Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms between you ("Controller") and [Company name] ("Processor") and applies when we process personal data of your website visitors on your behalf.

1. Subject matter

Processing of visitor data for the Proof Ledger: tracking-link clicks, page views of pages we published for you, and (optional) snippet events and Stripe payment events.

2. Nature and purpose

Counting and attributing visits, signups and payments to your steps, and showing them to you.

3. Data and data subjects

Visitors to your links, pages and website. Data: daily-rotating hashes of IP and user agent, referrer domain, UTM tags, landing path, timestamps, email hashes (only if you call go.identify), payment amounts (only with optional Stripe).

4. Duration

For the life of your subscription plus 30 days, then deletion.

5. Processor obligations

We process only on your documented instructions (these Terms and your settings); keep personnel bound by confidentiality; apply the security measures in our Privacy Policy; assist with data-subject requests through export and delete tools; notify you without undue delay, and within 72 hours where feasible, of a personal-data breach; delete or return data at the end of the service; and make available information needed to show compliance.

6. Sub-processors

You authorise the sub-processors listed on the Sub-processors page. We will give 14 days' notice of changes by email; you may object and cancel.

7. Transfers

Standard Contractual Clauses (Module 2 or 3) apply to transfers outside the EEA, UK or Israel where needed.

8. Your obligations

You are responsible for having a lawful basis and giving notice to your visitors, and, in the EU, EEA and UK, for collecting consent before calling go.consent(true).