1. Purpose and roles
This Data Processing Addendum is a beta template for B2B customers that use Voidek to process traffic and security telemetry from properties they own or control.
For protected-site telemetry, the customer generally determines why and how request metadata is sent to Voidek, and Voidek processes that data to provide crawler defense, security decisions, logs, usage, support, and reliability. Depending on final deployment and customer instructions, Voidek may act as a processor, service provider, or independent controller for limited platform security and abuse-prevention records.
2. Processing instructions
Voidek will process customer personal data only to provide and secure the service, follow documented customer configuration, comply with law, prevent abuse, maintain billing and audit records, and perform support or troubleshooting.
Customers must not send unnecessary sensitive data, payment card data, health records, government identifiers, authentication secrets, or unrelated content in request telemetry.
3. Categories of data
Processed data may include account details, workspace details, site configuration, API key metadata, request IP address, user agent, headers, path, method, referrer, accept-language, cookie/token presence, timestamps, decision, score, bot category, browser challenge signals, logs, support messages, and billing metadata after paid launch.
4. Security measures
Voidek will maintain reasonable technical and organizational measures appropriate to the beta service, including HTTPS/TLS, access controls, credential handling, production secret isolation, logging, retention limits, deployment review, backup/rollback practices, and incident response procedures.
Customers are responsible for their own origin security, account access, API key storage, route configuration, timeout/fail mode, and privacy notices to their end users.
5. Subprocessors and international transfers
Voidek may use subprocessors for hosting, deployment, databases, monitoring, source control, support, email, and payment processing. Current production and candidate providers include Vercel, AWS, GitHub, Google account tooling, and the payment providers under review such as Toss Payments, PortOne, Stripe, or PayPal.
Some subprocessors may process data outside the customer's country. Before paid launch, the final international transfer disclosures and contracts should be reviewed against the production vendor list.
6. Retention, deletion, and return
Raw request logs are intended to be retained for limited periods based on plan and configuration, while aggregated usage, security, audit, and billing records may be retained longer.
Upon account closure or verified deletion request, Voidek will delete or de-identify customer personal data within a reasonable period unless retention is required for security, billing, legal, audit, backup, or dispute reasons.
7. Assistance and incidents
Voidek will provide reasonable assistance for verified rights requests, security questions, and incident investigations to the extent the request relates to Voidek processing and is technically feasible.
Security or privacy notices should be sent to voidek.dev@gmail.com.