Data Processing Agreement

Last updated: October 27, 2026

This agreement under Art. 28 GDPR is part of the terms of service between you, a business using Shotlane (the controller), and Lennart Eisold, Shotlane, c/o Autorenglück #14076, Albert-Einstein-Straße 47, 02977 Hoyerswerda, Germany ("we", the processor). It applies whenever you use the Service for your business and the content you send or have us fetch contains personal data. It takes effect with the terms and needs no signature; if you need a signed copy, email [email protected]. For data protection matters it takes precedence over the terms.

1. Subject, duration and purpose

We render web pages, HTML and Markdown that you send or point us to into screenshots, PDFs, videos, Markdown and structured data, and run the jobs, crawls, change monitors, hosted result links, webhooks and uploads to your own storage that you set up. We process personal data only for that. This agreement lasts as long as the terms.

2. Data and data subjects

Types of data: whatever the pages and documents you render contain (for example names, contact details, images and text), the URLs you send, and the cookies, headers and credentials you pass for a target site. Data subjects: people whose data appears in those pages and documents, and your staff or users who send requests.

3. Your instructions

We process the data only on your documented instructions: your API requests and the settings you choose, these terms and this agreement, unless EU or German law requires otherwise, in which case we tell you first where the law allows. If we think an instruction infringes data protection law, we tell you.

4. Confidentiality

Only people bound to confidentiality get access to the data. Today that is the operator alone.

5. Security

We take the technical and organisational measures of Art. 32 GDPR described on the security page: a fresh sandboxed browser per render, network rules that keep renders off private networks, credentials used for one request and never stored or logged, TLS in transit, encrypted backups, short retention and access limited to the operator. We may change the measures as long as the level of protection doesn't drop.

6. Sub-processors

You authorise these sub-processors, each bound by a data processing agreement with the same obligations:

We tell you at least 4 weeks before adding or replacing a sub-processor, by email or on this page. You can object for a data protection reason; if we can't address it, you may end the contract, and unused paid credits are refunded pro rata. Transfers outside the EU rely on the EU–US Data Privacy Framework where the provider is certified under it, otherwise on the EU Standard Contractual Clauses.

7. Helping you

We help you, as far as we can given what we process, to answer requests from data subjects and to meet your obligations under Articles 32 to 36 GDPR (security, breach notification, impact assessments, prior consultation).

8. Personal data breaches

We notify you without undue delay after becoming aware of a breach affecting your data, by email to your account's address, with what we know and what we are doing about it.

9. Deletion

Content is deleted on the schedule in the privacy policy: results that aren't cached or hosted are discarded once sent, hosted results after 24 hours or your keep_days, monitor snapshots when you delete the monitor. When you delete your account, its data is deleted at once; hosted results and caches still expire on that schedule, and database backups within a year. We keep nothing longer unless the law requires it.

10. Audits

We give you the information you need to show that this agreement is kept. You, or an auditor bound to confidentiality, may inspect it after reasonable notice, at your own cost, normally once a year and without disrupting the Service; written answers and documents come first.

11. Liability

Liability follows Art. 82 GDPR and section 8 of the terms.