Data processing agreement

For business customers. This agreement is part of the terms of use; you accept it when you accept the terms. Last updated 27 October 2026.

Parties and roles

This agreement is between the business customer (“you”, the controller) and Varselio, run by Dennis Erichsen, registered sole trader (enskild firma), Dalvägen 11, 697 34 Hallsberg, Sweden, dennis@varselio.se (“we”, the processor). It applies when we process personal data on your behalf in Varselio, as required by Article 28 of the GDPR (Regulation (EU) 2016/679). For data we decide on ourselves, such as your account, payments and security logs, we are the controller, as described in the privacy notice.

What we process for you

• Purpose and nature: running the checkpoint for your AI agents, your traps and the alerts and explanations you ask for.
• Types of data: what your agents send in checks (which can contain personal data if your agents include it), and what visitors send when they touch a trap (IP address, approximate country, browser details and the request).
• Data subjects: your users, people whose data appears in your agents’ checks, and visitors who touch your traps.
• Duration: as long as your account is active, with automatic deletion after 90 days for checks and trap evidence.

Our commitments

• We process the data only on your documented instructions: these terms, this agreement and the settings you choose in Varselio. We tell you if we believe an instruction breaks data protection law.
• Anyone who works with the data is bound by confidentiality.
• We take appropriate technical and organisational security measures (Article 32), including HTTPS, encrypted trap evidence, hashed passwords and keys, data separated per organisation, access limited to what is needed, and automatic deletion. No system is completely secure.
• We help you, as far as we reasonably can, to answer requests from data subjects and to meet your duties on security, breach notification, impact assessments and prior consultation (Articles 32 to 36).

Sub-processors

You give us general permission to use sub-processors. The current ones are:

• Render: hosting of the app and database, Frankfurt (EU) region.
• xAI: writes the Eye’s free-form answers when you chat or ask for an explanation (US).
• Strato: e-mail delivery (Germany).
• Browser push services of your browser’s maker: delivery of encrypted alert notifications, if you turn them on.

We bind each sub-processor to data protection terms that give at least the same protection as this agreement, and we remain responsible to you for them. We e-mail you at least 30 days before we add or replace a sub-processor. If you object on reasonable grounds and we cannot solve it, you can end your account, and we refund prepaid time you have not used.

Transfers outside the EU

Where a sub-processor is in a country outside the EU/EEA, or can reach data from there, we rely on an adequacy decision such as the EU–US Data Privacy Framework where the provider is certified, or on the EU standard contractual clauses.

Personal data breaches

If we become aware of a personal data breach affecting data we process for you, we tell you without undue delay, and where we can within 48 hours, by e-mail to your account owner. We share what we know about what happened, the data and people likely affected, the likely consequences and what we are doing about it, and we keep you updated.

Deletion and return

You can download your data at any time. When your account ends, the data we process for you is removed from the live service straight away and any backup copies are overwritten within 30 days, unless the law requires us to keep it.

Audits

We give you the information you need to show that this agreement is followed. If that is not enough, you may audit us, yourself or through an independent auditor bound by confidentiality, once a year with at least 30 days’ written notice, at your own cost, and in a way that does not disturb the service or reveal other customers’ data. Audits that a supervisory authority requires are always allowed.

Liability and order of precedence

The limitation of liability in the terms of use also applies to this agreement, as far as the law allows. If this agreement and the terms of use differ on data protection, this agreement takes precedence. Swedish law applies.

Signed copy

If you need a signed copy of this agreement, e-mail dennis@varselio.se and we will send one. This agreement is available in English and in Swedish with the same content. If the two versions differ, the Swedish version governs. Läs avtalet på svenska.