Data processing agreement

We process personal data to provide emberbee's analytics service to you. This agreement lasts as long as we process personal data for you, and ends when your account and its data are deleted.

We collect events from the emberbee script on your sites, store them, and show you totals and breakdowns. We process the data only to provide the service. We do not use it for our own purposes, sell it, or use it for advertising.

Data subjects: visitors of the sites where you install the emberbee script.

Personal data: a visitor id that changes every day, page paths, referring host names, UTM values, country, region, and city, preferred language, browser, operating system, device type, event times, and any event properties you send. The visitor id is a salted hash of the site, IP address, and user agent. We use the IP address and user agent to compute it, and do not store them.

Special categories: none. You must not send special category data, or data that identifies a visitor directly, in page paths, event names, or event properties.

• We process personal data only on your documented instructions. These terms, your settings, and your use of the dashboard are your instructions. We tell you if we think an instruction breaks data protection law.
• Everyone we authorize to process the data is bound by confidentiality.
• We tell you without undue delay after we become aware of a personal data breach that affects your data, with the information you need to meet your own obligations.

You authorize us to use the subprocessors on our subprocessors page. Each one is bound by data protection terms that are at least as protective as this agreement. Before we add or replace a subprocessor, we update that page and email you. You can object within 30 days. If we cannot address your objection, you can end the agreement by deleting your account. We remain responsible for our subprocessors.

We keep these technical and organizational measures in place:

• Data minimization. We never store visitor IP addresses, full user agents, full URLs, or query strings other than UTM values.
• Pseudonymization. Visitor ids are hashes salted with a secret that changes every day, so they cannot be linked across days or sites.
• Encryption in transit. All traffic to emberbee uses HTTPS.
• Access control. Only the members of a site can see its data. Every dashboard page and data request checks the signed-in user and their role on the site.
• Authentication. Sign-in uses one-time email codes, stored only as hashes and valid for 10 minutes, or Google or GitHub sign-in.
• Secrets such as database credentials are kept in the hosting provider's environment settings, not in source code.

We store data in the United States. For transfers of personal data from the EU or EEA, the European Commission's Standard Contractual Clauses (Module Two, controller to processor) apply and are part of this agreement. For the UK and Switzerland, the UK International Data Transfer Addendum and the Swiss adaptations of the clauses apply. If the clauses conflict with this agreement, the clauses win.

We help you respond to requests from data subjects, and with data protection impact assessments and consultations with supervisory authorities, as far as the nature of the processing allows. The dashboard lets you export a site's events as CSV and delete events for a date range or for a whole site. If a data subject contacts us directly, we pass the request to you.

When you delete a site, we delete its events. When you delete your account, we delete it and every site you own with all of its events. Deletion takes effect right away in our database. Copies in our database provider's backups expire on that provider's schedule. We do not keep copies of your data after the agreement ends, unless the law requires us to.

We meet audit requests with written information: this agreement, the subprocessors list, the security measures in section 6, and answers to a reasonable security questionnaire. You may send one questionnaire a year, and we answer it within 30 days.

We allow an inspection only when a data protection authority requires one. It takes place with 30 days' notice, during business hours, at your own cost, and the inspector must agree to keep what they learn confidential.

The liability limits in the terms of service apply to this agreement. If this agreement and the terms conflict on data protection, this agreement wins.

Write to support@emberbee.app with any question about this agreement.