Data processing agreement

Template — not legal advice. This text is a starting point written for LoopLab’s actual data flows. It must be reviewed and completed by counsel (company name, address, governing law, liability caps) before it is relied on.

1. Scope and roles

The customer is the controller of visitor and lead data collected through LoopLab; LoopLab is the processor and processes it only on documented instructions — to provide tracking, analytics, replays, hosted pages, AI features, integrations and webhooks the customer configures.

2. Categories

• Data subjects: visitors of the customer’s pages; people who submit the customer’s forms.
• Data: click IDs, campaign parameters, page interaction events, session replays (inputs masked), form submissions, conversion events, country and device class.
• Not processed: IP addresses (not stored), device identifiers, cross-site profiles.

3. Processor obligations

• Confidentiality of personnel; security measures appropriate to the risk (encryption in transit, encrypted integration secrets at rest, access control by role, audit log).
• Sub-processors listed in the privacy notice, with [30] days’ notice of changes.
• Assistance with data-subject requests, breach notification without undue delay, deletion or return at the end of the service.

4. AI processing

When AI features are used, page content and aggregated behaviour statistics (not raw replays or lead contact details) are sent to Anthropic to produce diagnoses and page versions.

5. Signature

[Signature blocks, or acceptance by clicking in-app.]