Data processing agreement

Version 1.0 · Effective 13 November 2026

This Data Processing Agreement ("DPA") forms part of the Eureka Search API Terms of Service (the "Terms") between LOGICANCE S.L., Spain ("we") and the business that uses the Eureka Search API under a business account (the "Customer"). It applies automatically when the Customer accepts the Terms. On request to info@logicance.com we will also sign a copy.

1. Definitions

"GDPR", "controller", "processor", "personal data", "processing", "data subject", "personal data breach" and "supervisory authority" have their GDPR meanings. "Query Data" means the queries and request parameters the Customer sends to the API and the answers we return, to the extent they contain personal data. "Sub-processor" means a processor we engage to process Query Data.

2. Roles and scope

2.1 For Query Data, the Customer is the controller and we are its processor (or its sub-processor, where the Customer is itself a processor).

2.2 We are a separate controller for account, security, billing and tax data, and for usage counts that contain no Query Data, as our privacy notice describes. This DPA does not cover that processing.

2.3 Annex 1 describes the processing.

3. Instructions

3.1 We process Query Data only to answer each request, on the Customer's documented instructions: the Terms, this DPA and the requests the Customer sends.

3.2 We process Query Data otherwise only where EU or Member State law requires it, and tell the Customer first unless the law forbids it. If we think an instruction breaks data protection law, we tell the Customer at once.

3.3 We never store or log Query Data, never use it to train or improve models or ranking, and never sell it or use it for advertising.

4. Confidentiality and security

4.1 Only people who need access to run the Service can reach the systems that process Query Data, and they are bound by confidentiality.

4.2 We apply the measures in Annex 2 and keep them at least at that level.

5. Sub-processors

5.1 The Customer authorises the Sub-processors in Annex 3. Each is bound by written terms giving Query Data at least the protection of this DPA.

5.2 We give at least 30 days' notice by email to the account owner before we add or replace a Sub-processor. The Customer may object on reasonable data protection grounds within 15 days. If we cannot resolve the objection, the Customer may close its account and we refund its unused purchased credit.

6. Location and transfers

Query Data is processed in Germany. We do not transfer Query Data outside the EU and EEA.

7. Helping the Customer

7.1 Because we store no Query Data, we hold nothing to return, correct or delete in answer to a data subject request. We will answer the Customer's reasonable questions about the processing.

7.2 We provide the information the Customer reasonably needs for a data protection impact assessment or prior consultation about its use of the API.

8. Personal data breaches

We notify the Customer without undue delay, and in any case within 48 hours after we become aware of a personal data breach affecting Query Data, with the information the Customer needs to meet its own obligations, and keep it informed.

9. Deletion

Query Data is held in the API's working memory while a request is answered. Single words from queries may stay in small in-memory lookup tables (for example, whether a word names a country) until the process restarts; they are not linked to a customer, a key or a request, and are never written to disk. Nothing needs deleting at the end of the Service.

10. Audits

10.1 We make available the information needed to show compliance with this DPA, including this DPA, Annex 2 and answers to written questions.

10.2 If that is not enough, the Customer, or an independent auditor bound by confidentiality, may audit our compliance once a year with at least 30 days' written notice, during business hours, without disrupting the Service or exposing other customers' data, at the Customer's cost. Sub-processors' own audit terms apply to their facilities.

11. Liability, duration and precedence

11.1 Liability under this DPA is governed by the Terms (section 10).

11.2 This DPA lasts as long as the Customer uses the API. If it conflicts with the Terms, this DPA prevails for Query Data. We may change it with 30 days' notice by email; a change will not reduce the protection of Query Data.

Annex 1. Description of the processing

• Subject and purpose: answering the Customer's search, context, document and find requests.
• Nature: receiving a request, searching our index, ranking and returning results; in memory only.
• Duration: the time needed to answer each request (normally under a few seconds); see section 9 for single words kept in memory lookup tables.
• Types of personal data: whatever personal data the Customer puts in a query (for example a person's name), and personal data that appears in public web pages returned as results.
• Data subjects: the Customer's users and any person named in a query.
• Special categories: not intended; the Terms (section 6.2) restrict them.

Annex 2. Technical and organisational measures

• Hosting in a dedicated server in Hetzner's data centre in Falkenstein, Germany; physical security under Hetzner's certified measures.
• Encryption in transit (TLS) for all API traffic; the API is reachable only through our own edge proxy.
• No query logging in the API, the search engine or the edge proxy; logs hold method, route, status and duration only.
• API keys stored only as SHA-256 fingerprints and shown to the Customer once; revocation effective within seconds.
• Per-key and global rate limits; request size limits enforced before a request is read.
• Administrative access by SSH key only; firewall admits only the ports the Service needs.
• Least-privilege containers with memory and CPU limits; the API reads account keys from a file that holds no secret.
• Encrypted backups of account data; no Query Data exists to back up.
• Dependency pinning and a secret scan before every code change; security review of every module before deployment.

Annex 3. Sub-processors