Data Processing Agreement

1. Definitions

• GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council.
• Controller means the customer, who determines the purposes and means of processing.
• Processor means Pieowl, who processes data on the Controller's behalf.
• Personal Data, Processing, Data Subject, and Supervisory Authority have the meanings given in the GDPR.
• Sub-processor means any third party engaged by Pieowl to process Personal Data in connection with the service.

2. Our approach to privacy

Pieowl is built to minimize personal data collection by design. We do not use cookies for analytics tracking. We do not store IP addresses. Instead, we create a pseudonymous visitor identifier using a one-way hash of the visitor's user agent, IP address and website, combined with a secret salt. A new salt is created every day and only the two newest salts are kept. The IP address is not stored, and once a salt is deleted, the identifiers made with it can no longer be recreated.

The data we store per event is:

• Page URL and referrer
• Browser name and version
• Operating system name and version
• Device type, brand, and model
• Approximate location: country, region, city and approximate coordinates (derived from the IP address at the time of the request; the IP address is not stored)
• Custom event properties the Controller chooses to send

No cookies and no cross-site tracking. Pieowl is designed so that standard website tracking collects as little personal data as possible. Some of the data above may still be personal data under the GDPR, for example the visitor identifier or custom properties the Controller sends. This DPA covers all Personal Data Pieowl processes on the Controller's behalf.

User identification (optional feature)

If the Controller chooses to identify its users, Pieowl stores the user ID and any profile details the Controller sends (for example a name or email address). The Controller decides which details to send.

Session replay (optional feature)

Pieowl optionally supports session replay, which must be explicitly enabled by the Controller. When enabled, session replay records DOM snapshots and user interactions (mouse movements, clicks, scrolls). All text content and form inputs are always masked and the Controller cannot turn this off. The Controller is responsible for ensuring their use of session replay complies with applicable privacy law, including providing appropriate notice to end users.

AI features

Pieowl offers a few AI features. When the Controller's users type a request into the AI filter, the request and the analytics data needed to understand it (event names, top pages, countries and traffic sources) are sent to an AI provider (OpenAI or Anthropic), as a sub-processor for the sole purpose of turning it into filters. Some AI features also run in the background, for example to summarize detected insights or to write the weekly email digest. These send aggregated statistics and insight summaries to the same AI provider. If the Controller connects its own AI assistant to Pieowl over MCP, that assistant's provider is chosen by the Controller and is not a sub-processor of Pieowl.

3. Scope and roles

Pieowl acts as a Processor when processing data on behalf of the Controller. The Controller is responsible for the analytics data collected from visitors to their websites and applications.

4. Processor obligations

Pieowl commits to the following:

• Process Personal Data only on the Controller's documented instructions and for no other purpose.
• Ensure that all personnel with access to Personal Data are bound by appropriate confidentiality obligations.
• Implement and maintain technical and organizational measures in accordance with Section 7 of this DPA.
• Not engage a Sub-processor without prior general or specific written authorization and flow down equivalent data protection obligations to any Sub-processor.
• Assist the Controller, where reasonably possible, in responding to Data Subject requests to exercise their rights under GDPR.
• Notify the Controller without undue delay (and no later than 48 hours) upon becoming aware of a Personal Data breach.
• Make available all information necessary to demonstrate compliance with this DPA. Audits by the Controller or their designated auditor are limited to one per 12-month period (unless required by a supervisory authority or following a confirmed Personal Data breach), require 30 days' prior notice, are conducted under confidentiality, at the Controller's cost, and without unreasonable disruption to operations. Documentary requests in lieu of on-site audits will be accommodated where they provide equivalent assurance.
• At the Controller's choice, delete or return all Personal Data upon termination of the service.

5. Controller obligations

The Controller confirms that:

• They have a lawful basis for the processing described in this DPA.
• They have provided appropriate privacy notices to their end users.
• They are responsible for the accuracy and lawfulness of the data they instruct Pieowl to process.

6. Sub-processors

Pieowl uses the following sub-processors to deliver the service:

Pieowl will inform the Controller of any intended changes to this list with reasonable notice, giving the Controller the opportunity to object.

7. Technical and organizational measures

8. International data transfers

Analytics data is stored in the European Union (EU).

Transfers to other countries may occur in the following cases:

• Transactional email (via Resend, United States) — necessary to deliver account, billing, and product communications to the Controller's authorized users.
• AI features (via OpenAI and Anthropic, United States) — the relevant prompt and analytics data are sent to the AI provider for processing.
• Payments and billing (via Stripe, Ireland and United States) — necessary to process subscription payments and invoices.

Where Personal Data is transferred outside the European Economic Area to a country without an adequacy decision, the transfer is governed by the EU Standard Contractual Clauses (Commission Decision (EU) 2021/914) executed with each sub-processor, providing the adequate safeguards required under GDPR Chapter V.

9. Data retention and deletion

• Analytics events are retained while the Controller's account is active, for the retention period of the Controller's plan: 3 years on Starter and 5 years on Growth. If these periods change, all customers will be notified in advance.
• Ended trials and plans: if a free trial or a paid plan ends without a new paid plan, Pieowl stops collecting events and permanently deletes the analytics data of the Controller's sites 7 days after it ends. The Controller is notified by email before the deletion.
• Session replays are retained for 30 days and then permanently deleted.
• The Controller can delete individual sites, all associated data, or their entire account at any time from within the dashboard. Upon account termination, Pieowl will delete the Controller's data within 30 days unless required by law to retain it longer.

10. Governing law

This DPA is governed by the laws of Poland and is interpreted in accordance with the GDPR.