Data processing agreement

We process visitor data to provide analytics to you for as long as your account is active, plus the deletion period described below.

Pseudonymous visitor and session identifiers, page URLs, referrers, campaign tags, device and browser details, approximate location derived from IP addresses (which are not stored), and payment amounts linked to a visitor identifier when you connect a payment provider.

• Process data only on your documented instructions, which are the settings of your workspace.
• Ensure people with access are bound by confidentiality.
• Apply appropriate security: encryption in transit, hashed API tokens, row-level access controls and least-privilege database roles.
• Assist you with data subject requests and security incidents, and notify you without undue delay of a personal data breach.

You authorise Vercel (hosting), Supabase (database) and our payment provider (billing). We will inform you of changes and you may object.

Where data leaves the EEA or UK, transfers rely on the European Commission's standard contractual clauses or another lawful mechanism.

You can export data at any time. When you delete a website or close your account, its data is deleted from production systems, and from backups as they expire.

On reasonable request we will provide information needed to demonstrate compliance with this agreement. Contact us to request it.