Data Processing Agreement

This agreement applies automatically whenever you use GeckoStats to process personal data of people in the UK or the EEA. You do not have to sign or request it: accepting the Terms of Service accepts this, and it forms part of them.

It is written to meet Article 28 of the UK and EU GDPR. If your organisation needs a countersigned copy on paper, write to the address on our contact page and we will sign one.

You are the controller of the personal data your websites generate. GeckoStats is the processor, acting only on your instructions. Where we decide things ourselves, which is your own account and your own subscription, we are the controller instead and the Privacy Policy covers it.

Subject matter and purpose: providing website analytics and revenue attribution for the websites you add.

Duration: for as long as the website exists in your account, and no longer than the agreement between us.

Categories of data subject: visitors to your websites, and, where your payment provider sends them, your customers.

Types of personal data: an identifier derived as described in the Privacy Policy; pages viewed and the referrer that brought the visit; approximate location to roughly a kilometre; browser, operating system and device type; events and goals you configure; and, where you choose to supply them, a user id or email address through identify() or a link parameter. Where you connect a payment provider, the amount, the currency, the time, whether it was a renewal or a refund, and the customer id, email address and name as your payment provider sends them.

Not included: we ask you not to send special category data under Article 9, criminal offence data, or the data of children, and the service is not designed to hold any of it.

We process this data only to provide the service, to keep it secure and running, and where a law we are subject to requires something else, in which case we tell you first unless that law forbids it.

We do not sell it, use it for our own advertising, pool it into benchmarks or industry reports, or use it to train machine learning models. We will tell you if we believe an instruction of yours breaks data protection law.

Everyone with access is bound by confidentiality. Access is limited to the people who need it to run or support the service, and it is removed when they no longer do.

We implement appropriate technical and organisational measures under Article 32. They are listed in the annex at the end of this document, and each one is a statement about what the software does rather than an intention.

You give general authorisation for the sub-processors listed in the Privacy Policy, which is the current list and is kept up to date there. Each is bound by terms no less protective than these.

We will publish any new or replacement sub-processor on that page before it starts processing, giving you time to object. If you object on reasonable data protection grounds and we cannot offer an alternative, you may terminate and we refund the unused part of your period.

The service runs on Cloudflare’s global network, and several sub-processors are established in the United States, so personal data may be processed outside the UK and the EEA.

Where it is, the transfer relies on the European Commission’s Standard Contractual Clauses together with the UK Addendum, or on an adequacy decision where one covers the recipient, plus the measures in the annex. Because no IP addresses are stored and the visitor identifier cannot be reversed once the day’s secret is deleted, what crosses a border is already a long way from identifying anyone.

We help you meet your own obligations, taking into account the nature of the processing and what we have: answering a data subject’s request to see, correct, delete or port their data; data protection impact assessments; and consultations with a supervisory authority.

Most of it you can do yourself and faster. A visitor’s data can be found and deleted from the dashboard, and deleting a website removes everything it holds at once.

If we become aware of a personal data breach affecting your data we notify you without undue delay and in any case within 48 hours, with what we know: what happened, which categories and roughly how many records, the likely consequences, and what we are doing about it. We keep you updated as we learn more.

You can delete a website, or your whole account, at any time from your own settings, and that is immediate and irreversible.

When the agreement between us ends, we delete your data. Backups taken by our infrastructure provider roll off on their own schedule and are never restored selectively to bring deleted data back.

On reasonable written request, and no more than once a year unless an authority requires otherwise, we provide the information needed to show we meet this agreement and we answer a security questionnaire. Where that is not enough for your obligations, we will agree an audit with you that does not compromise the confidentiality or security of other customers.

• No raw IP addresses. An address exists for the length of one hash and is never written to storage. The visitor identifier is sha256(daily salt + site id + IP + User-Agent), the salt is 32 fresh random bytes every UTC day, and salts older than two days are deleted. Once a salt is gone nobody can recompute that day’s identifiers from an address, us included.
• Encryption in transit and at rest. Every connection is HTTPS with HSTS. The database is encrypted at rest by Cloudflare. Search Console refresh tokens are encrypted with AES-GCM before they are written, under a key that is not in the database.
• Separation by account. Every query for a website is scoped to its owner. An API or MCP key is issued per website and reads only that website; revoking it ends that access immediately.
• Authentication. Sign-in is by Google, GitHub or a one-time emailed link. There are no passwords to leak. Sign-in links are stored only as a SHA-256 hash, work once, and expire after fifteen minutes. Session cookies are signed, HttpOnly and SameSite=Lax.
• Rate limiting. Sign-in, sign-in links and their redemption are rate limited per address and per network, so neither an account nor an inbox can be hammered from this service.
• An end date, not an archive. When a plan or a trial ends and is not renewed, the account and everything it collected are deleted 30 days later, automatically. The date is shown on the billing page from the day access ends, so nobody is surprised by it.
• Deletion that actually deletes. Deleting a website removes its events, visitors, payments, funnels, goals and connections in one transaction. Deleting an account does that for every website it owns and then removes the account. Neither is a flag; the rows are gone.
• Least data by default. Cookieless is the default. Global Privacy Control and Do Not Track are honoured both in the browser and again in the collector. Sensitive-looking query parameters are removed in the browser, before the address is sent.