Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Metrone Inc. ("Processor", "we", "us") and you ("Controller", "Customer") and governs the processing of data through the Metrone analytics platform.

1. Scope and Roles

Under applicable data protection laws, the Customer acts as the data controller who determines the purposes and means of data processing by installing the Metrone tracking script on their website or application. Metrone acts as the data processor, processing data solely on behalf of and under the instructions of the Customer.

2. Types of Data Processed

Metrone processes the following categories of data on behalf of the Customer:

• Page view data — URLs, referrer URLs, UTM parameters
• Custom events — event names and properties defined by the Customer
• AI interaction events — AI feature usage metrics defined by the Customer
• Technical metadata — browser name/version, operating system, device type (parsed from User-Agent at the edge; raw string is discarded)
• Geographic data — country, region, and city (resolved at our edge network; no IP lookup service used)
• Daily-salted visitor hash — a SHA-256 hash of the IP address combined with a daily-rotating salt (raw IP address is never stored)

Metrone does not process names, email addresses, cookies, raw IP addresses, or any data that directly identifies an individual visitor.

3. Processing Purposes

We process data exclusively for the following purposes:

• Providing web analytics and AI feature tracking as described in our service documentation
• Generating aggregate statistics, dashboards, and reports for the Customer
• Maintaining, securing, and improving the Metrone platform
• Complying with legal obligations

We will not process Customer data for any purpose other than those listed above or as instructed by the Customer in writing.

4. Sub-Processors

Metrone engages the following sub-processors. We will notify the Customer at least 30 days before adding or replacing a sub-processor.

• Cloud infrastructure provider — Managed database hosting (United States)
• Edge compute provider — Edge processing, CDN, and geographic enrichment (Global — 275+ locations)
• Stripe, Inc. — Payment processing (United States)

Each sub-processor is bound by data protection obligations no less protective than those set out in this DPA.

5. Security Measures

Metrone implements the following technical and organizational measures:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• IP address hashing at the edge before data reaches our database
• Daily rotation of hashing salt to prevent cross-day visitor correlation
• Role-based access control with multi-factor authentication for infrastructure access
• Regular security reviews and dependency audits
• Logical data isolation between customers
• Automated backups with encrypted storage

6. Data Breach Notification

In the event of a confirmed personal data breach, Metrone will notify the Customer without undue delay and no later than 72 hours after becoming aware of the breach. The notification will include:

• A description of the nature of the breach, including categories and approximate volume of data affected
• The name and contact details of the Metrone point of contact
• A description of the likely consequences of the breach
• A description of measures taken or proposed to address the breach and mitigate its effects

7. Data Retention and Deletion

Analytics data is retained according to the Customer's subscription plan:

• Starter — 1 year
• Growth — 2 years
• Scale — 5 years

Upon termination of the Customer's account, Metrone will delete all Customer data within 30 days unless the Customer requests data export beforehand. The Customer may also request deletion of specific data sets at any time during the term of service.

8. Customer Rights and Assistance

Metrone will assist the Customer in fulfilling data subject requests (access, rectification, erasure, portability) to the extent technically feasible, taking into account the nature of the processing. Since Metrone does not store personal data, most individual data subject requests will not be applicable.

Metrone will also provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities where required.

9. International Data Transfers

Customer data is stored in managed databases located in the United States. Edge processing occurs at global edge locations. For transfers of data from the European Economic Area, United Kingdom, or Switzerland to the United States, the following safeguards apply:

• Standard Contractual Clauses (SCCs) as adopted by the European Commission are incorporated into this DPA by reference
• Our cloud infrastructure and edge compute providers maintain their own SCCs and supplementary measures for international transfers
• Because Metrone does not process personal data as defined by GDPR, the practical risk of international transfers is minimal

10. Audits and Compliance

Upon reasonable written request and no more than once per year, Metrone will make available information necessary to demonstrate compliance with this DPA. This may include summaries of security audits, certifications, or third-party assessment reports. On-site audits are available for Scale and Enterprise customers by mutual agreement.

11. Duration

This DPA remains in effect for the duration of the Customer's use of Metrone and continues until all Customer data has been deleted or returned in accordance with Section 7.

12. Conflict

In the event of a conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to data processing matters.

13. Contact

For questions about this DPA or to exercise your rights, contact us at hello@metrone.io.