Data Processing Agreement

This agreement is between you (the "Customer") and JAMP. For personal data contained in the analytics we collect from your websites ("Visitor Data"), you are the controller and JAMP is your processor. JAMP processes Visitor Data only to provide the service and only on your documented instructions, which your configuration of the service and these terms provide. Where the GDPR applies, this section meets the requirements of Article 28.

Subject matter and duration: processing lasts for as long as you use the service. Purpose: providing website analytics, monitoring and the related features you enable. Nature:collection, storage, aggregation and display of the data described below.

Types of data: by design JAMP is built to avoid personal data. We set no cookies and store no IP addresses; uniqueness is counted with a daily-rotating, one-way hash. The data we hold is page paths, referring domains, browser, operating system, device type, approximate country, and any custom events you choose to send. If you send identifiers or other personal data through custom events, that becomes Visitor Data you are responsible for under section 8.

Data subjects: the visitors to your websites.

• process Visitor Data only on your instructions, and tell you if we believe an instruction breaks data protection law;
• keep the data confidential and ensure anyone who processes it is bound by confidentiality;
• apply appropriate technical and organisational security measures (section 5);
• help you, as far as we reasonably can, to respond to data subject requests and to meet your own obligations around security, breach notification and impact assessments;
• delete or return Visitor Data at the end of the agreement, as set out in section 7.

You give us general authorisation to use the sub-processors below to deliver the service. We remain responsible for their performance, and we impose data protection terms on them no less protective than these. We will give you notice of any intended change so you have a chance to object on reasonable data protection grounds.

We keep Visitor Data in the EU: analytics events on dedicated servers at Hetzner in Germany, and the account database on Supabase in the EU. Traffic is served over TLS. Visitor identity is one-way hashed with a rotating secret and no raw IP is retained. Error messages and stack traces are scrubbed of emails, tokens and long numbers before storage. Access to production data is limited to those who need it. We review these measures as the service evolves.

Visitor Data is stored in the EU. A limited set of operational sub-processors (payments, email, single sign-on) may process data in the United States. Where they do, transfers are covered by the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

You can export your data as CSV and delete a site or your whole account at any time from the dashboard. When you do, or when this agreement ends, we delete the associated Visitor Data within 30 days, unless we are legally required to keep limited records. Backups age out on our normal cycle.

You confirm you have a lawful basis to collect the Visitor Data through JAMP and to instruct us to process it, that your own site carries the privacy information your visitors are owed, and that if you send any data that identifies a person through custom events you have obtained any consent that applies. You are the point of contact for your visitors' data subject requests; we will help you respond.

We will make available the information reasonably needed to show we meet our obligations under this agreement, and will notify you without undue delay after becoming aware of a personal data breach affecting Visitor Data, with the detail you need to meet your own notification duties.

If anything in this DPA conflicts with the rest of our Terms of Service on the processing of Visitor Data, this DPA wins. Everything else in the terms still applies. Questions go to support@jamp.io.