Processor agreement
Findings · Version 1 · 24 September 2026
This agreement is between you, the customer who puts the Findings button on your own website or app (the controller), and YINDOR, Torenallee 20, 5617 BC Eindhoven, the Netherlands, KvK 42120380 (the processor). It meets article 28 of the GDPR. It forms part of the Findings terms of use and applies as soon as your site passes signed-in users to Findings or you switch on the visitor button.
1. What we process, and why
| Purpose | Letting people report problems and ideas on your site, and showing those reports to you |
| People | Your visitors, your testers, and your signed-in users |
| Data | The sentence typed; page path, screen size, browser user agent, build, environment and date; an email address only if the person is signed in on your site or types one in; the email and role your site passes for a signed-in person; a salted hash of the IP address |
| Not processed | Screenshots, session recordings, page content, raw IP addresses. No special categories of data are intended; see §3 |
| Duration | As long as you use Findings |
2. Your instructions
We process this data only to run Findings for you, as described in §1 and in the settings you choose. We do not use it for our own purposes, do not sell it and do not train models on it. If we think an instruction breaks the law, we tell you.
3. Your part
You make sure you may collect this data, and you tell the people on your site about Findings in your own privacy notice. You do not ask anyone to type in health data, payment details, passwords or other special categories of data.
4. Confidentiality
Only YINDOR's owner has access to the production systems. Anyone YINDOR ever gives access is bound to confidentiality first.
5. Security
We take these measures, and we do not claim more:
- HTTPS only, for the service and the button.
- Every account is isolated. Sites, testers, groups and tokens belong to one account, and one account's token cannot read another's data.
- A site accepts reports only from the origins you allow, with a rate limit per visitor.
- IP addresses are kept only as a salted hash, for 7 days. Passwords and session cookies are stored only as hashes.
- The server sits behind a firewall that admits only the ports the service needs.
- Daily backups are encrypted before they leave the server and are stored in a different data centre, for up to 6 months.
Findings is not certified or externally audited.
6. Requests from the people on your site
When someone asks to see or delete their report, you handle it, because you are the controller. On the desk you can delete a single report, a whole site or your account. Deleting removes the data from the live database at once. Backups expire within 6 months. If a request reaches YINDOR, we forward it to you without undue delay and do not answer it ourselves. We help you with anything the desk cannot do.
7. Sub-processors
You allow YINDOR to use these sub-processors:
| Who | What for | Where |
|---|---|---|
| Hetzner Online GmbH, Germany | Server and database | Helsinki, Finland |
| Hetzner Online GmbH, Germany | Encrypted backups | Falkenstein, Germany |
We give you at least 30 days notice on findings.dev before adding or replacing one. If you object, you may close your account before the change, and we delete your data. Each sub-processor is bound by a data processing agreement with obligations no weaker than these.
No data leaves the European Union.
8. Breaches
If we discover a breach that affects your data, we tell you within 48 hours of discovering it. We say what happened, what data and how many people it concerns, and what we are doing about it. We then help you with your own notifications.
9. Help with your obligations
On request, we give you the information you need to show that this agreement is kept, and we help you with a data protection impact assessment or a question from a supervisory authority, as far as it concerns Findings. You may have an audit carried out at your own cost, with 30 days notice and under confidentiality, no more than once a year unless a breach gives cause.
10. At the end
When you delete a site or your account, we delete its data from the live database at once and from backups when they expire, within 6 months. We keep no copy unless the law requires it. Before you delete, you can copy your data through the API.
11. Liability and law
Liability follows the terms of use. Dutch law applies, and disputes go to the District Court of Oost-Brabant (Rechtbank Oost-Brabant). Where this agreement and the terms of use conflict on personal data, this agreement wins.