Data processing agreement

Updated November 12, 2026. Revised contractual provisions apply to new contracts from this date. Existing contracts change only following the required notice and any consent required by law.

Who operates PageCaptain

Anemo Adrian Czarnoleski, ul. Zielonogórska 7/42, 41-218 Sosnowiec, Poland. NIP: PL6443545500. Contact us at contact@pagecaptain.dev.

Parties, scope and instructions

This agreement forms part of the PageCaptain terms. You are the controller of personal data you place in your website, uploads and visitor enquiries; Anemo, identified above, is your processor for that data. We act as an independent controller for our own account administration, billing and security as described in the privacy policy. Processing lasts for your use of the service and the deletion and backup periods described below.

We store, organise, retrieve, transmit, back up, display and delete customer data to host websites, deliver enquiry forms, provide requested AI changes and support recovery. Data subjects include your staff, customers and website visitors. Data may include names, business contact information, enquiry text, website text and images you supply. The service is not intended for special-category data, criminal records or payment-card information. Enquiry records are not automatically sent to AI providers; material you include in an AI instruction may be.

Your settings, submitted requests and these terms are documented instructions. We process data only on those instructions, including for transfers, unless legally required otherwise; we inform you of such a requirement before processing unless prohibited. We tell you if an instruction appears to infringe data-protection law.

Confidentiality and security

Access is restricted to authorised people and providers who need it and are bound by confidentiality. Measures include encrypted network connections, account authentication, separation of customer records through database access policies, restricted administrative access, activity records and encrypted recovery archives. You must protect your own login and review what you publish. Website image URLs are public; this service is not a confidential document vault.

Subprocessors and transfers

You give general authorisation to use Vercel for hosting, Supabase for database, authentication and file storage, Anthropic for requested AI processing, GitHub for encrypted backup archives and Resend for transactional delivery. Aftermarket hosts support correspondence. Stripe processes payments under its applicable role and terms. These providers may use infrastructure outside the EEA. We use applicable transfer mechanisms, including European Commission standard contractual clauses where required, and can provide relevant information on request.

We impose equivalent data-protection obligations on subprocessors and remain responsible for their performance of those obligations. We notify you of intended additions or replacements at least 30 days in advance. You may object on reasonable data-protection grounds during that period. If we cannot resolve an objection or offer an appropriate alternative, you may terminate the affected service and receive a proportionate refund of unused prepaid service.

Assistance and incidents

Taking account of the processing and information available, we assist with data-subject requests, security obligations, breach notifications, impact assessments and consultation with supervisory authorities. We notify you without undue delay after becoming aware of a personal-data breach affecting your data, giving available information about its nature, likely consequences and mitigation, with updates as information becomes available. Contact contact@pagecaptain.dev for requests or incident reports.

Return, deletion and accountability

On closure, you may choose return or deletion of customer data. Contact support to obtain an export before deletion. We aim to delete active copies within 30 days after verifying the request, except where law requires retention. Our recovery archives expire after 15 days, are restricted to recovery, and deletion instructions are reapplied after restoration. We make compliance information available and allow reasonable audits and inspections by you or a mandated auditor, with safeguards for security and other customers' information. These arrangements do not limit a supervisory authority's powers.

Permanent service closure

On planned permanent closure, the notice and retrieval arrangements in the Terms apply. You may instruct us to return your customer data in a commonly used, machine-readable format or delete it, without an export fee. After the retrieval window or completion of a timely pending return request, we aim to delete active copies within 30 days, unless law requires storage; backup copies expire under the schedules above. Legally retained copies remain protected and are not used for other purposes. Binding legal and insolvency requirements prevail, without removing rights that cannot lawfully be excluded.