Data Processing Agreement
For business clients: how we process personal data on your behalf, for example the answers of your study participants.
This Data Processing Agreement ("DPA") forms part of the Selfware Terms of Service between Jara Service Group LLC, c/o Republic Registered Agent LLC, 262 Chapman Rd, Suite 240, Newark, DE 19702, USA ("Processor", "we") and the business customer that accepts those Terms ("Customer", "you"). It applies whenever we process personal data on your behalf while providing Narratia, Sitekeeper or studio work.
1. Roles and terms
1.1 You are the controller (in Spanish-speaking countries: responsable) of the personal data described in Annex 1. We are your processor (encargado).
1.2 "Personal data", "processing", "data subject" and "security incident" have the meaning given by the data-protection law that applies to the processing, including, as applicable: Chile Law 19.628 and, from 1 December 2026, Law 21.719; Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (2025); Colombia Law 1581 of 2012 and Decree 1074 of 2015; Argentina Law 25.326; Brazil Law 13.709 (LGPD); and applicable U.S. state laws ("Data Protection Law").
2. Instructions
2.1 We process personal data only on your documented instructions: these Terms, this DPA, your settings in the product, and the requests you make through it (for example, a study you launch or a change you confirm). We do not process it for our own purposes, sell it, or use it to train AI models of our own. Our AI providers process it on the terms described in Annex 3.
2.2 If we believe an instruction breaks Data Protection Law, we tell you and may suspend that instruction.
2.3 If the law requires us to process personal data otherwise, we tell you first unless the law forbids it.
3. Your obligations
You confirm that you have a lawful basis for the processing, that you give data subjects the notices the law requires (for Narratia, the participant notice is shown before each interview; for Sitekeeper bookings, your site's own privacy notice), and that you do not send us sensitive data or data of people under 18 unless we have agreed it in writing.
4. Confidentiality
Everyone at our company and at our providers who can access the personal data is bound by confidentiality.
5. Security
We apply the technical and organizational measures in Annex 2 and keep them at a level appropriate to the risk.
6. Providers (subprocessors)
6.1 You authorize us to use the providers listed in Annex 3.
6.2 Each provider is bound by its written terms, which include data-protection obligations. Where those terms allow the provider to use content to improve its own models, Annex 3 says so. We remain responsible to you for our providers.
6.3 We give at least 15 days' notice (by e-mail and by updating Annex 3) before adding or replacing a provider. You may object on reasonable data-protection grounds within that period; if we cannot address the objection, you may terminate the affected product and we refund any prepaid amount for the period or credits you cannot use. Where the law that applies to you requires a specific written authorization for each provider, Annex 3 is that authorization for the providers listed, and we ask for your written authorization before adding a new one.
7. International transfers
7.1 Personal data is stored on servers in Helsinki, Finland, and may be processed by our providers in the United States and other countries listed in Annex 3.
7.2 Where Data Protection Law requires a specific safeguard for a transfer (for example, standard contractual clauses approved by the Argentine authority, or the transmission contract required by Colombian law), this DPA together with Annex 4 is that safeguard, and we will sign any additional form that the law requires.
8. Help with data subjects' requests
8.1 If a data subject contacts us directly, we pass the request to you without undue delay and do not answer it ourselves unless you ask us to.
8.2 We help you answer requests for access, correction, deletion, objection, portability or withdrawal of consent, using the tools in the product (for example, deleting an interview or a booking) or on your request to support@selfwarehq.com.
9. Security incidents
We notify you without undue delay, and in any case within 48 hours, after we become aware of a security incident affecting your personal data. We describe what happened, the data and people likely affected, the likely consequences and the measures taken, and we help you with any notification you must make to an authority or to data subjects.
10. Assistance
We give you the information reasonably needed to carry out a data-protection impact assessment or to consult an authority for the processing under this DPA.
11. Deletion and return
11.1 Personal data is kept for the periods in Annex 1 and then deleted.
11.2 When the product ends, or earlier on your instruction, we delete the personal data, unless the law requires us to keep it. Before deletion you can export or copy what the product allows. Backup copies are deleted within 30 days.
12. Audits
We make available the information needed to show compliance with this DPA. Once a year, or after a security incident, you may ask for a written audit questionnaire; an on-site audit, if the law requires it, is carried out with 30 days' notice, during business hours, at your cost and under confidentiality.
13. Liability and term
Liability under this DPA is subject to section 13 of the Terms, except where Data Protection Law does not allow a limitation. This DPA lasts for as long as we process personal data on your behalf.
Annex 1 — Description of processing
| Narratia | Sitekeeper | Studio work (Prima / Sitekeeper) | |
|---|---|---|---|
| Data subjects | People you invite to your studies (participants) | Guests who book through your site; people named or shown in your site's content | People named or shown in materials you give us |
| Personal data | Participant link and status; answers (text); if voice is used, voice recording and transcript; summary of answers and its corrections; acceptance of the participant notice (version, time, language). Invitation e-mail addresses are used only to send the invitation and are not kept in the study | Guest name, e-mail, note, language, time zone, appointment time, booking status; payment status if paid bookings are enabled; texts, photos and other content of your site | Texts, photos, logos and other materials |
| Sensitive data | Not intended; you must not ask for it (Terms, B5) | Not intended | Not intended |
| Purpose | Conduct the interviews and prepare the analysis for your study | Edit and maintain your site on your instructions; take and manage bookings | Make the deliverables you ordered |
| Duration / retention | For the duration of the study and up to 12 months after it ends, unless you or the participant ask for earlier deletion; withdrawn participants' answers are deleted | Bookings: deleted 24 months after the appointment date. Site credentials: until you disconnect the site. Photos passed through our media relay: 30 days | For the duration of the work and the period needed to support the handover |
Annex 2 — Security measures
- Servers in a Hetzner data centre in Helsinki, Finland; access to servers by SSH keys only, password login disabled.
- Encryption in transit (HTTPS/TLS) for all product traffic.
- Site access credentials and calendar tokens stored encrypted (symmetric encryption, key kept outside the database).
- Access to customer data limited to people and systems that need it to provide the service.
- Every change to a customer's site through Sitekeeper is logged with "before" and "after" and can be undone.
- Participant links are personal, expire after 30 days and can be revoked.
- Logs are kept without message bodies where possible.
- Database copies made before software updates are deleted within 30 days.
Annex 3 — Providers (subprocessors)
| Provider | Country (company) | Where data is processed | What it does | Products |
|---|---|---|---|---|
| Hetzner Online GmbH | Germany | Helsinki, Finland | Servers, databases, backups | Narratia, Sitekeeper, Prima |
| OpenAI OpCo, LLC | USA | USA and other countries | AI models that conduct interviews, analyse answers, prepare edits and studio work, used through a ChatGPT subscription; under its terms OpenAI may use content to improve its models unless this is turned off in the account settings | Narratia, Sitekeeper, Prima |
| Eleven Labs Inc. | USA | USA | Speech recognition and synthetic voice (voice interviews; voice messages and voice sessions; narration of review videos); its terms allow it to use content for training unless the account opts out | Narratia, Sitekeeper, Prima |
| Plus Five Five, Inc. (Resend) | USA | USA | Delivery of e-mails (sign-in links, invitations, order and booking messages) | Narratia, Sitekeeper, Prima |
| Stripe, LLC | USA | USA and other countries | Payment processing | Narratia, Sitekeeper, Prima |
| Cloudflare, Inc. | USA | Global network | DNS and e-mail routing for selfwarehq.com; file storage for media of some connected sites | All |
| GitHub, Inc. | USA | USA | Storage of the code and content of sites kept in Git repositories | Sitekeeper, Prima |
Telegram is not our provider: if you or your guests use our Telegram bot, Telegram Messenger Inc. processes those messages as an independent service under its own privacy policy.
Annex 4 — Transfer clauses
For transfers of personal data subject to Argentine law, the parties incorporate the model contractual clauses for international transfers between a controller and a processor approved by the Argentine data-protection authority (AAIP, Resolution 198/2023), with this DPA's Annexes 1–3 as their annexes. For transfers subject to Colombian law, this DPA is the transmission contract under Decree 1074 of 2015 (article 2.2.2.25.5.2). For transfers subject to Chilean law, the parties will sign, on request, the model contractual clauses approved under Law 21.719 (Exempt Resolution 202503748 of the Ministry of Economy) or adopted later by the Agencia de Protección de Datos Personales. For transfers subject to Mexican or Brazilian law, this DPA sets out the guarantees the processor provides.