Data Processing Addendum

In force from 10 November 2026.

1. Parties and roles

This addendum is between the operator of Analytics House ("we", the processor) and the customer who accepted the Terms ("you", the controller). It covers personal data about visitors to your websites and apps that we process when providing the Service ("Customer Personal Data"). Words such as "personal data", "processing" and "personal data breach" have the meaning given in the UK GDPR. Where the EU GDPR applies to your processing, references to the UK GDPR include the EU GDPR. If this addendum and the Terms conflict on data protection, this addendum wins.

2. Instructions

We process Customer Personal Data only on your documented instructions, unless UK law requires otherwise (in which case we will tell you first, unless the law forbids it). Your instructions are the Terms, this addendum, and the settings and requests you make through the dashboard and API. We will tell you if we believe an instruction breaks data protection law.

3. Confidentiality

Everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality.

4. Security

We apply the technical and organisational measures in Annex 2, which are designed to give a level of security appropriate to the risk. We may improve them, but will not reduce the overall level of protection.

5. Sub-processors

You give general authorisation for us to use sub-processors. The current ones are listed in Annex 3. We impose data protection obligations on each of them equivalent to this addendum, and we remain responsible to you for their performance. We will give at least 30 days' notice by e-mail before adding or replacing a sub-processor. If you object on reasonable data protection grounds, we will try to resolve it with you; if we cannot, you may close the affected projects or your account before the change takes effect.

6. Helping you

• Requests from individuals. The dashboard and API let you export and delete data, filter by page or event, and shorten retention. If an individual contacts us directly, we will pass the request to you without answering it ourselves. Visitor ids rotate daily and cannot be linked to an IP address once the day is finalised, so it is often not possible to find a particular person's data.
• Security, impact assessments and regulators. Taking into account the nature of the processing and the information we have, we will give you reasonable help to meet your obligations on security, data protection impact assessments and consultation with a supervisory authority.

7. Personal data breaches

We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We will give you the information we have about its nature, likely consequences and the measures taken, update you as we learn more, and take reasonable steps to contain it. Notifying you is not an admission of fault.

8. International transfers

Customer Personal Data is stored in Cloudflare D1 in the European Union. Requests from your visitors are handled in the Cloudflare data centre nearest to them, which may be outside the UK and the EU. Where a transfer outside the UK is restricted, it is made under a valid safeguard: adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, or the Information Commissioner's International Data Transfer Addendum to the EU standard contractual clauses.

9. Deletion at the end

When you delete a project or your account, or the Terms end, we delete the related Customer Personal Data from the live system immediately. You can export it first from the dashboard. Copies in the database's point-in-time recovery are overwritten within 30 days. We do not keep a copy unless UK law requires it.

10. Information and audits

We will make available the information reasonably needed to show that we meet Article 28 of the UK GDPR, including answers to security questionnaires. Once a year, or after a personal data breach or at a regulator's request, you may audit our compliance (yourself or through an independent auditor bound by confidentiality) with at least 30 days' written notice, at your own cost, without access to other customers' data. For the infrastructure operated by Cloudflare, you agree to rely on Cloudflare's published certifications and audit reports.

11. Your responsibilities

You confirm that you have a lawful basis for the processing, that your privacy notice tells visitors about it, that you comply with the rules on storing or accessing information on visitors' devices (in the UK, the Privacy and Electronic Communications Regulations), and that you will not instruct us to process special category data or data that directly identifies people.

12. Liability and duration

Each party's liability under this addendum is subject to the limits in the Terms, except where the law does not allow them to apply. This addendum lasts as long as we process Customer Personal Data for you.

Annex 1: Details of the processing

• Subject matter and purpose: producing privacy-preserving web analytics, performance and error statistics for your websites and apps, and the reports, alerts, exports and answers you request.
• Nature: collection at Cloudflare's network edge, removal of identifiers, pseudonymisation, storage, aggregation, retrieval, export and deletion.
• Duration: the term of the Terms, plus the deletion period in section 9. Within that, data is kept for the retention period you set for each project (365 days by default).
• Data subjects: visitors to and users of your websites and apps.
• Personal data: daily-rotating pseudonymous visitor and session ids (hashes of the IP address, user-agent, date and a secret that is deleted daily; the IP address and user-agent themselves are not stored); page paths without query strings; referrer domain; country, and region and city if you enable them; browser, operating system and device type; campaign (UTM) tags; event names and properties, revenue amounts, performance timings and JavaScript error messages that you choose to send, after automatic removal of e-mail addresses, long numbers and tokens; if you turn on click maps, daily counts of clicks per page element (described by tag names and positions only, never text or values) and where inside the element they landed; and a user id if you send one, which we hash when it looks like an e-mail address or UUID.
• Special category data: none. You must not send it.

Annex 2: Security measures

• Encryption in transit (TLS) for every connection, and encryption at rest in the database.
• No storage of IP addresses or full user-agents; a daily random secret for visitor ids, deleted once the day is finalised; automatic removal of common personal data patterns before storage.
• Optional zero-raw-history mode, geographic detail switches and k-anonymity thresholds you control per project.
• Passwords hashed with PBKDF2-SHA256 (100,000 iterations); two-factor authentication (TOTP) with encrypted secrets; account lockout against password guessing; rate limits on sign-in, data collection and public endpoints.
• Role-based access for team members, with personal fields hidden from viewers; read-only API keys stored as hashes; revocable share links.
• Each project's data is separated by project id in every query; access is checked on every request.
• Production access limited to the people who run the Service, using accounts protected by two-factor authentication.
• Operational logs exclude IP addresses, e-mail addresses and secret tokens; Cloudflare's automatic request logs are switched off.
• Database point-in-time recovery for 30 days, and an automated end-to-end test suite covering access control, tenant isolation and the privacy protections above.

Annex 3: Sub-processors

Alerts and reports you send to Slack, Discord, webhooks or e-mail addresses go to destinations you choose; those providers act for you, not for us. Questions: privacy@analytics.house. The operator of Analytics House.