Trust Center
We're committed to protecting your data and maintaining transparency about our security practices.
Effective date: June 6, 2023
Company Information
We are a technology company based and registered in South Africa.
Legal Name: Espresso Dev (Pty) Ltd
Registration Number: 2015/437542/07
Country: South Africa
Founder: Herman Schutte
Product Name: SiteSpeakAI
Contact Email: privacy@sitespeak.ai
Privacy & GDPR Compliance
SiteSpeakAI is GDPR compliant. We act as a data processor on our customers’ behalf and provide the contractual and technical safeguards required to process EU and UK personal data lawfully:
- A signable Data Processing Agreement incorporating the EU Standard Contractual Clauses
- A published list of subprocessors with their location and transfer safeguard
- Support for data subject rights, including access, export, and deletion
- Cookie consent for visitors in the EEA and UK
- Encryption in transit and at rest, and a 48-hour breach notification commitment
We also support compliance with the UK GDPR, South Africa’s POPIA, and California’s CCPA/CPRA.
Data Requests
If you have any questions or requests regarding your personal data, please contact us at privacy@sitespeak.ai.
Data Processing Agreement (DPA)
Our Data Processing Agreement outlines how we handle your personal data and ensures compliance with privacy regulations.
- Data processing purposes and AI training restrictions
- Data retention periods (conversations: 2 years, accounts: 30 days post-termination)
- 48-hour breach notification and incident response procedures
- Data subject rights assistance and deletion requests
- International data transfers with adequate safeguards
Subprocessors
We work with trusted third-party service providers to deliver our services. All subprocessors are contractually bound to protect your data.
| Service Provider | Purpose | Location | Transfer Mechanism | DPA Status |
|---|---|---|---|---|
| Anthropic | AI language model processing | United States | Standard Contractual Clauses | Available |
| Better Stack | Log management & monitoring | United States | Standard Contractual Clauses | Available |
| Cloudflare | CDN, DNS & DDoS protection | United States | EU-US Data Privacy Framework | Available |
| Cohere | Search result ranking | Canada | Adequacy decision (Canada) | Available |
| DigitalOcean | Cloud hosting, database & storage | United States | EU-US Data Privacy Framework | Available |
| Drip | Email marketing automation | United States | Standard Contractual Clauses | Available |
| AI language model processing | United States | EU-US Data Privacy Framework | Available | |
| LlamaIndex | Document parsing | United States | EU-US Data Privacy Framework | Available |
| Microsoft Azure | Speech-to-text processing | United States | Standard Contractual Clauses | Available |
| Nightwatch | Application performance monitoring | United States | EU-US Data Privacy Framework | Available |
| OpenAI | AI language model processing & embeddings | United States | EU-US Data Privacy Framework | Available |
| Replit | Payment processing / transfer of content | United Kingdom | Standard Contractual Clauses | Available |
| Pinecone | Vector database (content search) | United States | EU-US Data Privacy Framework | Available |
| PostHog | Product analytics | United States | Standard Contractual Clauses | Available |
| Pusher | Real-time messaging | United Kingdom / United States | Standard Contractual Clauses | Available |
| Resend | Transactional email | United States | Standard Contractual Clauses | Available |
| ScrapingBee | Web page rendering for indexing | France (EU) | Not applicable (EU) | Available |
| Sentry | Error monitoring | United States | EU-US Data Privacy Framework | Available |
| Talt | Affiliate tracking | United States | EU-US Data Privacy Framework | Available |
| Upstash | Caching (Redis) | United States | EU-US Data Privacy Framework | Available |
| xAI | AI language model processing | United States | EU-US Data Privacy Framework | Available |
Security Measures
We may modify these Terms or any additional terms that apply to the Application. We will post notice of modifications to these Terms on this page.
Encryption
- Data encrypted in transit (TLS 1.3)
- Data encrypted at rest (AES-256)
- Database encryption enabled
Access Controls
- Role-based access control
- Multi-factor authentication
- Regular access reviews
Infrastructure
- DigitalOcean SOC 2 certified infrastructure
- Regular security updates
- Automated backup systems
Monitoring
- 24/7 system monitoring
- Automated threat detection
- Incident response procedures
Data Protection
- PII redaction masks ID numbers, payment cards and bank accounts in visitor messages
- Redacted values never reach AI providers or storage
- Audit trail records every redaction for compliance evidence
Encryption
- Prompt injection and jailbreak protection
- Configurable response restriction levels
- Per-visitor rate limiting to prevent abuse
Your Data Rights
You have the following rights regarding your personal data:
- Right to access your data
- Right to data portability
- Right to rectification
- Right to erasure
- Right to restriction
- Right to object
Legal Documents
Privacy Policy
How we collect, use, and protect your data
Terms of Service
Terms governing use of our services
DPA Agreement
Data processing agreement for businesses