 72 hours of becoming aware of it.

We’ll tell you, as far as we know it (and complete it later if needed): what happened, the types of data and approximate number of data subjects and records affected, the likely consequences, the measures we’ve taken or propose and a contact person.

We’ll notify the email of the account that owns the project. We’ll immediately take reasonable steps to contain the breach and reduce its effects.

Customer responsibility: as controller, it’s up to you to decide whether to notify the authority and the data subjects, and to do so within your law’s deadlines. We’ll help with the information we have. Notifying you isn’t an admission of fault or liability.

Berse operates from the United States and its sub-processors are mainly in the United States, so customer personal data is processed there.

Where the applicable law requires safeguards for those transfers, Berse uses the mechanisms it calls for, such as the contractual clauses included in each sub-processor’s data processing agreement.

Information: we’ll give you the information reasonably necessary to show we comply with this agreement, such as descriptions of our security measures and the certifications or reports of our sub-processors that we are able to share.

Audits: if that information isn’t enough, or an authority requires it, you can carry out a reasonable audit, yourself or through an independent auditor bound by confidentiality, with 30 days’ notice, at most once a year, during business hours, without access to other customers’ data and at your expense, unless it is due to a breach on our side.

Alternative: before an on-site audit, we’ll try to answer your questions in writing or with documentation, which is usually enough.

When you unpublish a site, it goes offline and stops collecting its visitors’ data. When you delete the project or your account, its pages, files, images and working machine are also deleted. Pulse data is kept for 400 days at most. Form messages are kept for 12 months at most (those that look like spam, 30 days) and the customer can delete them sooner. Managed email doesn’t keep messages. Images attached in the chat of sites made by Cortex are deleted after 30 days or with the project.

Return: before deleting, you can download your data from your account and copy your sites’ code from Code.

Backups: deleted data disappears from automatic backups when they roll over, within 7 days; meanwhile they’re only used to restore the service after a failure. Our sub-processors’ technical logs are deleted automatically within 30 days at most.

Legal retention: if the law requires us to keep any data longer, we’ll keep it restricted, only for that purpose and protected under this agreement.

Each party’s liability under this agreement is governed by the liability rules of the Terms, including their limitations and exclusions, to the extent data protection law allows. Nothing in this agreement limits the rights the law gives data subjects or any liability that can’t be limited.

As controller, the customer must: have a legal basis to process their visitors’ data; inform them with a privacy policy on their site (they can use the text in section 15); ask for their consent where their law requires it for audience measurement or for third-party services they add to their site; handle their requests; and not upload or include personal data they aren’t entitled to process.

About Pulse and consent: Pulse uses no cookies, doesn’t recognize the same person from one day to the next (the local “came before” record doesn’t identify them), only measures the site itself and measures nothing if the browser sends Global Privacy Control. If the law that applies to their site requires asking permission to measure visits, it’s up to the customer to assess that with their adviser and ask for it.

This agreement takes effect when you accept the Terms or start using Berse to publish or host sites, and lasts as long as Berse processes customer personal data.

Obligations that by their nature should continue (confidentiality, deletion, security of what remains in backups) survive until all the data is deleted.

We may update this agreement (for example, for the sub-processor list or changes in the law). If the change is meaningful, we’ll tell you in advance by email or in Berse; changes won’t reduce the protection of customer personal data. The current version is the one shown at the top.

If you publish a site with Berse, include in its privacy policy a text like this, adapted to your case (it doesn’t replace your own legal advice):

“Audience measurement. To understand how this site is used we measure visits with Pulse, a Berse tool that processes the data on our behalf. It doesn’t use cookies. It records the page you view, where you came from, the device type, the country and approximate city, your browser language, the day and hour, time and scroll, how far down the sections you get, load speed, the buttons and links you click and where they lead, the name of the forms you start or send (never what you type) and technical errors. It doesn’t store your IP address: a code to count unique visitors is computed from it, your browser and a key that changes every day, and it can’t recognize you from one day to the next. To know whether you come back, your browser keeps (berse:pulse) only the first and last day of visit, on how many days you came and where your first visit came from, with no identifier; it stops being used after 13 months. The data is kept for 400 days and processed in the United States with appropriate safeguards. We do this based on our legitimate interest in understanding and improving this site. If your browser sends the Global Privacy Control signal, nothing is measured.”

“Hosting. This site is hosted by Berse with its provider Vercel, in the United States. When you visit it, your IP address and technical data are logged for a limited time for security.”

If your site has forms: “Forms. If you write to us through a form, your message is kept in Berse, the service this site is built with, which lets us know by email through its provider Resend, in the United States. We keep it for 12 months at most and use it to reply to you.” If the site loads Google Fonts, a Google Maps map or Unsplash images, also mention that the browser connects to those services; if you sell with your Stripe account, mention Stripe. Always add who you are, how to contact you and your visitors’ rights.

For any question about this agreement, to ask for a signed copy or to tell us about a data subject’s request: legal@berse.ai.