Data Processing Agreement

This Data Processing Agreement is part of our Terms of Service. It applies whenever we process personal data on your behalf: data of the visitors of the sites you publish with frascati.app (form messages and your replies to them, entries in Cloud tables, bookings of times and of places in classes and events with their waitlists, orders, contact requests from the AI chat for visitors, what they enter into the AI features of your sites, with the photos they add, page view statistics, and the accounts of visitors who sign in on your sites, with their email address and name, the sign-in codes we send them, their sign-ins, what your site keeps in their account and which entries and bookings are theirs); data of the people who use the phone apps you build with frascati.app (their accounts with email address and name, the sign-in codes we send them, what they save in the app, what they send through its forms, their questions to its AI, with the photos they add, and the push addresses of their phones when they turn on notifications); and personal data in your projects, such as names, photos and other details of people in your texts, images, uploads and chat messages. For this data, you are the controller, and Frascati GmbH, Binningerstrasse 95, 4123 Allschwil BL, Switzerland ("we", "us"), is your processor within the meaning of Art. 9 of the Swiss Federal Act on Data Protection (DSG) and Art. 28 of the GDPR. The agreement applies automatically when you use frascati.app; you do not need to sign anything. For the processing of personal data, this agreement takes precedence over the Terms of Service.

We process the data only to provide frascati.app and the features you use. We store your projects and, when you ask, build and change them with the AI providers named in section 7. We receive and store form messages, table entries, bookings and orders, show them to you in the editor and let you export and delete them. For your sites and phone apps that let people sign in, we keep the accounts and data of the people who sign in, send them sign-in codes by email and show each of them their own data, entries and bookings; when you make a table visible to signed-in members only, we show its entries to everyone who is signed in on that site. When your app has AI features, we have the AI answer the questions of your app's users to them, within the monthly budget you set in the Cloud tab; a photo a user adds to a question goes to the AI with it, and we delete it once the answer has come, at the latest after a day, unless it is also sent with an entry. When your app has notifications, we keep the push addresses of the phones that turned them on and pass the notifications you send on your behalf to Expo's push service, with your own Expo account, or, for the version of your app on the home screen, to the push service of the person's browser (see section 7). We notify you by email. When your site uses online booking, classes and events or payments, we send emails to your visitors in your name: confirmations, reminders and cancellations of bookings, that a guest is on a waitlist or got a place from it, and confirmations of orders. When you answer a form message in Messages, we send your reply in your website's name to the address the message came from, with your address to answer to, and keep it with the message. When you ask for a draft with AI, the message, your earlier replies and your site's content go to the AI providers named in section 7, and the draft is shown only to you until you send it. When you switch on the AI chat, we answer your visitors' questions and pass contact requests on to you. When your site has AI features of its own, we have the AI answer what your visitors enter there, also a photo they add, within the monthly budget you set in the Cloud tab, without keeping the conversation or the photo. If you add your own key with OpenRouter or OpenAI, we send the requests of the AI features of your sites and apps with your key to that provider instead, on your behalf (see section 7); they then use none of your credits. When you set webhook addresses, we send the new data you chose for each to it, try again when an address does not answer, and keep a log of each delivery, with the data sent, for 30 days, so you can see and resend it. When you create an API key, the services you give it to can add entries and bookings to your sites and, if the key allows it, read entries, through our API; we send no emails to the people of bookings added this way. When you subscribe to your bookings or your classes and events from a private calendar link, your calendar provider (such as Google, Apple or Microsoft) fetches them from that link, with the names of the people who booked and, for bookings of times, their contact details; you choose this, and you can reset the link at any time, which ends the old one. We count page views. We do not use the data for our own purposes, and we do not sell it.

The people concerned are the visitors of your sites, such as guests, buyers, members who sign in and people who contact you, the users of your phone apps, the people who take appointments in your team, and the people named or shown in your projects. The data can include contact details (name, email address, phone number), accounts on your sites and in your apps (email address, name, sign-in codes, sign-ins, what people save in their account, and which entries and bookings are theirs), the push addresses of phones that turned on an app's notifications (an Expo push token or a browser's push subscription) and the notifications you send them, the content of messages and of your replies to them, notes and table entries, booking details (service, class or event, date, time, number of people or places, a place on a waitlist, the answers to the questions you add to the booking form, the person a booking is with), the names, services, working hours and days away of the people who take appointments, as you enter them, order details (items, amount, currency, shipping address, reference of the Stripe payment), questions asked in the AI chat, in the AI features of your sites or in your apps' AI, with the photos people add to them, photos and other personal data in your texts, images and uploads, and the technical data needed to deliver the site and prevent abuse. Page view statistics contain the site, the domain of the website the visitor came from and the time, without IP addresses. Do not use forms, tables, booking notes or your own questions in booking forms to collect health data or other sensitive personal data, unless the law allows it and you have taken the measures it requires.

We process the data only on your documented instructions. Your instructions are these terms, the requests you make in the editor and the settings you choose in frascati.app, for example switching on the AI chat, setting up booking or payments, sending a reply in Messages, setting a webhook address, creating an API key or adding your own key for the AI. If we believe that an instruction breaks data protection law, we tell you. We process data without your instruction only where the law requires it, and we tell you beforehand unless the law forbids it.

Everyone at Frascati GmbH who can access the data is bound to confidentiality.

We protect the data with technical and organizational measures that fit the risk. Every transfer is encrypted (HTTPS/TLS). The database is operated by Neon in Frankfurt, Germany, which encrypts stored data with AES-256. Stripe keys and the access token of your Expo account that you connect are additionally encrypted by us with AES-256-GCM and are never shown in the browser or passed to the AI. Your own OpenRouter or OpenAI key for the AI features of your sites and apps is encrypted by us in the same way; it is never shown in the browser, never written into the code of your sites and apps and never passed to the AI, and we use it only for their AI requests. Photos people add to a question to the AI are made again without their hidden data, such as the place where they were taken, before they go to the AI. The push addresses of your app users' phones are encrypted by us in the same way. The secrets your webhooks are signed with are encrypted the same way; a webhook set up with the earlier version of Connections keeps its earlier unencrypted copy for two weeks after we take it over, so the previous version of the service can be restored, and then we delete it. Of API keys we keep only a hash, from which a key cannot be read back; each key can do only what you allow it and makes at most 60 requests a minute, and a site takes at most 200 bookings and 1,000 entries a day through the API. Orders are not available through the API: no key can read them, they reach other services only through the webhook for paid orders, if you set one. Passwords are stored only as hashes. Your data is accessible to your account and, where needed to operate and support the Service, to authorized staff of Frascati GmbH. Public forms and online booking have limits and spam checks. Our database provider makes automatic backups. We review these measures and improve them as technology develops.

You allow us to use these subprocessors: Vercel (USA) for hosting frascati.app, the published sites and the data of your phone apps, and for storing uploaded files (Vercel Blob); Neon (a US company, database in Frankfurt, Germany) for storing the data named in section 3; Resend (USA) for sending emails to you, to your visitors (your replies to their messages included) and to the users of your apps; OpenRouter (USA) for the AI requests, as far as you use them: building and changing your sites and apps, turning dictation into text, drafting replies to form messages, the AI chat for visitors, the AI features of your sites, the AI assistant in apps, and making presentations and videos. OpenRouter passes each request on to a company that runs the model: for Claude, Anthropic or a cloud provider that runs Claude, today Amazon Web Services, Google Cloud or Microsoft Azure; for GPT, OpenAI, Microsoft Azure or Amazon Web Services; for dictation, OpenAI, Groq or DeepInfra; for still images in videos, OpenAI; for checking them and for music, Google; for voices, Microsoft; all of them US companies; and for clips of scenes made by AI, MiniMax (Nanonoble Pte. Ltd., Singapore). Sentry (a US company, data stored in Frankfurt, Germany) receives error reports of our servers, with technical data and without IP addresses or cookies of your visitors; Sentry does not run on your sites. Each is bound by written data protection obligations that protect the data at least as well as this agreement. We inform you at least 30 days before we add or replace a subprocessor, by email or in the app. You can object for reasons of data protection; if we cannot resolve your objection, you can stop using the affected feature or end your account before the change applies. Payments on your sites are processed by Stripe under your own agreement with Stripe, so Stripe is not our subprocessor. Notifications of the App Store and Google Play versions of your apps go through the push service of Expo (650 Industries, Inc., USA) with your own Expo account, which you connect yourself and for which you agree with Expo directly, so Expo is not our subprocessor either. We pass the notifications you send, with the push addresses of the phones, to Expo on your behalf, and Expo passes them on to Apple's push service (APNs) or Google's (Firebase Cloud Messaging). When you add your own key with OpenRouter (OpenRouter, Inc., USA) or OpenAI (OpenAI, L.L.C., USA) for the AI features of your sites and apps, we send their requests, with the photos people add, to that provider with your key on your behalf. The provider works under your own agreement with it and bills you directly, so for these requests it is not our subprocessor either. With your own OpenRouter key, OpenRouter passes the requests on to Anthropic or a cloud provider that runs Claude, as above; OpenAI answers them with its own GPT models. Name the provider in the privacy policy of your site or app. Notifications of the version of your apps on the home screen go through the push service of the person's browser (Apple, Google, Mozilla or Microsoft), encrypted so that it cannot read them; the browser chooses that service, so it is not our subprocessor, and it should be named in your app's privacy policy. Photos from Pexels and fonts from Bunny Fonts load directly in your visitors' browsers; they are named in our Privacy Policy and should also be named in yours. Sites published before 25 September 2026 also load program libraries from unpkg, cdnjs and jsDelivr and can show pictures from Unsplash and pravatar.cc; the Google Fonts they use come from frascati.app.

Some subprocessors are in the USA, and through OpenRouter an AI request can also be handled in another country where the chosen provider runs the model. We transfer data only where adequate protection is ensured: under the Swiss-US or EU-US Data Privacy Framework for certified companies, or on the basis of the standard contractual clauses of the European Commission, with the adjustments that Swiss law requires. The one exception is MiniMax in Singapore, which neither Switzerland nor the EU recognizes as adequate: it receives data only when you have clips made by AI for a video, on your instruction, namely the description of the scene, the still image and, if you animate one of your photos, that photo. Do not have photos of people animated unless you may pass them on for this. When you use your own OpenRouter or OpenAI key, the transfer to that provider rests on your own agreement with it (see section 7).

You can view, export as CSV and delete form messages, table entries, bookings, the guest lists of your classes and events, and orders yourself in the editor. There you also see, sign out and delete the accounts of the people who sign in on your sites and in your apps. If a visitor or an app user asks you for access to their data, a correction or a deletion that you cannot carry out yourself, we help you. If one of them contacts us directly about data we process for you, we pass the request on to you. As far as we can, we also help you with security, the notification of data breaches and data protection impact assessments.

If we become aware of a breach of the security of the data we process for you, we inform you without undue delay, with the information we have: what happened, which data and roughly how many people are affected, the likely consequences, and what we are doing about it.

When you delete a message (with your replies to it), an entry, a table, a booking, the account of a person who signs in on your site or in your app, a site or your account, we delete the data from our live database; when you delete a site or your account, also the files kept for it in our file storage (a file another of your sites still uses stays with that site). When a person deletes their own account on your site or in your app, we delete it with what is kept in it; their entries and bookings stay with you, without the link to the account. Sign-in codes are deleted within a day, and a sign-in on a site ends after 30 days without a visit. The log of webhook deliveries is deleted after 30 days, and with its webhook address. Your own OpenRouter or OpenAI key is deleted when you remove it, and with its site or app and your account. A photo that a user of your app adds to a question to its AI is deleted once the answer has come, at the latest after a day, unless it is also sent with an entry; photos added on your sites are not kept. Copies in the backups of our database provider are overwritten automatically at the end of the backup period. When our contract ends, we delete the data, unless the law requires us to keep it. Before you delete your account, you can export your data.

We give you the information you need to show that we meet this agreement. If that is not enough, you may have us audited once a year, with 30 days' notice, during business hours and at your own cost, by an auditor who is bound to confidentiality.

This agreement applies as long as we process personal data for you. The liability rules of the Terms of Service apply. The agreement is governed by Swiss law, and the place of jurisdiction is the one set in the Terms of Service.

Questions about this agreement: Frascati GmbH, Binningerstrasse 95, 4123 Allschwil BL, Switzerland, email support@frascati.app.