Data Processing Agreement

Last updated 5 November 2026

This Data Processing Agreement ("DPA") is part of the Terms of Service between you, the customer ("you", the controller), and Ampersand Labs by Davide Morotti, Flüelastrasse 10, 8048 Zürich, Switzerland — UID CHE-497.974.362 ("we", the processor). It applies whenever we process personal data on your behalf through Hoila (the "Service"). By accepting the Terms you accept this DPA. If you need a signed copy, write to legal@ampersand.ch and we will send you a PDF.

1. Subject and duration

We process personal data on your behalf to provide the Service. The DPA lasts as long as we process personal data for you under the Terms, and ends once that data has been returned or deleted as described in section 11.

2. Nature and purpose

We process personal data only to:

• host your websites and apps, and store their files, databases and settings;
• prepare changes with the AI assistant, show them as drafts and publish them when you say so;
• receive and forward messages that visitors send through forms on your sites;
• count visits without cookies and without storing IP addresses (visitors are counted with a key that changes daily);
• let members of your apps sign in;
• make backups and keep version history;
• receive change requests that you and your team send by e-mail or WhatsApp, including photos and voice messages.

3. Data subjects and data

Data subjects: visitors of your websites and apps, people who send you messages through forms, members of your apps, people named or shown in your content, and you and your team members.

Personal data: contact details and message contents from forms; names, e-mail addresses and password hashes of app members; technical data such as IP addresses (for security and abuse prevention; not stored by the visitor statistics), browser and time of access; names, photos and other personal data contained in your website content; and the e-mail addresses, mobile numbers, messages, photos and voice messages of your team when they request changes.

The Service is not designed for special categories of personal data (for example health data). If you process such data with Hoila, you are responsible for making sure that is lawful and for telling us beforehand.

4. Your instructions

We process personal data only on your documented instructions: the Terms, this DPA, and what you do and configure in the Service (for example asking the assistant for a change or connecting a form). If we believe an instruction breaks data protection law, we will tell you. If the law requires us to process data in another way, we will tell you before we do so, unless the law forbids it.

5. Confidentiality

Everyone at Hoila who can access personal data is bound to confidentiality. Hoila support may sign in to your account to help you, only when needed; every such sign-in is recorded in an audit log.

6. Security

We take appropriate technical and organisational measures, in particular:

• Encryption: all connections use TLS. Hosting passwords and API keys are encrypted at rest with a master key (libsodium) and are never shown to the AI. Account passwords are stored only as hashes.
• Access control: roles and permissions per person and team; optional two-step sign-in for customers, required for Hoila administrators.
• Accountability: an audit log of sensitive actions, including support sign-ins.
• Separation: code builds run on a separate build server in isolated containers.
• Integrity: changes are prepared as drafts and only go live when you publish them; version history lets you go back.
• Availability: regular backups.

We may update these measures as long as the level of protection does not go down.

7. Sub-processors

You allow us to use the sub-processors below. Some are only used when you use the related feature. We bind each of them to data protection obligations at least as protective as this DPA, and we remain responsible for them.

Planned: we plan to move hosting to Exoscale in Switzerland. This is not the case yet; we will announce it as a change below.

Changes: we will tell you about new or replaced sub-processors at least 30 days in advance, by e-mail or in the app. You can object within that time for reasonable data protection reasons. If we can't find a solution together, you may end the affected part of the Service before the change takes effect.

8. International transfers

Some sub-processors are in the USA or have access from there (Anthropic, OpenAI, Stripe, Meta and Twilio among them). Transfers to countries without an adequate level of data protection are covered by the EU Standard Contractual Clauses (with the adjustments required by Swiss law), or by the Swiss-US Data Privacy Framework where the provider is certified, or by an adequacy decision.

9. Helping you

Taking into account the nature of the processing, we help you answer requests from data subjects (access, correction, deletion, objection, portability), mostly through the functions of the Service. If a data subject contacts us directly about your data, we forward the request to you. We also help you with data protection impact assessments and consultations with authorities where needed.

10. Breaches

If we become aware of a breach of security affecting personal data we process for you, we will tell you without undue delay, aiming for 48 hours, with the information we have: what happened, which data and data subjects are affected, likely consequences and what we are doing about it. We will keep you updated as we learn more.

11. After the end

When the Terms end, you can export your websites, apps and data for 30 days. After that we delete the personal data we processed for you, including from backups as they expire, unless the law requires us to keep it.

12. Audits

On reasonable request we give you the information you need to show that this DPA is being followed, and allow audits by you or an independent auditor bound to confidentiality, with reasonable notice and during business hours. Audits are at your cost, unless they show a material breach of this DPA by us.

13. Liability and law

Liability under this DPA follows the Terms of Service. If this DPA and the Terms disagree on data protection, this DPA prevails. This DPA is governed by Swiss law; the courts of Zürich, Switzerland, have exclusive jurisdiction, subject to mandatory law.

14. Contact