Data Processing Agreement

Version 2026-10-20 · Effective from the day it is published

This data processing agreement ("DPA") forms part of the Terms of Service between the customer (the controller) and Felwood Studios (Gustav Henning, enskild näringsverksamhet), Fleminggatan 63A, 112 32 Stockholm, Sweden, headlark.info@gmail.com, a sole proprietorship registered in Sweden, which runs Headlark (the processor). It applies when pages the customer connects contain personal data.

1. Subject matter, nature and purpose

The processor fetches pages of the customer's websites, extracts their text, headings, images and existing metadata, sends this to an AI model, and stores and publishes the resulting metadata, all in order to provide the service described in the Terms.

To avoid regenerating identical content, the processor keeps generated metadata keyed by a hash of the page text it was generated from, without any link to the customer, site or URL, and may serve it again when identical content is submitted by this or another customer. This cache is not deleted under section 9.

2. Duration

For as long as the customer uses the service, and until the data is deleted under section 9.

3. Types of personal data and data subjects

Whatever personal data appears on the customer's pages, typically: names, job titles, contact details (email, phone, address), photos and their file names, and other information people have published on the site. Data subjects are people mentioned or shown on the customer's websites, such as the customer's staff, customers and other contacts. Where the customer uses the script, visitors' IP addresses and request metadata reach the processor's CDN logs.

4. Instructions

The processor processes personal data only on the customer's documented instructions. The Terms, this DPA and the customer's use of the service (connecting sites, triggering builds and webhooks) are those instructions. The processor informs the customer if it believes an instruction breaks data protection law. The processor may process data otherwise only where EU or Swedish law requires it, and then informs the customer unless the law forbids that.

The customer is responsible for the lawfulness of the personal data on its pages and for having a legal basis to process and publish it; it gives instructions through the service and may at any time delete sites or the account.

5. Confidentiality

Anyone authorised to process the data is bound by confidentiality.

6. Security

The processor takes appropriate technical and organisational measures (GDPR art. 32), including:

• encryption in transit (TLS) for all connections, and encryption at rest by our hosting and database providers;
• secret keys stored only as hashes, and customer platform credentials (such as Webflow API tokens) encrypted with AES-256-GCM;
• access to production systems limited to the processor, with multi-factor authentication on provider accounts;
• processing limited to pages the customer connects; pages are fetched only at build, deploy or publish time, never when visitors view them;
• deletion of account data on request, with a documented inventory of what is stored and how it is deleted.

7. Sub-processors

The customer gives general authorisation for these sub-processors:

The processor imposes data protection obligations on each sub-processor equivalent to this DPA, and remains responsible to the customer for them. The processor gives at least 30 days' notice by email before adding or replacing a sub-processor. The customer can object on reasonable data protection grounds; if no solution is found, the customer can terminate the affected service.

8. Transfers outside the EU/EEA

Transfers rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses.

9. Deletion and return

When the customer deletes a site or the account, the processor deletes the related personal data, including page content stored for reuse and published metadata, within 30 days. The processor's encrypted backups are kept for 14 days and are then deleted; sub-processors delete their copies under their own retention cycles. The customer can export its data from the dashboard before deleting.

10. Assistance

Taking into account the nature of the processing, the processor helps the customer respond to data subject requests and meet its obligations on security, breach notification, impact assessments and prior consultation (GDPR art. 32–36).

11. Personal data breaches

The processor notifies the customer without undue delay, and aims to do so within 48 hours, after becoming aware of a breach affecting the customer's data. The notice describes what happened, the data and people likely affected, the likely consequences and the measures taken.

12. Information and audits

The processor makes available the information needed to show compliance with this DPA. The customer may carry out an audit, or have one carried out, at its own cost, with at least 30 days' notice, no more than once a year unless a breach or authority requires it, and in a way that does not compromise other customers' data.

13. Liability and precedence

Liability follows the Terms. If this DPA and the Terms conflict on data protection, this DPA prevails.