Data processing
Last updated 25 September 2026
These terms apply whenever OriginStat processes personal data on your behalf. They form part of the terms of service and need no separate signature, though if your procurement process needs a countersigned copy, write to support@originstat.com and you will get one.
1. Roles
For the traffic you measure, you are the controller and OriginStat is the processor. We process it only on your documented instructions, of which using the product as designed is one. For your own account data we are the controller, and the privacy policy covers that.
2. What is processed
| Subject matter | Measuring and attributing traffic to your websites. |
|---|---|
| Duration | For as long as your account is open, plus the retention below. |
| Nature and purpose | Collection, storage, aggregation and display of website analytics. |
| Data subjects | Visitors to the websites you have added. |
| Personal data | Page and referrer URLs including campaign parameters; approximate location at country and region level; browser, operating system and device type; window width; time on page; a daily-rotating pseudonymous identifier. Where you connect a payment provider, a customer reference and order value supplied by that provider. |
| Special categories | None. The terms forbid sending them, and we ask you to keep them out of URLs and event names. |
We do not store IP addresses or user agent strings. They are hashed in memory with a secret and the current date, and only a truncated digest is retained. See the privacy policy for the mechanism.
3. Our obligations
- We process only on your instructions, and will tell you if an instruction appears to breach the law.
- Everyone with access is bound by confidentiality.
- We keep the measures in section 5, and will not weaken them.
- We help you answer data subject requests, run impact assessments, and consult regulators, so far as is reasonable.
- We notify you without undue delay, and in any case within 48 hours, of a breach affecting your data.
- On request we delete or return your data when this agreement ends, except where retention is legally required.
- We make available what you need to demonstrate compliance, and will accept an audit on reasonable notice, at most once a year unless a regulator asks for more.
4. Sub-processors
You give general authorisation for these, and we will give 30 days' notice before adding another, which you may object to on reasonable grounds:
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Compute, database, analytics storage, CDN | Global edge network |
| Resend (Plus Five Five, Inc.) | Transactional email | United States |
| Polar Software, Inc. | Payments and subscription management | United States |
5. Security measures
These are the measures actually in place, not a wish list:
- TLS on every connection, in transit and at rest with our host.
- Passwords stored as PBKDF2-SHA256 at 600,000 iterations with a per-user salt, and compared in constant time.
- Optional TOTP two-factor authentication with single-use recovery codes.
- Connected payment provider credentials encrypted with AES-GCM under a key held separately from the session secret, with a random IV per record.
- Visitor identifiers derived from a secret salt that rotates every day, so they cannot be linked across days or across sites.
- Rate limiting on authentication and ingest, origin checks on every state-changing request, and site keys scoped to a single domain.
- Access to production limited to those who need it, over authenticated channels.
6. Retention
Individual events are kept for 90 days. Aggregates (daily counts by page, source, country and device, which identify nobody) are kept for as long as the account is open, so your history does not evaporate. Deleting a site deletes both. Closing your account deletes everything within 30 days, backups included.
7. International transfers
The database holding your account, your sites and your rolled-up history runs in Western Europe, so that data does not leave the EEA at rest. Analytics events are written at the edge closest to the visitor, which is how a tag stays fast, and are aggregated back into that same European database.
OriginStat itself is established in the United States, and access to that European database from the United States is a transfer in its own right, as is the processing done by the two sub-processors above that operate from there. All of it is covered by the EU Standard Contractual Clauses and the UK Addendum, together with the additional measures each sub-processor publishes.
Saying so plainly matters more than it costs us: the storage location and the access location are different questions, and a policy that answers only the flattering one is the kind a regulator reads twice.
8. Liability
The limits in the terms of service apply to this agreement too. Where these terms conflict with those, these take precedence for anything concerning personal data.
This agreement is governed by the laws of the State of Delaware, United States. Any dispute will be resolved exclusively in the courts of the State of Delaware. Nothing here removes a data subject's right to bring a claim, or to complain to a supervisory authority, where the law gives them one regardless of this clause.
9. Contact
Data protection enquiries: support@originstat.com. No data protection officer is appointed; OriginStat's processing does not meet the threshold in Article 37 that would require one. Enquiries go to the address above and reach a person.