Data Processing Addendum

This addendum forms part of the Terms of Service and applies whenever Codivion, LLC processes personal data on your behalf. You are the controller; we are the processor. Where data protection law uses different words for these roles, the equivalent roles apply.

You decide what to collect and why, and you are responsible for having a lawful basis for it and for telling your visitors. We process only on your instructions.

The categories of data and the retention periods are set out in our Privacy Policy, which forms part of this addendum. In summary: page and referrer data, approximate location derived from an IP address that is never stored, device and browser class, an opaque session identifier, and whatever custom events you choose to send.

The data subjects are the visitors to the sites you measure. We hold no name, email or advertising identifier for them, and identifiers are hashed per site so that the same person on two customers’ sites cannot be linked.

• We process personal data only on your documented instructions.
• We keep it confidential and make sure the people who can access it are bound to do the same.
• We apply appropriate technical and organisational measures, including encryption in transit, tenant isolation enforced at the database level, and access limited to the staff who need it.
• We help you respond to data subject requests, and to your obligations around security, breach notification and impact assessments.
• We tell you without undue delay if we become aware of a personal data breach affecting your data.
• On request we delete or return your data when the service ends, except where we must keep it by law.

We use four sub-processors, each for a single purpose:

• Vercel — application hosting and delivery
• Supabase — accounts, sites, settings and subscription records
• Tinybird — the analytics event store
• Stripe — payment and subscription processing

Each is bound by terms no less protective than these. If we add or replace one, we will give account holders notice by email before it starts processing, so you have the chance to object.

Our sub-processors operate in the United States and the European Union. Where personal data is transferred out of the EEA or the UK, the transfer relies on the European Commission’s Standard Contractual Clauses, together with the UK Addendum where the UK GDPR applies.

On reasonable written request, and no more than once a year unless a regulator requires otherwise, we will provide the information needed to demonstrate compliance with this addendum.

This addendum applies automatically — you do not need to sign anything for it to be in force. If your own compliance process needs a countersigned copy, write to privacy@truestat.io and we will arrange one.