Data processing agreement.

In short: when you use CSP Logger, some of the data we hold is personal data belonging to your website's visitors rather than to you. For that data you are the controller and we are your processor. This agreement is the Article 28 contract that says what we may do with it, how we protect it, who else touches it, and what happens when you leave. It takes effect automatically when you create an account. You do not need to sign anything.

1. Parties and acceptance

This Data Processing Agreement ("DPA") is between you, or the organisation you represent ("Controller", "you"), and Lova Labs, a sole proprietorship established at Rietoever 60, 2371 JL Roelofarendsveen, the Netherlands, KvK 42103900, VAT NL005496650B29 ("Processor", "we", "us"), operator of CSP Logger.

This DPA forms part of, and is governed by, our Terms of Service. It applies from the moment you create an account and for as long as we process personal data on your behalf. Accepting the Terms accepts this DPA in the version published here. Where this DPA and the Terms conflict on the processing of personal data, this DPA prevails.

If your procurement process requires a countersigned copy, or terms that differ from these, email support@csplog.io and we will consider it case by case. To keep a fixed copy of this version, print this page to PDF from your browser; the version and date above identify it.

2. Which data this covers, and which it does not

We hold two kinds of data, and our role differs between them. This distinction matters, so we state it plainly rather than leaving it to be inferred.

We are your processor for the violation reports your websites send us. Those reports describe the browsing of your end-users, and it is your relationship with those people that authorises the collection. This DPA governs that data.

We are the controller of your own account data: the name and email address you register with, your password hash, your plan and subscription state, and our records of how you use the Service. While you are signed in, that also includes a session record holding your IP address and user-agent, kept so the sign-in can be secured. We process all of it under our own Privacy Policy for our own purposes of running and billing the Service, not on your instructions, so this DPA does not govern it.

3. Subject matter, duration, nature and purpose

The subject matter is the collection and processing of Content Security Policy violation reports from websites you own or control, for the purpose of showing you what your pages load and assembling a policy from the decisions you make about it. The full description required by Article 28(3) is in Annex I.

Processing is continuous for as long as your projects are active, and ends as described in section 10.

4. Our instructions

We process personal data only on your documented instructions, including on international transfers, unless EU or Dutch law requires otherwise. If such a law applies, we will tell you before processing unless that law forbids it on important grounds of public interest.

Your instructions are: this DPA, the Terms of Service, and the configuration you set in the Service, such as which domains you register, which pages you have us check, your filter rules, and your retention tier. Using a feature is an instruction to perform the processing that feature performs.

We will tell you if, in our opinion, an instruction infringes the GDPR or other EU or member-state data-protection law.

5. Confidentiality

Access to production systems is limited to the founder, who is bound by a duty of confidentiality. We do not sell your data, and we do not use the personal data we process for you to train machine-learning models, our own or anyone else's.

6. Security

We implement the technical and organisational measures set out in Annex II, taking account of the state of the art, the cost of implementation, and the risk to data subjects. We may update those measures over time, but not in a way that materially lowers the level of protection.

7. Sub-processors

You give us general authorisation to engage sub-processors. Our current sub-processors, what each of them does, and where they process data are published and kept current at csplog.io/subprocessors. That page is Annex III of this DPA, referenced rather than copied so that it cannot fall out of date here.

Before adding or replacing a sub-processor we will give you at least 30 days' notice by email. If you object on reasonable data-protection grounds within that period, tell us at privacy@csplog.io. We will try to offer an alternative; if we cannot, you may terminate the affected part of the Service and receive a refund for the unused portion of your term.

We impose data-protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain fully liable to you for their performance.

8. International transfers

All storage and all application compute are in the European Union: the database is in Frankfurt and the servers are in Germany. We, the processor under this DPA, are an EU entity and are directly subject to the GDPR; no transfer takes place between you and us. Some of our own sub-processors are outside the EEA, and each onward transfer has its own legal basis, described per vendor on the sub-processors page. Currently, Standard Contractual Clauses (Module Three, processor to sub-processor) apply for every one of them.

9. Assisting you

Taking into account the nature of the processing, we will help you meet your own obligations:

• Data-subject rights. If one of your end-users contacts us directly, we will not answer them on your behalf; we will refer them to you and tell you. Where you need our help to answer a request for access, correction, erasure, restriction, objection, or portability, we will give reasonable assistance. Because we hold violation reports and not identities, we usually cannot locate a single person's records without identifying information from you.
• Security, impact assessments, and consultation. We will give you the information you reasonably need for your obligations under Articles 32 to 36, including this DPA, our Privacy Policy, and the sub-processor list.
• Breach notification. If we become aware of a personal-data breach affecting your data, we will notify you without undue delay and in any case within 72 hours of becoming aware, at your account email address, with the information available to us and updates as we learn more. Reaching your own supervisory authority within your own deadline remains your responsibility as controller.

10. Deletion and return

Violation data is deleted continuously, not only at the end. Raw reports are removed shortly after processing, and processed events are deleted once they pass your plan's retention window, which is 30 days on Trial and Starter and 90 days on Professional. Deletion is automatic; you do not have to ask.

When you delete your account, we delete the personal data we process for you immediately, along with any remaining violation data; copies in the nightly backups expire within 30 days. This applies except where EU or Dutch law requires us to keep something, in which case we keep only that and only for as long as required. Billing and tax records are held by Paddle as Merchant of Record under its own retention obligations.

Return, on request. We do not provide a bulk, self-service export. If you ask us at privacy@csplog.io before you delete your account, we will manually export a copy of your violation data and generated policies and provide it to you. We do not restore or supply data once it has been deleted, and we do not restore it from backups. Section 7 of the Terms of Service describes what is available while your account is active.

11. Audits

We will make available the information necessary to demonstrate compliance with Article 28, and allow and contribute to audits. In practice, and to keep this proportionate for a small operation:

• audits are limited to once per twelve months, on at least 60 days' written notice, unless a supervisory authority requires otherwise or a breach has occurred;
• we may satisfy an audit by answering a reasonable written questionnaire, or by providing a current third-party report where one exists;
• any on-site or hands-on audit is at your cost, during business hours, must not disrupt the Service or affect other customers, and the auditor must be bound by confidentiality and must not be our competitor.

12. Liability

Our liability under this DPA is subject to the limitations and exclusions in section 13 of the Terms of Service, including the cap at the fees you paid in the 12 months preceding the claim. Nothing here limits liability that cannot be limited under applicable law, including a data subject's rights under Article 82 GDPR against a controller or processor directly.

13. Governing law, term, and changes

This DPA is governed by the laws of the Netherlands, and disputes go to the competent court in Amsterdam (Rechtbank Amsterdam). It lasts as long as we process personal data on your behalf, and the obligations in sections 5, 6, 8, 10, and 12 survive its end for as long as we hold any of that data.

We may publish a new version of this DPA. For material changes we will give at least 30 days' notice by email; continued use after the change takes effect is acceptance. The version and date at the top of this page identify the version in force.

Annex I: description of the processing

A. Parties. Data exporter and controller: you, the account holder, at the contact details on your account. Data importer and processor: Lova Labs, Rietoever 60, 2371 JL Roelofarendsveen, the Netherlands, KvK 42103900, VAT NL005496650B29, contact privacy@csplog.io. Neither party has appointed a Data Protection Officer; we are below the Article 37 thresholds.

B. Description of the transfer and processing.

• Categories of data subjects. End-users of your websites, whose browsers send violation reports. We never see or contact them, and we hold no identifier that would let us do so.
• Categories of personal data. From each violation report: the address of the page the visitor was on, the address of the blocked resource, the referring address, the source file, the violated directive, line and column numbers, and a sample of up to about 40 characters of the blocked inline script or style. Every address (page, referrer, blocked resource and source file) is truncated at the first ? or # before we store it, in the ingest service and again in the processing step, so query strings and fragments, which routinely carry session tokens, password-reset links, email addresses and tracker identifiers, never reach our database. Scheme, host and path are kept, because the path is what the Service exists to report on.
• Sensitive data. None is processed intentionally, and we ask for none. The inline sample field is the one place where page content could incidentally appear. You are responsible for scoping CSP reporting away from pages that render sensitive data. We apply no additional restrictions to this field beyond the measures in Annex II, so treat that scoping as yours to do.
• Nature and purpose. Collection, deduplication into daily aggregates, storage, presentation to you, deletion on a retention schedule, and the assembly of a Content Security Policy from the decisions you record.
• Automated decision-making. None within the meaning of Article 22. The Service makes suggestions; a policy is only ever assembled from choices you make yourself.
• Frequency. Continuous, in real time, for as long as your projects are active.
• Duration. Raw reports are deleted shortly after processing. Processed events are deleted after 30 days on Trial and Starter, and after 90 days on Professional. See section 10 for account closure.

C. Competent supervisory authority. Autoriteit Persoonsgegevens, the Netherlands, as the authority of our place of establishment.

Annex II: technical and organisational measures

• Encryption in transit. TLS on every endpoint: report collection, dashboard, marketing site, and every sub-processor API we call.
• Encryption at rest. Provided by our managed database host under its own terms, which are listed with that vendor on the sub-processors page. We rely on the host for this measure rather than implementing it ourselves.
• Tenant isolation. Every read and write of customer data is authorised in the application against the owner of the project, through a single access policy. The application connects to the database through least-privilege roles that hold only the grants their service needs. Row-level security is enabled on the shared tables, with no policies, so the database's public API cannot reach them.
• Authentication. Password hashing with bcrypt; per-project tokens for report collection; session-based authentication for the dashboard.
• Data minimisation at the point of collection. Query strings and fragments are stripped before storage, as described in Annex I. The report-collection service is write-only, returns no data, and always answers 204, so it cannot be used to read anything back.
• Minimisation towards the AI sub-processor. Only the domains configured for the project, and an aggregated table of blocked origins per directive with event counts, counts of distinct pages affected, the number of other origins seen on the same page, and ages in whole days, are sent to Anthropic. No page addresses, no report times, no IP addresses, and never the inline sample field. The generated Content Security Policy itself is assembled deterministically from your own recorded decisions, so no model output can reach the policy your site serves.
• Separation of duties in the architecture. The collection service and the dashboard share only the database and no code, and each writes only its own tables.
• Rate limiting and abuse controls. Per-project rate limits on report collection, and rejection of reports for domains that are not registered and active.
• Retention enforcement. Automated and scheduled rather than manual: raw reports are purged on an hourly job, and processed events are bounded by your plan's retention window.
• Backups. A full backup of the database is taken nightly and stored, encrypted in transit and at rest, in a bucket located in the European Union and held by a different provider than the database itself. Copies are kept for 30 days and then deleted. Each night's backup is verified after it is written, and the restore procedure is rehearsed rather than assumed.
• Monitoring and logging. Application error monitoring and scheduled-job monitoring, with personal data scrubbed from error traces.
• Access control and personnel. Production access is limited to the founder. No other person has access to customer data, other than the sub-processors in Annex III acting on our instructions.
• Incident response. Breach notification to you without undue delay and within 72 hours, per section 9.

Annex III: sub-processors

The authorised sub-processors, the service each provides, the data each receives, and the transfer basis for each are published at csplog.io/subprocessors, which forms this Annex. It is referenced rather than reproduced here so that one page stays authoritative and cannot drift from the other. Changes are notified 30 days in advance under section 7.

Contact

Data-protection questions and sub-processor objections: privacy@csplog.io. Everything else: support@csplog.io.