Legal

Data Processing Agreement

Last updated: 28 October 2026

This Data Processing Agreement ("DPA") is part of the Terms of Service between you (the "Customer") and us, as defined there. It applies when we process personal data on your behalf while providing the Service, and sets out the terms required by Article 28 of the General Data Protection Regulation (GDPR) and other data protection laws that apply. It takes effect when you accept the Terms of Service, without needing a signature. If you need a signed copy, write to support@bitlane.co.

1. Roles

  • For the personal data in your content (section 2), you are the controller, or a processor acting for your own client, and we are your processor (or sub-processor).
  • For the data of your account and team members, we are the controller, as described in the Privacy Policy. This DPA doesn't cover it.

2. The processing

  • Subject matter and purpose: providing the Service: hosting and running your search engines, answering searches, the search widget, the integrations with store platforms, and the reports on searches, clicks and orders.
  • Duration: as long as you use the Service, and until the data is deleted as described in section 9.
  • Nature: storage, indexing, search, analysis, transmission and deletion.
  • Data subjects: the visitors and customers of your websites and stores, and any person whose data is in the documents you index.
  • Categories of data: what you choose to index (usually products and content, not personal data); searches with their filters and results; with the widget's analytics on, a random session id, visits, the page path, the kind of device, clicks, additions to the cart, orders and refunds (order number, products, amounts, the session id); the IP address, browser and address of each request in our servers' logs. The analytics hold no IP addresses, names or contact details of visitors, and the integrations never send us the buyer's name, email or address. You should not send special categories of data (Article 9 GDPR) to the Service.

3. Your instructions

We process your personal data only on your documented instructions: these Terms, this DPA, and what you set up in the dashboard, the API and the widget. If we think an instruction breaks data protection law, we tell you. If a law requires us to process the data otherwise, we tell you first, unless that law forbids it.

You are responsible for the lawfulness of the data you send us, for the notices you give your visitors and for the consents you need, including for the widget's analytics, which you can keep off until your visitor agrees. The events the widget passes to your own tags on the page (such as Google Tag Manager or the Meta Pixel) go to those tools directly and are not part of our processing.

4. Confidentiality

Only people who need it to provide the Service have access to your data, and they are bound by confidentiality.

5. Security

We protect your data with appropriate technical and organisational measures, which we review as the Service evolves. Their summary is in the Annex. We may change them as long as the overall level of protection doesn't decrease.

6. Sub-processors

You give us general authorisation to use sub-processors. The current list is on the Sub-processors page. We bind each of them by contract to obligations at least as protective as this DPA, and remain responsible to you for their work.

We announce a new sub-processor at least 30 days in advance. You can object in writing within that time on reasonable data protection grounds; we'll then try to find a solution with you. If we can't, you can end the affected part of the Service before the change, and we refund the prepaid fees for the time after the end.

7. International transfers

Your content is stored and processed in the European Union. When a sub-processor processes personal data outside it, we make sure the transfer is protected by an adequacy decision or by the European Commission's standard contractual clauses, with additional measures where needed.

8. Assistance

  • Requests from data subjects: the dashboard and the API let you find, correct, export and delete the data in your engines. When we receive a request about your data, we pass it on to you and don't answer it ourselves.
  • Breaches: we notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting your data, with what we know about it and what we are doing; we update you as we learn more.
  • Assessments: we give you the information you reasonably need for data protection impact assessments and consultations with authorities.

9. Deletion

Your data is deleted when you delete it, your engines or your projects, and when your projects are deleted after a plan ends, as described in the Terms of Sale. Before that, you can export your documents through your engines' API.

Independently of that, data is kept for at most:

  • raw searches, clicks and visits: 90 days;
  • the products seen in each session: 1 year;
  • orders and refunds: 2 years;
  • reports aggregated by day (no session ids): 2 years;
  • request logs: 30 days;
  • temporary copies made while moving or upgrading an engine, and uploaded files waiting to be imported: 7 days;
  • database backups: 7 days.

10. Audits

We make available the information needed to demonstrate compliance with this DPA, including answers to reasonable security questionnaires. If that isn't enough, or an authority requires it, you can audit our compliance, once a year with 30 days' notice, at your expense, during business hours and under confidentiality; the audit relies on our providers' certifications (such as ISO 27001 and SOC 2) for their systems.

11. Liability and precedence

Liability under this DPA follows the Terms of Service. If this DPA and the Terms disagree on personal data, this DPA prevails; the standard contractual clauses, where they apply, prevail over both.

Annex: security measures

  • Encryption: traffic over the internet encrypted with TLS 1.2 or later; connections to the database encrypted; all data encrypted at rest by our hosting provider; secrets kept in a secrets manager.
  • Isolation: each engine runs in a container of its own with its own keys; the servers have no public address and are reachable only through our load balancer and private network; separate environments for testing and production.
  • Access: access to production limited to the staff who need it, with personal accounts; every service runs with its own least-privilege identity; server access only through an identity-aware proxy; dashboard accounts protected by hashed passwords, optional two-factor authentication, bot protection and limits on failed attempts.
  • Keys: engine master keys encrypted; search-only keys for the widget.
  • Monitoring: audit log of important actions in each project, and logs of access to the systems.
  • Availability: a managed database with daily backups and point-in-time recovery; upgrades made without interrupting search; engines moved between servers with their data checked after the move.
  • People: confidentiality obligations for everyone with access, and secure development practices.