Data Processing Agreement

1. Parties

This Data Processing Agreement ("DPA") is entered into between:

• Controller: the natural or legal person who creates an XPmetric account and installs the tracking script on a website they operate ("Customer"); and
• Processor: Stefan Rosanitsch, Kriegerdankstr. 14, 96450 Coburg, Germany (trading as XPmetric), email privacy@xpmetric.com — see also the Impressum.

Acceptance is recorded in-app (Settings → General → Legal & compliance) with a timestamp and this version string (2026-10-06). Creating an account and using the Service also incorporates this DPA by reference from the Terms of Service and Privacy Policy.

2. Subject matter, duration, nature and purpose

Subject matter: processing of personal data relating to visitors of Customer websites on which the XPmetric tracking script (p.js / p.cookie.js) is installed, and related derived analytics, gamification state and alerts.

Nature: collection via HTTP ingest, storage in ClickHouse and PostgreSQL, aggregation, display in the Customer dashboard, optional alerts and share cards. Processing is automated.

Purpose: to provide web analytics and related product features to the Customer as described in the product documentation. The Processor does not determine the purposes of visitor analytics — the Customer does.

Duration: for the term of the Customer's XPmetric subscription / account, and thereafter until deletion or return as set out in § 10. Analytics events in ClickHouse are subject to a two-year TTL in addition to account-level deletion.

3. Categories of data subjects and personal data

Data subjects: visitors of Customer websites (and, where enabled, authors of public social posts that mention a Customer domain — see Annex I).

Personal data: the categories listed in Annex I (mirroring the ClickHouse events columns and related stores). In the default cookieless mode, visitor identity is a daily-rotating salted hash; raw IP addresses are not retained in the analytics databases.

4. Documented instructions (Art. 28(3)(a))

The Processor processes personal data only on documented instructions from the Customer, unless required to do so by Union or Member State law to which the Processor is subject. In that case the Processor informs the Customer of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

Documented instructions for the purposes of this DPA are: (i) the configuration the Customer makes in the XPmetric product (sites, tracking mode, goals, funnels, integrations, retention via account deletion); (ii) this DPA; and (iii) written instructions the Customer sends to privacy@xpmetric.com. The Processor shall immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data-protection provisions.

5. Confidentiality (Art. 28(3)(b))

Persons authorised to process personal data on behalf of the Processor are committed to confidentiality or are under an appropriate statutory obligation of confidentiality. Access to production systems is limited as described in Annex II.

6. Security of processing (Art. 28(3)(c) / Art. 32)

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, the Processor implements the technical and organisational measures described in Annex II — Technical and Organisational Measures. Measures are reviewed as product and infrastructure change; material gaps are listed there as planned rather than claimed.

7. Sub-processors (Art. 28(2), 28(3)(d), 28(4))

The Customer provides general written authorisation for the Processor to engage sub-processors. The current list is published in Annex III — Sub-processors.

The Processor shall inform the Customer of any intended change concerning the addition or replacement of an Art. 28 sub-processor at least 30 days in advance by email to every affected Customer account. This 30-day period is a term of this DPA. The Customer may object in writing within that period. If the objection cannot be resolved, the Customer may terminate the affected services as set out in the Terms.

Where the Processor engages a sub-processor, it imposes the same data-protection obligations as set out in this DPA, by way of contract or other legal act under Union or Member State law. The Processor remains fully liable to the Customer for the sub-processor's performance of those obligations.

8. Assistance with data-subject rights (Art. 28(3)(e))

Taking into account the nature of the processing, the Processor assists the Customer by appropriate technical and organisational measures, insofar as possible, for the fulfilment of the Customer's obligation to respond to requests for exercising the data subject's rights under Chapter III GDPR. Visitors should contact the Customer (site operator) first; the Processor will support the Customer on written request to privacy@xpmetric.com.

9. Assistance with Arts. 32–36 (Art. 28(3)(f))

The Processor assists the Customer in ensuring compliance with obligations pursuant to Articles 32 to 36 GDPR (security, breach notification, data-protection impact assessment and prior consultation), taking into account the nature of processing and the information available to the Processor. Personal-data breaches affecting Customer visitor data will be notified to the Customer without undue delay after the Processor becomes aware of them.

10. Deletion or return (Art. 28(3)(g))

At the choice of the Customer, the Processor deletes or returns all personal data after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage.

The Customer can export account data from Settings and request site, analytics or account deletion. Deletion jobs retry until ClickHouse events, imported daily aggregates and crawler hits are verified empty, before finalising the corresponding PostgreSQL deletion. Site-scoped email-to-visitor links are removed and user-linked error logs are deleted during account erasure. Encrypted backup copies expire under the backup schedule. Any restoration must reconcile completed erasures before collection resumes. The retention matrix and remaining receipt-retention gaps are documented in Annex II and the internal processing record.

11. Audit rights (Art. 28(3)(h))

The Processor makes available to the Customer all information necessary to demonstrate compliance with the obligations in Art. 28 GDPR and this DPA, and allows for and contributes to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer. Audits are scheduled with reasonable notice, during business hours, and in a manner that does not compromise the security or confidentiality of other customers. The Processor may satisfy audit requests in the first instance by providing up-to-date documentation (this DPA, Annex II, Annex III, and relevant policies).

12. International transfers

Analytics data at rest is stored on servers in Germany (Hetzner). Transfers to sub-processors outside the EEA (notably Cloudflare at the edge, and other Annex III recipients where applicable) rely on Standard Contractual Clauses and/or the EU–US Data Privacy Framework as disclosed on /subprocessors and in the Privacy Policy.

13. Liability and precedence

Liability under this DPA follows the Terms of Service, except where mandatory data-protection law provides otherwise. In case of conflict between this DPA and the Terms regarding processing of personal data, this DPA prevails.

Annex I — Categories of personal data

Primary store: ClickHouse table pulse.events (2-year TTL).

• site_id — Customer site identifier
• event_type, timestamp
• url, path, referrer
• utm_source, utm_medium, utm_campaign
• visitor_hash — pseudonymous daily ID (cookieless) or client ID (cookie mode)
• session_id
• country, city, region, lat, lng
• browser, os, device_type
• event_name, event_value
• revenue_amount, revenue_currency

Related: pulse.crawler_hits (bot traffic: path, URL, user agent, country, classification; 2-year TTL). Postgres may hold attributed PaymentEvent rows (visitor hash, session, referrer, landing path, country) and, when mention tracking is enabled, public X post metadata (handle, name, excerpt of up to 280 characters, tweet ID and likes). Optional email-based payment attribution stores site-scoped HMAC links for 30 days after their last capture. Raw email is not stored by that link feature. Imported GA4 data is stored as daily aggregates, separately from observed visitor events. Growth evidence and experiment records may include search queries, public-page URLs, prompt identifiers and measured outcomes.

Raw visitor IP addresses are used transiently at ingest for hashing and geo lookup and are not stored in ClickHouse or Postgres. The XPmetric reverse-proxy site blocks remove visitor IPs and Authorization headers from their access logs. Other products on the shared proxy have separate logging policies.

Annex II — Technical and organisational measures

See /dpa/toms.

Annex III — Sub-processors

See /subprocessors.

Contact

Privacy questions: privacy@xpmetric.com · Contact form