Data Processing Agreement

Last updated: 30 September 2026

This agreement is part of the Zenhook Terms. It applies when you, the customer, use Zenhook to process personal data about other people: in the events your apps send (a person in an actor, an email in a field) or, with Analytics, about the visitors of your websites. For that data you are the controller, and Solar Beam Studio (SASU, SIREN 900 029 208, France) is your processor under Article 28 of the GDPR.

1. What we process

  • Events: what your channels receive, titles, messages, fields, actors, links and attachments.
  • Analytics: for each visit, the page (segments that look like a token, an id or an email are masked), the referring site, the country, the device and the browser, and a fingerprint of the IP address and browser that changes every day (the IP address itself is never stored); your custom events; feedback messages, and the email a visitor chooses to leave.
  • People concerned: your users, customers and website visitors.

Purpose: to show, notify, search and summarise these events for your workspace, and to count your sites' visits. Nothing else: we do not sell or share this data, and we do not use it for ourselves or to train models.

2. Your instructions

We process the data only to run Zenhook for your workspace, as set by your settings and these terms, or where the law requires it, in which case we tell you first unless the law forbids it.

3. Security

  • Hosting in the EU: Hetzner, Helsinki (Finland). Connections are encrypted (TLS), and the servers answer only through Cloudflare.
  • Access is limited to the people who run Zenhook, who are bound by confidentiality.
  • Analytics: no cookie, the IP address is never stored, the fingerprint's salt is deleted after two days, Global Privacy Control and Do Not Track are honoured, and visits are kept 13 months.
  • Public endpoints have rate limits and daily caps.

4. Subprocessors

  • Hetzner Online (Germany, servers in Finland): hosting and database.
  • Cloudflare (United States): network, CDN and file storage.
  • Resend (United States): email notifications.
  • Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging): push notifications to your devices.
  • OpenRouter (United States) and the model provider it routes to: the Assistant's answers, only when a member of your workspace asks it a question.

We announce a new subprocessor on this page 30 days before it starts. If you object, you can close your workspace before then. Transfers outside the EU rely on the EU-U.S. Data Privacy Framework or on the European Commission's standard contractual clauses.

5. Helping you

You can delete events, channels and sites yourself. We help you answer the people concerned (access, deletion, objection) and act on your written request within 30 days. We tell you about a personal data breach affecting your workspace without undue delay, and within 48 hours of learning of it, with what we know.

6. End of processing

Deleting a site deletes its visits. Deleting your workspace or your account deletes its data; backups roll over, and deleted data disappears from them as they expire. Visits older than 13 months are deleted automatically.

7. Audits, law and contact

On request, we give you the information needed to show that these obligations are met: [email protected]. This agreement is governed by French law.