Version of 6 November 2026

Data processing agreement

This agreement is part of the terms of service for every customer and sets out how stati processes visitor data on your behalf under Article 28 of the GDPR.

Roles

You, the website owner, are the controller of the data about the visitors of your website. stati ([Company name]) is the processor and acts only on your documented instructions, which are the settings of your account.

What is processed

Page views, referrers, campaign parameters, country and region, device, browser and operating system, events you configure, and a daily pseudonymous visitor hash. No IP addresses are stored, no cookies or other identifiers are placed in the visitor’s browser.

Our duties

We keep the data confidential, protect it with measures appropriate to the risk (encryption in transit, encrypted backups, access limited to named staff, servers in the European Union only), help you answer requests from data subjects, tell you without undue delay about any personal data breach, and delete the data when the contract ends.

Sub-processors

Hetzner Online GmbH (hosting, Germany and Finland), Amazon Web Services EMEA SARL (e-mail delivery), Stripe Payments Europe Ltd (payments, no visitor data), Anthropic PBC (weekly summaries from aggregate numbers only, if you turn them on). We will tell you by e-mail at least 30 days before adding a sub-processor; you may object by ending the contract.

Audits

We will answer your reasonable questions about our measures and make available the results of audits we commission. An on-site audit is possible once a year with 30 days’ notice, at your cost.

Duration

The agreement lasts as long as you use stati. At the end we delete all visitor data of your websites within 30 days, unless law requires us to keep it longer.