Data processing

Last updated 3 September 2026

These terms apply whenever OriginStat processes personal data on your behalf. They form part of the terms of service and need no separate signature — though if your procurement process needs a countersigned copy, write to support@originstat.com and you will get one.

1. Roles

For the traffic you measure, you are the controller and [[ LEGAL ENTITY ]] is the processor. We process it only on your documented instructions, of which using the product as designed is one. For your own account data we are the controller, and the privacy policy covers that.

2. What is processed

Subject matter	Measuring and attributing traffic to your websites.
Duration	For as long as your account is open, plus the retention below.
Nature and purpose	Collection, storage, aggregation and display of website analytics.
Data subjects	Visitors to the websites you have added.
Personal data	Page and referrer URLs including campaign parameters; approximate location at country and region level; browser, operating system and device type; window width; time on page; a daily-rotating pseudonymous identifier. Where you connect a payment provider, a customer reference and order value supplied by that provider.
Special categories	None. The terms forbid sending them, and we ask you to keep them out of URLs and event names.

We do not store IP addresses or user agent strings. They are hashed in memory with a secret and the current date, and only a truncated digest is retained — see the privacy policy for the mechanism.

3. Our obligations

We process only on your instructions, and will tell you if an instruction appears to breach the law.
Everyone with access is bound by confidentiality.
We keep the measures in section 5, and will not weaken them.
We help you answer data subject requests, run impact assessments, and consult regulators, so far as is reasonable.
We notify you without undue delay, and in any case within 48 hours, of a breach affecting your data.
On request we delete or return your data when this agreement ends, except where retention is legally required.
We make available what you need to demonstrate compliance, and will accept an audit on reasonable notice, at most once a year unless a regulator asks for more.

4. Sub-processors

You give general authorisation for these, and we will give 30 days' notice before adding another, which you may object to on reasonable grounds:

Sub-processor	Purpose	Location
Cloudflare, Inc.	Compute, database, analytics storage, CDN	Global edge network
Resend (Plus Five Five, Inc.)	Transactional email	United States
Polar Software, Inc.	Payments and subscription management	United States

5. Security measures

These are the measures actually in place, not a wish list:

TLS on every connection, in transit and at rest with our host.
Passwords stored as PBKDF2-SHA256 at 600,000 iterations with a per-user salt, and compared in constant time.
Optional TOTP two-factor authentication with single-use recovery codes.
Connected payment provider credentials encrypted with AES-GCM under a key held separately from the session secret, with a random IV per record.
Visitor identifiers derived from a secret salt that rotates every day, so they cannot be linked across days or across sites.
Rate limiting on authentication and ingest, origin checks on every state-changing request, and site keys scoped to a single domain.
Access to production limited to those who need it, over authenticated channels.

6. Retention

Individual events are kept for 90 days. Aggregates — daily counts by page, source, country and device, which identify nobody — are kept for as long as the account is open, so your history does not evaporate. Deleting a site deletes both. Closing your account deletes everything within 30 days, backups included.

7. International transfers

Where data leaves the UK or EEA, it goes to sub-processors covered by the EU Standard Contractual Clauses and the UK Addendum, together with the additional measures each publishes. Our host processes at the edge closest to the visitor; the analytics store and database are configured for [[ CONFIRM PRIMARY REGION ]].

8. Liability

The limits in the terms of service apply to this agreement too. Where these terms conflict with those, these take precedence for anything concerning personal data.

9. Contact

Data protection enquiries: support@originstat.com. Our representative for these purposes is [[ DPO OR REPRESENTATIVE, IF REQUIRED ]].