Skip to content

Data processing agreement

Last updated 21 September 2026

The short version. Your site holds personal data about other people. When your agent handles it, we act only on your instructions, keep it secure, tell you about a breach, use only the providers listed on our sub-processors page, and delete it when you delete your site. You accept this agreement by accepting the terms; there is nothing to sign.

Who this is between

This agreement is between you and Refact, which provides SiteSelf (“we”). It forms part of the terms. It applies whenever we process personal data on your behalf in providing SiteSelf. For that data you are the controller and we are your processor. If you are yourself a processor for someone else, such as an agency running a client's site, see “If you work for someone else” below.

What we process

  • Why: to carry out the work you ask your agent to do on your WordPress site, and to keep the records and your agent's backups that let you see and undo it.
  • What kind of data: whatever personal data your site holds and your agent reads or changes in doing that work. Typically names, email and postal addresses, phone numbers, order details, comments, form entries and the addresses of visitors in your site's logs.
  • About whom: your site's visitors, customers, commenters, subscribers, and your own staff.
  • For how long: for as long as you use SiteSelf, then as described in “When you leave”.

Only on your instructions

We process this data only on your documented instructions. Those are the terms, this agreement, and what you ask your agent to do. They include reviewing conversations with your agent to check the quality of its work and using a conversation to test and improve the agent, as the terms say. We use the data for nothing else, and we do not use it to train models. If we think an instruction breaks data protection law, we tell you straight away. If the law requires us to process it in some other way, we tell you first unless the law forbids it.

People and security

Everyone we let process this data is bound to keep it confidential. We keep it secure with the measures in the annex below, which we review as the service changes.

Sub-processors

You authorise us to use the providers listed on the sub-processors page. We give at least 30 days' notice before adding one, as a dated entry on that page. You can object on reasonable data-protection grounds within that time. If we cannot resolve the objection, you can end the service, and we refund anything you paid in advance for the time left.

Each sub-processor is bound by data protection terms that give your data at least the protection this agreement does. We remain fully liable to you for how each of them performs those obligations.

Helping you meet your obligations

  • If someone asks us to exercise their rights over data on your site, we pass the request to you and do not answer it ourselves. We help you answer it, as far as the service allows.
  • We help you meet your obligations on security, breach notification, data protection impact assessments and consulting a supervisory authority, taking into account what we process and the information available to us.
  • If we become aware of a breach affecting this data, we tell you without undue delay, with what we know, and keep you updated as we learn more, so you can meet your own deadlines.

When you leave

Your site's data stays on your site: we never hold the only copy. When you delete a site from your dashboard, we delete what we hold for it, including your agent's backups on our servers; those on your own server stay there until you remove them. When you ask us to delete your account, we delete what we hold for it. Two exceptions: copies already sent to our model provider are deleted when its retention period ends, as the privacy notice describes, and we keep records the law requires us to keep.

Showing that we comply

We give you the information you reasonably need to show that we meet this agreement, and we answer written questions about it. Once a year, with reasonable notice and at your cost, you or an auditor you appoint may audit our compliance. We are not certified to SOC 2 or ISO 27001 today.

Transfers outside the UK and EEA

We and our sub-processors process data in the United States. Where the law requires it for a transfer from you to us, the European Commission's standard contractual clauses (module two, controller to processor, or module three, processor to processor, as fits your role) and the UK addendum to them form part of this agreement. Our sub-processors' transfer mechanisms are listed on the sub-processors page.

If you work for someone else

If you use SiteSelf on a site you run for a client, you may be their processor and we your sub-processor. In that case you confirm that your instructions to us reflect your client's, and this agreement's authorisation of our sub-processors and our notice of changes pass through to them. You can forward our notice for your clients to meet your own duty to tell them.

Liability

Each party's liability under this agreement is subject to the limits in the terms, except where the law does not allow it to be limited.

Annex: how we keep it secure

These are the measures in place today, stated only as far as they are true.

  • Separation. Each site's agent runs in its own isolated workspace, with nothing belonging to another customer in it.
  • Your WordPress password stays with us. Our servers hold the application password your WordPress issues for SiteSelf. Your agent never receives it; its requests to your site go through our servers and are recorded.
  • Secrets never reach the log. Passwords and keys are removed where the work runs, before anything is written down.
  • A record of everything that changed. Every change your agent makes is recorded in your activity log and kept for 365 days.
  • Your agent's backups. Made and kept on your own server, in a private folder your website does not serve, not in a separate location; the newest 5 are kept. Those taken before 24 September 2026 are on the servers that run the service: up to 10 per site, any but the newest deleted after 14 days.
  • Encryption in transit. The website, your dashboard and our servers are reached only over HTTPS.
  • Limits on where your agent can connect. On sites where it is switched on, your agent's workspace can reach only an approved list of addresses, and every attempt is recorded. It is being switched on site by site and is not yet on every site.
  • Model provider retention. Our model provider deletes what we send it within 30 days, except content its safety systems flag, as the privacy notice describes.
  • Access. Access to the servers is limited to the SiteSelf team.

Contact

Questions about this agreement go to dev@refact.co.