Data Processing Agreement

Roles

• You (customer): Data controller for personal data you collect about visitors to your sites and for your account data you choose to send into Clics.
• Clics: Data processor for visitor and related analytics data we process solely to deliver the Service under your instructions (including your project settings and this DPA).

Subject matter, duration, and purpose

• Subject matter: Providing the Clics analytics platform: collection, storage, aggregation, and presentation of usage metrics for properties you connect.
• Duration: For as long as you have an active subscription or account, plus a reasonable period afterward to wind down, backup rotation, and legal retention if required.
• Purpose: Operating the product you pay for, support, security, abuse prevention, and compliance with laws that apply to us as a processor.

Categories of data and data subjects

End users of your websites and apps are the primary data subjects for analytics processing. The types of data are those described in our Privacy Policy under end user collection (for example page paths, referrer, coarse device or browser hints, country derived from anonymized IP, and similar technical metrics). We do not intend to identify individuals as part of the analytics pipeline.

We also process personal data you provide as a customer (account and billing) to deliver the Service; that is covered in the Privacy Policy and may involve subprocessors listed below (for example Stripe for payments).

Our commitments

• Instructions: We process personal data only on documented instructions from you (these Terms, this DPA, and settings in the product), unless EU or Member State law requires otherwise.
• Confidentiality: We require personnel who access personal data to respect confidentiality, subject to applicable employment or engagement terms.
• Security: We implement appropriate technical and organizational measures appropriate to the risk, including encryption in transit where used for the Service, access control, and vendor review for critical infrastructure.
• Subprocessors: We may engage subprocessors to run the Service. You authorize use of the providers listed in the next section. We remain responsible for their performance of obligations under this DPA.
• Assistance: Taking into account the nature of processing, we will help you respond to data subject requests and comply with security, breach, and impact obligations where the GDPR or similar law requires your diligence, insofar as we can reasonably assist.
• Deletion: At the end of your use of the Service, we will delete or return personal data we process on your behalf in line with our Privacy Policy and product behavior, except where retention is required by law.

Subprocessors we use today

The Service relies on the following categories of providers. They act as subprocessors when they process personal data on our behalf.

• Convex: Application backend, database, and server-side logic for Clics dashboard and related product features.
• Cloudflare: Edge network, security, and related infrastructure (for example Workers, DNS, or tunnels) used to run or protect parts of the Service.
• Tinybird: Storage, querying, and analytics pipelines for event and metrics data that powers reports in the product.
• Stripe: Payment processing for subscriptions and customer billing records.
• WorkOS: Authentication, sign-in, and user and organization management for Clics dashboard and related account features.
• Resend: Transactional email delivery for product and account communications (for example digests, invitations, or billing-related notices).

Your responsibilities

• Lawful basis and notices: You are responsible for a lawful basis and transparent privacy notices for your end users, including describing Clics as a processor where appropriate.
• Instructions: Do not configure the Service to collect special categories of data or other unnecessary personal data through the analytics tag or APIs.
• Requests: End users typically contact you first. We will assist with requests that relate to data we hold as your processor when you ask us in writing and we can reasonably identify the relevant data.

Personal data breach

If we become aware of a personal data breach affecting data we process for you, we will notify you without undue delay and provide information reasonably necessary for you to meet your regulatory duties. Timelines may follow applicable law (for example within 72 hours where the GDPR requires our joint assessment).

Audits

On reasonable written notice and no more than once per year (unless required by a regulator or a serious incident), you may request information necessary to verify our compliance with this DPA, such as summaries of controls or certifications. If you require an onsite or extensive audit, we may charge for our time at reasonable rates and will coordinate to limit disruption.

Liability

Liability arising from processing under this DPA is subject to the limitations and exclusions in our Terms of Use, unless mandatory law provides otherwise.

Governing terms

This DPA supplements and is part of our agreement with you. If there is a conflict between this DPA and the Terms of Use regarding data protection as a processor, this DPA prevails to that extent.

Contact

For questions about this Data Processing Agreement:

contact@clics.dev