Data processing agreement
This agreement (“DPA”) applies between the customer (controller) and FutureChamps GmbH, Schenkenstraße 4, 6th floor, 1010 Vienna, Austria (processor), whenever kennt.ai processes personal data on the customer’s behalf. It forms part of the terms of service and takes effect when the customer accepts them. A signed copy is available on request from hello@kennt.ai.
1. Subject matter, duration, nature and purpose
kennt.ai collects AI answers to the customer’s questions, analyses them, stores reports and, if connected, reads data from Google Analytics 4, Search Console and Slack, in order to provide the kennt.ai service. The DPA runs for the term of the main contract.
2. Types of data and data subjects
- Users of the customer: names, e-mail addresses, profile pictures, login and usage data, questions to the AI analyst.
- Persons named in AI answers or cited sources (e.g. employees or public figures): names and related statements.
- Visitors of the customer’s websites, only in aggregated form from GA4 (sessions, key events by source, country and week); no individual visitor profiles.
- Slack users in connected workspaces: names and messages in threads with the kennt.ai bot.
3. Instructions
We process personal data only on documented instructions of the customer; the contract and the customer’s settings in the app are such instructions. We inform the customer if we believe an instruction breaches data protection law.
4. Confidentiality
Everyone authorised to process the data is bound to confidentiality (§ 6 DSG).
5. Security (Art. 32 GDPR)
- Hosting of the database in the EU (Frankfurt); encryption in transit (TLS) and at rest.
- Strict tenant separation: every customer record carries a project id and is protected by row-level security in the database; automated tests check the isolation.
- Access only for the staff who need it, with individual accounts and two-factor authentication; no passwords stored for customer logins; secrets stored in a vault, never in code.
- Backups by the hosting provider (Supabase) (daily); logs without IP addresses or e-mail addresses where not needed.
- Incident process: security incidents are recorded, assessed, contained and, where personal data is affected, reported to the customer as set out in section 8.
- Regular review of these measures, at least once a year.
6. Sub-processors
The customer authorises the sub-processors listed below. We inform the customer at least 30 days before adding or replacing a sub-processor; the customer may object for good cause and, if no solution is found, terminate the affected service. We bind every sub-processor to the same data protection obligations.
| Service | Provider | Where | Purpose | Basis for transfers outside the EU |
|---|---|---|---|---|
| Supabase | Supabase Pte. Ltd., Singapore | EU (AWS eu-central-1, Frankfurt) | Database, login (authentication), background jobs and the kennt.ai Score function | Data stored in the EU; access from outside the EU (e.g. support): Standard Contractual Clauses (Supabase DPA) |
| Vercel | Vercel Inc., USA | Functions in the EU (fra1, Frankfurt); global edge network for delivery | Hosting of this website and the kennt.ai app, content delivery, server logs | EU-U.S. Data Privacy Framework (certified) and Standard Contractual Clauses |
| DataForSEO | DataForSEO OÜ, Estonia | EU (Estonia) | Asks AI engines (ChatGPT, Gemini, Google AI Mode, AI Overviews) the tracked questions and returns their answers. Receives questions, country and language, no visitor data | Not required (EU company); data processing agreement under Art. 28 GDPR |
| Anthropic | Anthropic Ireland, Limited, Ireland (contract partner); processing by Anthropic PBC, USA | USA | AI models (Claude) that analyse AI answers, set up the free check (brand, category, competitors, questions) and power the AI analyst. Not used to train models | Standard Contractual Clauses (Anthropic DPA) |
| Stripe | Stripe Payments Europe, Ltd., Ireland | EU / USA | Payments, invoices, subscriptions | EU-U.S. Data Privacy Framework and Standard Contractual Clauses for transfers to Stripe, Inc. |
| Resend | Plus Five Five, Inc. (Resend), USA | Sending from the EU (AWS eu-west-1, Ireland); account data, e-mail metadata and logs in the USA | Sending e-mails: login links and codes, reports, service messages | EU-U.S. Data Privacy Framework (certified) and Standard Contractual Clauses |
| Google Ireland Ltd., Ireland | EU / USA | “Sign in with Google” (only if you choose it); reading Google Analytics 4 and Search Console data (only if a customer connects them) | EU-U.S. Data Privacy Framework | |
| Cloudflare Turnstile | Cloudflare, Inc., USA | Global | Bot protection for the free kennt.ai Score (checks browser signals, sets no tracking cookies) | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Slack | Slack Technologies Ltd., Ireland | EU / USA | Weekly report and AI analyst in Slack (only if a customer connects a workspace) | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
7. Assistance
We support the customer with data subject requests, security, breach notifications and data protection impact assessments (Art. 32–36 GDPR), as far as this concerns our processing.
8. Personal data breaches
We notify the customer without undue delay, and no later than 48 hours after becoming aware of a personal data breach, with the information available at that time.
9. Deletion and return
After the end of the contract, we delete the customer’s personal data within 30 days, unless law requires us to keep it. Before that, the customer can export its data (CSV, API).
10. Audits
We provide the customer with the information needed to demonstrate compliance and allow audits by the customer or an auditor bound to confidentiality, with reasonable notice and at most once a year unless there is a specific reason.
11. Transfers to third countries
Transfers outside the EU/EEA take place only under Art. 44 ff. GDPR (adequacy decision, EU-U.S. Data Privacy Framework or Standard Contractual Clauses), as listed in section 6.
12. Final provisions
Liability follows the terms of service and Art. 82 GDPR. Austrian law applies; place of jurisdiction is Vienna. The German version prevails.