Data Processing Agreement

How this works: this page publishes the DPA that applies between Lifub (processor) and a business customer (controller) when the customer uses a service through which Lifub processes personal data on the customer's behalf — currently, Page Finder (website crawling + search), the IP Whois & Geolocation API when used against end-user IPs, and Site Audit when a controller directs Lifub to audit a public page that the controller owns or is expressly authorized to audit.

Accepting our Terms of Service incorporates this DPA as Art. 28 GDPR terms. If your organisation requires a signed paper copy on your template, email info@lifub.com.

1. Parties

Processor

Alexander Orlov (natural person, trading as "Lifub"), Clementine-von-Braunmühl-Weg 11, 81541 München, Germany (see Imprint).

Controller

The business customer using the service under these Terms, as identified in any applicable service order, Site Audit checkout record, or documented request.

2. Subject, nature, and purpose of processing

• Page Finder: crawling and indexing of the controller's Authorized Domains; serving search queries submitted by the controller's end users; logging queries and IP addresses for operational and anti-abuse purposes.
• IP Whois & Geolocation API: returning GeoIP, ASN, and request-metadata responses for IP addresses supplied by the controller's applications; logging API requests for quota, billing, and audit.
• Site Audit: fetching and transiently analyzing controller-authorized public pages; returning bounded technical evidence; and retaining completed browser reports and server-side API or MCP snapshots under unguessable bearer UUIDs for 90 days. Direct API or MCP audits requested without sharing or snapshot storage are not retained as reports. Browser-created snapshot labels remain in the controller's browser.

3. Categories of data subjects and data

• End users of the controller's website or application.
• Individuals mentioned in crawled public content (names, roles, contact details as published by the controller).
• Data categories: IP addresses, HTTP request metadata, search terms, crawled page content, timestamps. No special-category data (Art. 9 GDPR) is intentionally processed.
• Site Audit data categories: audited target and final URLs; public page content processed transiently; selected response headers; content hashes and sizes; public page metadata; server-side snapshot labels supplied through the API or MCP; timestamps; scores; and findings. Stored reports do not retain response bodies, request headers, or cookies. Browser-created snapshot labels are not sent to Lifub.

4. Duration

Page Finder and IP Intelligence processing lasts for the service agreement plus up to 30 days for deletion and handover. Each server-stored Site Audit report or snapshot expires no later than 90 days after capture and may be deleted sooner on a valid controller instruction identifying its bearer UUID; the service term does not extend that 90-day TTL.

5. Obligations of the processor (Art. 28(3) GDPR)

1. Process personal data only on documented instructions from the controller, including as set out in the service order and this DPA.
2. Ensure persons authorised to process the data are bound by confidentiality.
3. Implement appropriate technical and organisational measures (Annex A).
4. Engage sub-processors only under the conditions in § 6 below.
5. Assist the controller with data-subject requests (Art. 12–23 GDPR) and with Art. 32–36 obligations.
6. On termination, delete or return all personal data unless EU or Member-State law requires retention.
7. Make available all information necessary to demonstrate compliance and allow audits, including inspections, conducted by the controller or an independent auditor (§ 9).
8. Notify the controller without undue delay of any personal data breach affecting the controller's data.
9. Immediately inform the controller if, in the processor's opinion, an instruction infringes the GDPR or other EU / Member-State data-protection law.

6. Sub-processors

The controller grants general written authorisation for engagement of the following sub-processors:

• OVH SAS, 2 rue Kellermann, 59100 Roubaix, France — infrastructure hosting (EU).
• DB-IP (operated by 2VIA S.A., Belgium) — provider of the DB-IP Lite geolocation database under CC BY 4.0. IP addresses are resolved locally against a hosted copy of the database; no end-user IP is sent to DB-IP.
• Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland — backup mail exchanger (iCloud Mail). The processor's mailboxes are hosted on its own EU server, which receives mail addressed to the processor and sends messages to the controller directly — no third party sits in that primary path. Apple processes controller data only when the processor's primary mail server is unreachable and the published backup mail-exchanger records deliver a message to Apple's iCloud Mail servers instead, where it is held until the primary returns.

The processor will inform the controller of any intended changes via the email address on file, giving the controller a 14-day objection period. If the controller objects on reasonable grounds, the controller may terminate the affected part of the service.

7. International transfers

The processor's own operational processing — hosting, indexing, metering and mail delivery — occurs within the EU, and every sub-processor named above is an EU or EEA entity. A sub-processor may nonetheless use infrastructure or sub-processors of its own outside the EEA; where such a transfer is unavoidable it is safeguarded by Art. 46 GDPR Standard Contractual Clauses.

8. Technical and organisational measures (Annex A)

• TLS 1.2+ for HTTPS and API traffic; verified STARTTLS for direct email when the receiving mail server offers it.
• API-key access controls and per-key quotas for keyed products; proof-of-work, per-network quota, per-target throttling, and optional bearer-voucher admission for anonymous Site Audit.
• Key material stored as sha256(pepper || key) (peppered server-side).
• Hosting on OVH EU infrastructure (ISO/IEC 27001 at the provider level).
• Production service, root, container, and data contents are encrypted at rest in LUKS2 volumes; unencrypted boot metadata contains no root unlock key.
• Root archives are encrypted before publication to the controlled OVH backup endpoint and accepted only after decrypt, decompress, tar-structure, and required-member verification. Service-data archives are accepted only after decrypt and compression-integrity verification.
• Human administrative access to production is restricted to the operator. Operator administration audit history is capped at 1,000 entries and its store expires 365 days after the last administrative write; security and access logs containing IP addresses are retained for up to 30 days.
• Site Audit browser reports and server-side snapshots expire after 90 days; public retrieval requires their unguessable bearer UUIDs.
• Breach response: notification to controller within 24 hours of detection; regulator notification within 72 hours (Art. 33).

9. Audits

Controller may audit the processor's compliance on 30 days' notice, no more than once per year unless a material breach has occurred. Audits are conducted at the controller's expense. The processor may fulfil its audit obligation by providing up-to-date third-party certifications or attestations.

10. Liability & jurisdiction

Liability follows the limits set out in the main Terms of Service § 11. German law applies; jurisdiction München, insofar as permitted between Kaufleute / juristische Personen per § 38 ZPO.