You already have a DPA. Section 14.1 of our Terms and Conditions is our data processing agreement under Article 28(3) of the GDPR. It applies to every customer on every plan, including Free, from the moment you accept the Terms, with no separate signature. This page summarizes it; where they differ, Section 14.1 prevails.
1. Scope
- Subject matter and purpose: providing the Service: website performance monitoring, analytics, search and crawler monitoring, and alerting
- Duration: the period in which you use the Service, plus the time needed to delete the data afterwards
- Personal data: the data listed in Section 4 of the Privacy Policy: measurements and usage data from our tracking scripts with pseudonymous identifiers, crawler records from your server logs, copies of your public pages, screenshots of the pages you test, and data from services you connect
- Data subjects: visitors to the websites you monitor, operators of crawlers that request them, and people whose personal data is published on the pages we check
For your account, billing and support data, and for our free tools, we are the controller, and the Privacy Policy applies instead.
2. Your instructions
We process the data only on your documented instructions: the Terms, and the choices you make in the Service, such as which domains you monitor, the storage level and sampling of the scripts, what is stored, and the integrations you connect. We do not use it for our own purposes, and we tell you if we believe an instruction infringes data protection law.
By choosing the Service and your plan, you instruct us to apply the identifier design and the retention periods described in the Privacy Policy. You can shorten retention at any time by deleting data, a domain or your account. You also instruct us to transfer data to the sub-processors and locations listed at vitalsentinel.com/subprocessors.
3. Confidentiality and security
People authorized to process the data are bound by confidentiality. We apply the measures Article 32 of the GDPR requires, including encryption in transit and at rest, access controls, two-factor authentication, logging and encrypted backups. We hold the encryption keys; the Service is not end-to-end encrypted. Further detail for a security assessment is available under a non-disclosure agreement.
4. Sub-processors
You authorize the providers listed at vitalsentinel.com/subprocessors. We give at least 7 days' notice of a new or replaced sub-processor; you may object on reasonable data protection grounds and, if we cannot resolve it, terminate the affected part of the Service for a pro rata refund. Sub-processors are bound by equivalent obligations, and we remain liable for them.
Theo, our AI assistant. When someone in your workspace asks Theo a question, our AI provider, Anthropic, receives the monitoring data Theo reads from your workspace to answer it, such as summaries of a domain, a module or a page and its open alerts, with email addresses, keys and IP addresses masked.
Site-search themes. Our AI provider receives the text of your visitors' most frequent site-search terms, without identifiers, to group them into themes. Your own privacy notice should say so. To prevent it, tick "Do not store page titles or site-search terms" for the domain.
5. Destinations you choose
When you send data out of the Service, through our API or MCP server, to an AI assistant or application, to a webhook, or as a report you email or share through its link, you choose the recipient and instruct the transfer. Those recipients are not our sub-processors, and the lawfulness of the transfer is yours to establish. Alerts you send to a Slack channel are delivered through Slack, which is listed as our sub-processor. The API and MCP server return no visitor or session identifiers, but some results, such as individual error events and crawler requests with a truncated network address, are still pseudonymous personal data. We keep a record of each API and MCP request, without its content, for 90 days.
6. Data subject requests
We help you answer requests from your visitors so far as the nature of the processing allows. Email legal@vitalsentinel.com with the visitor or session identifier and the domain, and we can find or delete the records that carry it. We cannot derive an identifier from a name, an email address or an IP address, and aggregated reports hold no individual records. A search that finds nothing is not proof that no data exists.
7. Deletion
- At the end of the Service we delete the data, or return it if you ask in time (Section 29 of the Terms), unless the law requires us to keep it
- Deleting a domain, workspace or account removes it at once; its monitoring data is kept for 30 days and then deleted. Backups can hold it for about two more weeks
- You can delete the stored history of a watched page at any time
- Disconnecting a log source stops collection and deletes its credentials, but not log data already stored
- An unverified domain is paused and later removed with its data, as Section 6.1 of the Terms describes
Deletion does not reach recipients you sent data to yourself (Section 5).
8. Breaches, assessments and audits
We notify you without undue delay after becoming aware of a personal data breach affecting your data, and assist you with Articles 32 to 36 of the GDPR. We make available the information needed to demonstrate compliance with Article 28 and contribute to audits, once in any twelve months unless a supervisory authority requires more or after a breach, at your cost, with reasonable notice, and without compromising other customers' data. We may first answer an audit request with written responses and documentation; an inspection follows if these are not sufficient.
9. Your responsibilities
- Consent: the default script mode stores nothing on visitors' devices. Whether your use of the scripts needs your visitors' consent depends on the law that applies to your website, and that decision is yours. The "session" and "persistent" storage levels of both scripts store identifiers on the device and need your visitors' consent before they are used
- Transparency: your privacy notice must tell visitors about VitalSentinel, and about any server logs you send us
- What your site sends: page addresses, titles and events reach us as your site sends them. We replace recognizable patterns, but a name or case reference in a title or address is stored. Do not let your pages or events carry special categories of data under Article 9 of the GDPR; you can stop page titles and site-search terms being stored for a domain
- Server logs and pages: you need the right to send us your logs, and you decide what your public pages publish. Do not ask us to watch pages that publish special categories of data
- Authorization: monitor only websites you own or are authorized to monitor
10. International transfers
Where data leaves the EEA we rely on an adequacy decision, including the EU-U.S. Data Privacy Framework, or the European Commission's Standard Contractual Clauses, as listed per provider on the sub-processors page. Where Standard Contractual Clauses apply, they prevail over any conflicting term.
11. A countersigned copy
A countersigned standalone agreement is available on custom plans. Email legal@vitalsentinel.com.