Log in
Start for free

Trust Center

We're committed to protecting your data and maintaining transparency about our security practices.

Effective date: June 6, 2023

Company Information

We are a technology company based and registered in South Africa.

Legal Name: Espresso Dev (Pty) Ltd

Registration Number: 2015/437542/07

Country: South Africa

Founder: Herman Schutte

Product Name: SiteSpeakAI

Contact Email: privacy@sitespeak.ai

Privacy & GDPR Compliance

SiteSpeakAI is GDPR compliant. We act as a data processor on our customers’ behalf and provide the contractual and technical safeguards required to process EU and UK personal data lawfully:
  • A signable Data Processing Agreement incorporating the EU Standard Contractual Clauses
  • A published list of subprocessors with their location and transfer safeguard
  • Support for data subject rights, including access, export, and deletion
  • Cookie consent for visitors in the EEA and UK
  • Encryption in transit and at rest, and a 48-hour breach notification commitment
We also support compliance with the UK GDPR, South Africa’s POPIA, and California’s CCPA/CPRA.

Data Requests

If you have any questions or requests regarding your personal data, please contact us at privacy@sitespeak.ai.

Data Processing Agreement (DPA)

Our Data Processing Agreement outlines how we handle your personal data and ensures compliance with privacy regulations.
  • Data processing purposes and AI training restrictions
  • Data retention periods (conversations: 2 years, accounts: 30 days post-termination)
  • 48-hour breach notification and incident response procedures
  • Data subject rights assistance and deletion requests
  • International data transfers with adequate safeguards

Read our DPA

Subprocessors

We work with trusted third-party service providers to deliver our services. All subprocessors are contractually bound to protect your data.
Service Provider Purpose Location Transfer Mechanism DPA Status
Anthropic AI language model processing United States Standard Contractual Clauses Available
Better Stack Log management & monitoring United States Standard Contractual Clauses Available
Cloudflare CDN, DNS & DDoS protection United States EU-US Data Privacy Framework Available
Cohere Search result ranking Canada Adequacy decision (Canada) Available
DigitalOcean Cloud hosting, database & storage United States EU-US Data Privacy Framework Available
Drip Email marketing automation United States Standard Contractual Clauses Available
Google AI language model processing United States EU-US Data Privacy Framework Available
LlamaIndex Document parsing United States EU-US Data Privacy Framework Available
Microsoft Azure Speech-to-text processing United States Standard Contractual Clauses Available
Nightwatch Application performance monitoring United States EU-US Data Privacy Framework Available
OpenAI AI language model processing & embeddings United States EU-US Data Privacy Framework Available
Replit Payment processing / transfer of content United Kingdom Standard Contractual Clauses Available
Pinecone Vector database (content search) United States EU-US Data Privacy Framework Available
PostHog Product analytics United States Standard Contractual Clauses Available
Pusher Real-time messaging United Kingdom / United States Standard Contractual Clauses Available
Resend Transactional email United States Standard Contractual Clauses Available
ScrapingBee Web page rendering for indexing France (EU) Not applicable (EU) Available
Sentry Error monitoring United States EU-US Data Privacy Framework Available
Talt Affiliate tracking United States EU-US Data Privacy Framework Available
Upstash Caching (Redis) United States EU-US Data Privacy Framework Available
xAI AI language model processing United States EU-US Data Privacy Framework Available

Security Measures

We may modify these Terms or any additional terms that apply to the Application. We will post notice of modifications to these Terms on this page.
Encryption
  • Data encrypted in transit (TLS 1.3)
  • Data encrypted at rest (AES-256)
  • Database encryption enabled
Access Controls
  • Role-based access control
  • Multi-factor authentication
  • Regular access reviews
Infrastructure
  • DigitalOcean SOC 2 certified infrastructure
  • Regular security updates
  • Automated backup systems
Monitoring
  • 24/7 system monitoring
  • Automated threat detection
  • Incident response procedures
Data Protection
  • PII redaction masks ID numbers, payment cards and bank accounts in visitor messages
  • Redacted values never reach AI providers or storage
  • Audit trail records every redaction for compliance evidence
Encryption
  • Prompt injection and jailbreak protection
  • Configurable response restriction levels
  • Per-visitor rate limiting to prevent abuse

Your Data Rights

You have the following rights regarding your personal data:
  • Right to access your data
  • Right to data portability
  • Right to rectification
  • Right to erasure
  • Right to restriction
  • Right to object

Read our DPA

Legal Documents

Privacy Policy
How we collect, use, and protect your data
Terms of Service
Terms governing use of our services
DPA Agreement
Data processing agreement for businesses