Data Processing Addendum

1. Scope and instructions

Processor processes visitor data (described in the Privacy Policy) only to detect invalid traffic, report it to Controller, and apply exclusions Controller enables, and only on Controller's documented instructions — the Terms, the settings Controller chooses, and this addendum.

2. Confidentiality and security

Personnel with access are bound to confidentiality. Measures include encryption in transit, encryption of stored third-party access tokens, row-level access controls isolating each customer's data, least-privilege service access with no shared administrative keys in the application, masking of all text and inputs in optional replays, and audit logs of exclusions.

3. Sub-processors

Supabase (database hosting, US), Netlify (application hosting and delivery), PayPal (customer billing only), and Google (only for Google features Controller connects). Processor will give 30 days' notice by email before adding or replacing a sub-processor; Controller may object and terminate.

4. Assistance

Processor will help Controller respond to data-subject requests, and with security, impact assessments and consultations, to the extent the information is available to Processor.

5. Incidents

Processor will notify Controller without undue delay, and within 72 hours, after becoming aware of a personal-data breach affecting Controller's data.

6. Retention and return

Raw visit events are kept 90 days and replays 30 days. On termination Processor will delete or return Controller's data within 30 days, except where law requires retention (for example, billing records).

7. International transfers

Data is processed in the United States. Where required, the parties rely on the EU Standard Contractual Clauses (Module 2) and the UK Addendum, incorporated by reference.

8. Audits

Processor will make available information reasonably needed to demonstrate compliance, and answer a reasonable security questionnaire once a year.

Need a countersigned copy? Email ryan@avakata.agency.