NoParrot NoParrot
Back to home

Widget Joint Controller Arrangement

Last updated: April 8, 2026

This Joint Controller Arrangement ("Arrangement") is entered into between SumatoSoft LLC, operating NoParrot.ai ("NoParrot"), and the entity embedding the NoParrot Widget on its website ("Website Operator"). This Arrangement supplements the NoParrot Widget Terms of Service.

This Arrangement is made pursuant to Article 26 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

1. Background

The Website Operator embeds the NoParrot Widget (a JavaScript snippet) on its website. When a visitor loads a page containing the Widget, the Widget extracts text content from the page and transmits it to NoParrot's servers for AI-powered analysis. The Widget then displays analysis results (NoParrot Score and claim markup) inline on the page.

2. Joint Controller Determination

Pursuant to CJEU case law (Case C-40/17, Fashion ID), the Website Operator and NoParrot are joint controllers for the following processing operations:

Joint control applies to:

  • (a) The collection of page content text from the Website Operator's website when a visitor's browser loads the Widget
  • (b) The transmission of such text, along with the visitor's IP address, to NoParrot's servers

NoParrot is sole controller for:

  • (c) Processing the text through AI models (Anthropic, OpenAI, Google, xAI)
  • (d) Generating and storing analysis results (NoParrot Score, claim extraction, synthesis)
  • (e) Managing Widget API keys, billing, and dashboard
  • (f) Caching results (by content hash) for subsequent requests

3. Respective Responsibilities

Website Operator shall:

(a) Inform website visitors about the Widget and its data processing in the Website Operator's own privacy policy. The privacy policy must describe: that the NoParrot Widget is embedded, what data is collected (page text, visitor IP), that data is transmitted to NoParrot (US-based) and to AI providers, and how visitors can exercise their rights.

(b) Obtain any required consent from visitors before the Widget is loaded, where required by applicable law. NoParrot recommends implementing a "2-click solution": the Widget initially displays a placeholder informing visitors about data processing; the Widget fully loads and transmits data only after the visitor takes an affirmative action (e.g., clicking "Load fact-check results").

(c) Ensure lawful basis for the processing of page content. If the page content contains personal data of identifiable individuals, the Website Operator must have a lawful basis for transmitting that data to NoParrot.

(d) Not represent Widget scores as factual verification. The Website Operator must not use language such as "Verified by NoParrot" or "Fact-checked" in connection with Widget scores. Permitted language includes: "NoParrot Score," "Model Agreement Score," or similar neutral descriptors.

NoParrot shall:

(a) Process page content solely for the purpose of generating analysis scores and displaying results via the Widget.

(b) Not use page content for AI model training. Content transmitted to AI providers via API is processed for inference only.

(c) Delete processed text within 30 days of analysis completion. Cached results (keyed by content hash, not containing raw text) are retained indefinitely for performance.

(d) Implement appropriate technical and organizational measures including encryption in transit (TLS 1.3), encryption at rest (AES-256), access controls, and PII filtering where technically feasible.

(e) Respond to data subject requests. NoParrot serves as the primary contact point for data subjects exercising rights under GDPR Articles 15-22 in relation to Widget processing. Contact: [email protected].

4. Contact Point for Data Subjects (Art. 26(1) GDPR)

NoParrot serves as the contact point for data subjects who wish to exercise their rights under GDPR in relation to data processed through the Widget.

Contact: [email protected]

Regardless of this arrangement, data subjects may exercise their rights against either controller (Art. 26(3) GDPR).

5. Summary for Data Subjects (Art. 26(2) GDPR)

The following summary shall be made available to data subjects, either through a link in the Widget badge or in the Website Operator's privacy policy:

"This page uses the NoParrot Widget to analyze text content for AI model agreement. When the Widget loads, the text of this page is sent to NoParrot.ai (operated by SumatoSoft LLC, USA) for analysis by multiple AI models. Your IP address is transmitted for security purposes. NoParrot does not use this data for advertising or AI training. For questions or to exercise your data protection rights, contact [email protected]."

6. International Data Transfers

The Website Operator acknowledges that data collected through the Widget is transferred to the United States (SumatoSoft LLC) and onward to AI providers located in the United States. Where such transfers involve personal data of EEA data subjects, NoParrot relies on the transfer mechanisms described in its Data Processing Agreement (Standard Contractual Clauses and/or EU-US Data Privacy Framework, as applicable per provider).

7. Data Breach Notification

In the event of a personal data breach affecting data processed through the Widget, NoParrot shall notify the Website Operator without undue delay and in any case within 48 hours of becoming aware of the breach, providing sufficient information for the Website Operator to meet its own notification obligations under Article 33 GDPR.

8. Liability

Each party is responsible for its own obligations under this Arrangement and under GDPR. The Website Operator is responsible for obtaining consent from visitors and for the lawfulness of embedding the Widget. NoParrot is responsible for the security and lawful processing of data after receipt.

Neither party shall represent NoParrot Score or Widget analysis results as factual verification. NoParrot's limitation of liability as set forth in the Widget Terms of Service applies to claims arising from Widget scores.

9. Term and Termination

This Arrangement is effective for as long as the Website Operator embeds the NoParrot Widget. Upon removal of the Widget or termination of the Widget subscription, NoParrot shall delete the Website Operator's cached results within 30 days upon request.

10. Contact

NoParrot: [email protected]
SumatoSoft LLC, Boston, MA 02108, United States