Data Processing Agreement

Last updated: October 17, 2026

This Data Processing Agreement ("DPA") is incorporated into and forms part of the Pieowl Terms of Service between Yevhen Shcherbynskyi, trading as Aioomi, Aleje Jerozolimskie 141, 02-351 Warszawa ("Pieowl", "we", "us") and the customer ("Controller", "you"). It applies where Pieowl processes personal data on your behalf as part of the Pieowl Cloud service.

1. Definitions

• GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council.
• Controller means you, the customer, who determines the purposes and means of processing.
• Processor means Pieowl, who processes data on your behalf.
• Personal Data, Processing, Data Subject, and Supervisory Authority have the meanings given in the GDPR.
• Sub-processor means any third party engaged by Pieowl to process Personal Data in connection with the service.

2. Our approach to privacy

Pieowl is built to minimize personal data collection by design. We do not use cookies for analytics tracking. We do not store IP addresses. Instead, we create a pseudonymous visitor identifier using a one-way hash of the visitor's user agent, IP address and website, combined with a secret salt. A new salt is created every day and only the two newest salts are kept. The IP address is not stored, and once a salt is deleted, the identifiers made with it can no longer be recreated.

The data we store per event is:

• Page URL and referrer
• Browser name and version
• Operating system name and version
• Device type, brand, and model
• Approximate location: country, region, city and approximate coordinates (derived from the IP address at the time of the request; the IP address is not stored)
• Custom event properties you choose to send

No cookies and no cross-site tracking.

Pieowl is designed so that standard website tracking collects as little personal data as possible. Some of the data above may still be personal data under the GDPR, for example the visitor identifier or custom properties you send. This DPA covers all Personal Data we process on your behalf.

User identification (optional feature)

If you choose to identify your users, Pieowl stores the user ID and any profile details you send (for example a name or email address). You decide which details to send.

Session replay (optional feature)

Pieowl optionally supports session replay, which must be explicitly enabled by the Controller. When enabled, session replay records DOM snapshots and user interactions (mouse movements, clicks, scrolls) on the Controller's website. This data is stored against the session identifier and may incidentally capture personal data visible in the page (for example, a logged-in user's name displayed in the UI). All text content and form inputs are always masked and the Controller cannot turn this off. The Controller is responsible for ensuring their use of session replay complies with applicable privacy law, including providing appropriate notice to end users. The Controller can also block whole elements from recordings via the SDK configuration.

AI features

Pieowl offers AI features, such as natural-language questions about the Controller's analytics data. When the Controller's users ask a question, the prompt and the relevant analytics data (which can include event, session and profile data) are sent to an AI provider (OpenAI or Anthropic), as a sub-processor for the sole purpose of generating the requested response. Some AI features also run in the background, for example to summarize detected insights or to write the weekly email digest. These send aggregated statistics and insight summaries to the same AI provider.

3. Scope and roles

Pieowl acts as a Processor when processing data on behalf of the Controller. You act as the Controller for the analytics data collected from visitors to your websites and applications.

4. Processor obligations

Pieowl commits to the following:

• Process Personal Data only on your documented instructions and for no other purpose.
• Ensure that all personnel with access to Personal Data are bound by appropriate confidentiality obligations.
• Implement and maintain technical and organizational measures in accordance with Section 7 of this DPA.
• Not engage a Sub-processor without your prior general or specific written authorization and flow down equivalent data protection obligations to any Sub-processor.
• Assist you, where reasonably possible, in responding to Data Subject requests to exercise their rights under GDPR.
• Notify you without undue delay (and no later than 48 hours) upon becoming aware of a Personal Data breach.
• Make available all information necessary to demonstrate compliance with this DPA. Audits by you or your designated auditor are limited to one per 12-month period (unless required by a supervisory authority or following a confirmed Personal Data breach), require 30 days' prior notice, are conducted under confidentiality, at your cost, and without unreasonable disruption to operations. Documentary requests in lieu of on-site audits will be accommodated where they provide equivalent assurance.
• At your choice, delete or return all Personal Data upon termination of the service.

5. Your obligations as Controller

You confirm that:

• You have a lawful basis for the processing described in this DPA.
• You have provided appropriate privacy notices to your end users.
• You are responsible for the accuracy and lawfulness of the data you instruct Pieowl to process.

6. Sub-processors

Pieowl uses the following sub-processors to deliver the service. All sub-processors are either located within the European Economic Area or provide adequate safeguards under GDPR Chapter V (for example, Standard Contractual Clauses).

We will inform you of any intended changes to this list (additions or replacements) with reasonable notice, giving you the opportunity to object.

7. Technical and organizational measures

Pieowl implements the following measures under GDPR Art. 32:

Data minimization and anonymization

• IP addresses are never stored. They are used only to derive an approximate location and to create a pseudonymous visitor identifier.
• Daily-rotating secret salts mean visitor identifiers can no longer be recreated once their salt is deleted.
• No cookies are used for analytics tracking.

Access control

• Dashboard access is protected by authentication and role-based access control.
• Production systems are accessible only to authorized personnel.

Encryption and transport security

• All data is transmitted over HTTPS (TLS).

Infrastructure and availability

• Data is hosted in the European Union (EU).
• Regular backups are performed.

Incident response

• We maintain procedures for detecting, reporting, and investigating Personal Data breaches.
• In the event of a breach affecting your data, we will notify you within 48 hours of becoming aware.

8. International data transfers

Analytics data is stored in the European Union (EU).

Transfers to other countries may occur in the following cases:

• Transactional email (via Resend, United States) — necessary to deliver account, billing, and product communications to the Controller's authorized users.
• AI features (via OpenAI and Anthropic, United States) — the relevant prompt and analytics data are sent to the AI provider for processing.
• Payments and billing (via Stripe, Ireland and United States) — necessary to process subscription payments and invoices.

Where Personal Data is transferred outside the European Economic Area to a country without an adequacy decision, the transfer is governed by the EU Standard Contractual Clauses (Commission Decision (EU) 2021/914) executed with each sub-processor, providing the adequate safeguards required under GDPR Chapter V.

9. Data retention and deletion

Analytics events are retained while your account is active, for the retention period of your plan: 3 years on Starter and 5 years on Growth. If we change these periods, we will notify all customers in advance.

Ended trials and plans: if a free trial or a paid plan ends without a new paid plan, we stop collecting events and permanently delete the analytics data of your sites 7 days after it ends. We email you before the deletion.

Session replays are retained for 30 days and then permanently deleted.

You can delete individual sites, all associated data, or your entire account at any time from within the dashboard. Upon account termination we will delete your data within 30 days unless we are required by law to retain it longer.

10. Governing law

This DPA is governed by the laws of Poland and is interpreted in accordance with the GDPR.

11. How to execute this DPA

Using Pieowl Cloud constitutes acceptance of this DPA as part of our Terms of Service.

If your organization requires a signed copy for your records of processing activities, you can download a printable version below. Fill in your company details and sign it.

Download printable DPA

Contact

For questions about this DPA or data protection at Pieowl:

• Email: hello@pieowl.com
• Company: Yevhen Shcherbynskyi, trading as Aioomi, Aleje Jerozolimskie 141, 02-351 Warszawa, Poland