Data Processing Agreement

1. Parties, roles & scope

This Data Processing Agreement ("DPA") is between you, the customer using didthey.click to track your own website or app ("Customer," "you," the data controller), and didthey.click ("we," "us," the data processor). It applies to the personal data we process on your behalf through the Service — chiefly, data about the visitors of the sites and apps you track.

This DPA is incorporated into, and governed by, our Terms of Service. In the event of a conflict between this DPA and the Terms on data-processing matters, this DPA controls. Terms not defined here have the meaning given in the Terms of Service or our Privacy Policy.

2. Subject matter & duration

The subject matter of this DPA is our processing of personal data in connection with providing the didthey.click analytics Service to you. Processing continues for as long as you use the Service under the Terms of Service, and ends when your account or the relevant project is deleted, subject to the retention and deletion terms in Section 10.

3. Nature & purpose of processing

We process personal data to provide web analytics for the sites and apps you track: recording pageviews and traffic, building funnels and goal completions, and — if you connect Stripe — attributing revenue to visits. Processing is carried out by automated means as part of our hosted software service.

4. Categories of data subjects & personal data

Depending on how you configure and use the Service, we may process:

• Website/app visitors: page URL, referrer, browser/OS/device (parsed server-side from the User-Agent header), and coarse geolocation (country, region, city) derived from IP address. Visitors are identified across a visit and session using two randomly generated, first-party cookies — _dtc_vid (visitor id, retained up to 1 year) and _dtc_sid (session id, ~30-minute sliding window) — neither of which is a fingerprint or derived from device/browser characteristics. Visitor IP addresses are used transiently, in memory, for geolocation and bot verification, and are never stored.
• Identified end users: if you call the optional identify() function, we store the user identifier and traits you choose to send us (your own IDs and string values — we don't define or infer these).
• Your customers, via connected payment providers: if you connect Stripe for revenue attribution, we process the payments data needed for that matching, which can include your customers' email addresses.

5. Documented instructions

We process personal data only on your documented instructions — meaning, as configured by you through the Service (your tracked domains, the events and goals you define, the integrations you connect) and as needed to provide, maintain, and secure the Service, or as required by law. We will not process personal data for any other purpose, including our own marketing or profiling, without your consent — and we never sell or share the personal data we process on your behalf.

6. Confidentiality & security

We apply the following measures to protect the personal data we process:

• Encryption in transit via TLS/HTTPS for all data sent to and from the Service
• Encryption at rest, managed by our infrastructure providers
• Access to production data restricted to what's needed to operate the Service
• A per-project domain allowlist that restricts which sites can send events to your project
• No storage of visitor IP addresses

Anyone authorized to access the personal data we process for you — today, the individual operating didthey.click — is committed to treating it as confidential: it is accessed only as needed to operate the Service and is never disclosed or used for any other purpose.

7. Subprocessors

You authorize us to use the following subprocessors to provide the Service:

• Vercel — application hosting (United States)
• Neon on AWS (us-east-1) — database hosting (United States)
• Stripe — payment processing
• Google and Microsoft (Bing) — only if and when you choose to connect Google Search Console or Bing Webmaster Tools integrations

If we add or replace a subprocessor, we'll give you reasonable prior notice — via the site or by email to your account address. If you object to a new subprocessor, you may terminate your account and we will delete your data as described in Section 10.

8. International transfers

Personal data is processed in the United States by our hosting and database subprocessors. Where this involves transferring personal data of EU/EEA or UK residents, we rely on those providers' own GDPR data processing agreements, which incorporate the European Commission's Standard Contractual Clauses, to provide an adequate level of protection for the transfer.

9. Assistance

If we receive a request from a data subject relating to data we process on your behalf, we will forward it to you (or, where appropriate, assist you in responding to it) — since you, as the controller, are best placed to respond. If we become aware of a personal data breach affecting data we process for you, we will notify you without undue delay after becoming aware of it, and provide the information we reasonably can to help you meet your own notification obligations.

10. Deletion & return

Deleting a project or your account removes the associated data from the Service. During the term of your use, analytics event data is otherwise purged automatically once it passes your plan's retention window (30 days on Free, 3 years on Pro, 5 years on Business), with a 90-day grace period before final deletion. You can export your data at any time via our API or MCP endpoint while your account remains active.

11. Audits & information

didthey.click is a solo-operated service — we don't currently undergo third-party compliance audits or hold formal certifications, and we won't claim otherwise. On reasonable written request, we will provide the information reasonably necessary to demonstrate our compliance with this DPA (for example, describing our security measures or subprocessor arrangements in more detail).

Governing law

This DPA is governed by the laws of France, consistent with the governing law of our Terms of Service.

Contact

Questions about this DPA? Reach us at hello@didthey.click.