Skip to the content
foundbyname
Log inCheck yours

Data processing agreement

What we may do with the data you put in our hands, and nothing else.

Last updated September 20, 2026. Questions: nick@foundbyname.com. It applies on its own from your first payment. No signature, no form to chase.

1. Who is who

This agreement is between you, the client named on the account, and Philippe Nicolas, entrepreneur individuel (French sole trader), 1 rue de Madrid, 67310 Wasselonne, France, SIREN 938 048 071. It is part of our terms of service and applies whenever we handle personal data on your behalf. If this page and the terms disagree, this page wins on data protection and the terms win on everything else.

For the data about your own business, your staff and your customers, you give the orders: you are the controller and we are your processor. Your account, your billing and the answers we record from AI assistants are ours to decide about. There we are the controller, and our privacy policy covers that part. An agency is the controller for its own client list, and we process it on the agency’s instructions.

2. What we process for you

  • Subject and purpose. Running the plan you bought: building and publishing your page, updating your listing when you give us access, checking directories, and recording each week what the assistants answer.
  • How long. For as long as your plan is active, then what section 8 says.
  • Whose data. You and the people you name as contacts; the staff whose names you ask us to publish; whoever wrote a public review we read.
  • What data. Names, business contact details, job titles, hours, services, photos and text you send us, the Google Business Profile access you grant, and public reviews. Nothing else. Do not send us health records, payment card numbers, government identifiers or any other special category data, and we will not ask for them.

3. What we may and may not do

  • We act only on your documented instructions. Your plan, your questionnaire answers and what you write to us are those instructions.
  • We do not sell that data. We do not train a model of our own on it, and we do not reuse it for another client.
  • Only people bound to keep it confidential can reach it. Today that is one person, the founder.
  • If a law obliges us to process it some other way, we tell you first unless that same law forbids it.
  • If we think an instruction of yours breaks data protection law, we say so instead of carrying it out.

4. How it is protected

What is actually in place today:

  • Everything travels over HTTPS, with HSTS on every page and no mixed content.
  • The database sits at Supabase and is encrypted at rest. Account pages are never cached and never framed.
  • Passwords are kept only as a salted hash. Sessions run on random tokens, they expire, and you can kill all of them from your account.
  • Every paid or internal route is behind a token. The admin routes are unreachable from the open internet.
  • Accounts are locked to the email used at checkout, and we cap sign-in attempts per email and per IP address.
  • Every action, ours or an agent’s, goes into a log we keep, so a change can be traced back later.

None of this means nothing will ever go wrong. It is what is in place, and we update the list when it changes.

5. The companies that help us

You agree that we use the companies listed on the subprocessors page. Each is bound by a written agreement no weaker than this one, and we answer for their work as for our own. We update that page and email your account at least 14 days before a new one starts. If the change does not suit you, tell us. If we cannot sort it out, you can cancel for that reason.

6. Sending data outside Europe

Most of those companies are in the United States. For each one we rely either on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, or on the Commission’s standard contractual clauses. Ask us and we will tell you which applies to which company.

7. When someone asks about their data, or something goes wrong

  • If one of your customers or staff writes to us directly, we do not answer for you. We pass the request on and help you answer it.
  • If data we hold for you is breached, we tell you without undue delay, and in any case within 48 hours of finding out. We tell you what happened, whose data was involved and what we have done about it. Reporting it to an authority is your job, not ours. We give you what you need to do it.
  • We help you with impact assessments and prior consultations, as far as our part of the work is involved.

8. When it ends

When your plan ends, your published page comes down. Within 30 days we delete the personal data we hold for you, or return it first if you ask inside that window. We keep what the law makes us keep, such as invoices, and nothing more. Backups age out on their own cycle, and we never restore one for another purpose.

9. Checking that we do this

Write to nick@foundbyname.com with questions about how we handle your data. You get a written answer within 30 days. If that is not enough, you can audit us once a year at your own cost, with 30 days’ notice, in a way that does not expose another client’s data.

10. If you need a signed copy

This agreement binds us from your first payment, with no signature, the same way our providers’ own agreements bind them. If your lawyer wants a countersigned PDF, or your own template instead of this page, write to nick@foundbyname.com and we will sort it out.