This addendum applies if you're in the European Economic Area, the United Kingdom or Switzerland, and adds to our Privacy Policy. Where the two differ, this addendum takes precedence for you.
Controller and processor
For our website and dashboard accounts, the controller is [Company name], [Registered address]. For identifications made on a customer's website, that customer is the controller and [Company name] processes data on their behalf, in line with Article 28 GDPR, under our data processing agreement, which applies to every customer whatever their plan. Customers' questions about it go to [privacy contact email].
Legal bases
| Purpose | Legal basis |
|---|---|
| Identifying devices and detecting fraud for customers | The customer's legitimate interest in preventing fraud and securing their service, or consent the customer collects |
| Protecting dashboard accounts | Our legitimate interest in keeping accounts secure |
| Providing the dashboard and billing | Performance of our contract with the customer |
| Creating your account and emailing you about it (verification, password resets, security notices) | Performance of our contract with you, and our legitimate interest in keeping accounts secure |
| Emailing an invite a teammate asked us to send | Our customer's legitimate interest in adding people to their project |
| Recording which dashboard pages are opened and which marked controls are clicked | Our legitimate interest in improving the dashboard |
| The live demo on our website | Your consent, given by starting the demo; you can withdraw it by clearing this site's data in your browser |
| Letting our support staff read a project's data | The customer's instruction, given by allowing support access for 12 hours at a time |
| Caching IP lookups for 90 days | The customer's legitimate interest in fraud prevention, and ours in not sending the same IP address to ipapi.is again |
| Meeting legal obligations | Legal obligation |
Reading information from a device or storing it there also falls under the ePrivacy rules (Article 5(3) of the ePrivacy Directive and the national laws that implement it), and the European Data Protection Board counts device fingerprinting as such access. Those rules allow it without consent only where it is strictly necessary for a service the user explicitly asked for. Whether identifying a browser meets that test depends on what the customer uses it for, on which pages, and on the law and the data protection authority's guidance in each member state. Identifying a browser while it logs in or pays is a different case from identifying every page view.
The customer decides this and is responsible for asking for consent where it is needed, before the agent starts. Our privacy and consent guide shows how to start the agent only after consent, or only on the pages that need it. Our own live demo reads and stores nothing until you start it; starting it is your consent.
International transfers
We host and store the service's data in the EU (Ireland). Two things reach outside the EEA: requests pass through the Amazon CloudFront edge location nearest to the visitor, which can be outside the EEA, on their way to Ireland; and Amazon Web Services and ClickHouse, Inc. can access the data they host from outside the EEA, for example for support. For both we rely on the providers' data processing agreements with the European Commission's Standard Contractual Clauses. The sub-processor list names every provider, its location and its transfer basis.
Your rights
You have the right to access your data, have it corrected or erased, restrict or object to its processing, and receive it in a portable format. Where we rely on consent, you can withdraw it at any time. We don't make decisions about you that produce legal or similarly significant effects based solely on automated processing; customers decide what to do with a risk score.
For data a customer controls, please contact that customer first; we'll help them answer. For data we control, write to [privacy contact email]. We answer within one month.
You can also complain to the data protection authority where you live or work.