Legal
Data Processing Agreement
Your site can collect personal data from its visitors. For that data you are the controller and SayLive is your processor. These are the terms of that processing. They form part of our Terms of Service and need no separate signature.
Who is who
You, the account holder, are the controller. SayLive is a product of KERN-IT SRL, Rue Belliard 2A, 1040 Brussels, Belgium (VAT BE0845906217). KERN-IT, as the provider of SayLive, is the processor.
This agreement covers only the data your site collects from its visitors. The data of your own account is a separate matter, where we are the controller: see our Privacy Policy.
What we process for you
| What | Data | Who it is about |
|---|---|---|
| Contact form | Whatever your form asks for, plus a truncated IP address kept to stop floods | People who write to you |
| Review tickets | The message, the page it was left on, and a screenshot of what the reviewer had on screen | People you invited to review the site |
| Visit counts | Aggregated page hits, with no cookie and no visitor identifier | Visitors, not identified |
| Published files | Anything personal you chose to put on your own pages | Whoever you put there |
The subject-matter of the processing is hosting your site and running the features above. It lasts as long as your account, and the nature and purpose are the ones described in our documentation, not others.
What we undertake
- We process this data only on your documented instructions, which for the most part are the actions you and your assistant take in the product
- Everyone at KERN-IT with access to it is bound by confidentiality
- We apply appropriate technical and organisational measures, listed below
- We engage no new sub-processor without giving you the chance to object, and the current list is on this page
- We help you answer requests from data subjects, and we help you with security, breach notification and impact assessments, to the extent our position allows
- On termination we delete the data, or return it, at your choice
- We make available what you need to demonstrate our compliance, and we accept audits
Our measures
- Everything travels over TLS, and published sites are served from an edge network with certificates we manage
- Review screenshots are stored apart from your public media, under keys that never leave our database, and are served only to your account. They are never reachable from the web
- Truncated IP addresses only: we keep enough to spot a flood, never enough to identify a person
- Staff access to a customer account requires a stated reason, has an expiry, and is recorded. A support session inside your account shows you a banner while it lasts
- Backups leave our servers encrypted
Sub-processors
| Sub-processor | Role | Location |
|---|---|---|
| Cloudflare | Serving your site, storing its files and media | Global edge network |
| Scaleway | The servers running SayLive itself and its database | France |
| Stripe | Payments (your data, not your visitors') | EU / US |
Where a sub-processor operates outside the European Economic Area, transfers rely on standard contractual clauses.
Retention
Form messages and review tickets stay in your inbox as long as your site does: nothing is cleared because a quota ran out, and running out of message capital stops collection without touching what you already received.
The one exception runs on its own: review screenshots and their tickets are deleted after 12 months. A screenshot records what a third party had on their screen, and holding that indefinitely is not defensible.
Breaches
If we become aware of a personal data breach affecting data we process for you, we tell you without undue delay, with what we know and what we are doing. Notifying your supervisory authority is your call to make, as the controller, and we give you what you need to make it.
Contact
Anything about this agreement: [email protected].