Data Processing Agreement
The terms under which PilotFox processes your visitors' personal data for you as your processor, under GDPR Article 28: data, purposes, security, subprocessors and deletion.
This Data Processing Agreement ("DPA") is part of the Terms of Service between you, the customer, and us, PilotFox ("we"). It applies whenever we process personal data for you in providing PilotFox at pilotfox.app. In it, the words of the GDPR (Regulation (EU) 2016/679) have their GDPR meaning; "GDPR" also means the UK GDPR where it applies. If this DPA and the Terms disagree on personal data, this DPA prevails.
Roles
You are the controller of the personal data PilotFox collects for you (the "customer data"). We are your processor. Where you act as a processor for someone else, we are your subprocessor and you pass on their instructions to us.
We are the controller of the data about your account holders that we need to run their accounts; our Privacy Policy covers it.
Subject matter, duration, nature and purpose
- Subject matter: providing PilotFox, the web and product analytics service, to you.
- Duration: as long as you use PilotFox, and until the customer data is deleted as described under Deletion or return.
- Nature: collecting events from your websites, apps and servers; computing visitor ids, sessions and locations; storing, analysing and showing the data in reports; exporting and erasing it; importing your payments and Search Console data; recording sessions where you turn session replay on; sending the notifications you set up.
- Purpose: giving you analytics about your websites and apps, as you configure them in PilotFox.
Types of personal data
What PilotFox collects depends on your settings and on what you send. It can include:
| Category | Data |
|---|---|
| Request data, never stored | The visitor's IP address, used while a request is processed and then dropped. |
| Visitor and session | A visitor id (a hash, different on every site), a random session id, and the user id you pass to identify. |
| Page | Time, host name, path, query string (as your settings allow), page title, referrer, campaign parameters, channel, affiliate. |
| Location | Country, continent, region, city, time zone, coordinates rounded to two decimal places (about 1 km), network (ASN and its name) and whether it belongs to a data centre, looked up from the IP address. |
| Device | Browser and its major version, operating system and its version, device type, screen size, language; for requests from bots, the user agent. |
| Events | Their names and the properties you send; the properties of the automatic events you turn on (clicks, forms, fields, copies: never field values or copied text); for JavaScript errors their message, stack trace, file, line and column; web vitals. |
| Identified users | The traits you send (up to 4 KB per user), including an email address if you send one, and which visitor ids belong to which user. |
| Session recordings | Where you turn session replay on: how pages changed and how the visitor moved, clicked and scrolled, with inputs masked by default and passwords always. |
| Payments | Where you connect Stripe, Dodo Payments or Polar, or send payments through the API: each payment's id, amount, currency, refunds and status, the provider's customer id, the visit it is linked to, and the buyer's email only with Store customer emails on. |
| Affiliates | The name and referral code of each affiliate you add. |
You must not send special categories of data (GDPR Art. 9), data about criminal convictions, passwords or payment card numbers to PilotFox, in events, traits, user ids or page addresses.
Data subjects
Visitors of your websites and apps, your users you identify, buyers whose payments you import or send, and your affiliates.
Your instructions
We process customer data only on your documented instructions: the Terms, this DPA, and what you set and do in PilotFox, in the dashboard or through its API. We do not process it for our own purposes. If a law requires us to process it otherwise, we will tell you first, unless that law forbids it. If we think an instruction infringes the GDPR or another data protection law, we will tell you.
Confidentiality
Everyone we allow to process customer data is bound to confidentiality.
Security
We take the technical and organisational measures of GDPR Art. 32. PilotFox is built with these:
- No stored IP addresses. IP addresses are used in memory and dropped; visitor ids are hashes keyed with a secret per site; rate limits and sign-in sessions keep only keyed hashes of addresses.
- Encryption in transit. pilotfox.app is served over HTTPS only, with HSTS.
- Secrets. Passwords are hashed with scrypt. API keys, share-link and affiliate-portal tokens, proxy secrets, email verification tokens and sign-in codes are stored as hashes. Payment-provider keys, Google tokens and Slack and Discord webhook addresses are encrypted with AES-256-GCM; two-factor secrets and sign-in tokens from Google or GitHub are encrypted too.
- Access control. Members have one of five roles and can be limited to some sites; sessions, user ids, query strings and buyers' emails are shown only to roles that may read sessions. API keys carry only the permissions and sites they are given. Two-factor authentication is available to every account, and a one-time code works only once.
- Isolation. Only the web server is reachable from the internet; the databases are on private networks. Reports and exports read the analytics database as a read-only user.
- Accounts and requests. Sign-in, sign-up, emails, data collection and API keys are rate-limited; session cookies are HttpOnly, Secure and SameSite=Lax; requests that change data are checked against their origin.
- Logs. The web server writes no access log. The application's logs name each request by its route, never its address, and leave out IP addresses; email addresses, traits, passwords, tokens and keys are redacted.
- Session replay. Inputs are masked by default and passwords always; hidden and file inputs, CSRF tokens and canvas content are never recorded.
- Backups. Database backups go to file storage and are deleted after 30 days.
We may change these measures if the level of security does not decrease.
Subprocessors
You give us general authorisation to engage subprocessors. Subprocessors lists the kinds we use and the data each receives; we name the current ones, and where they process data, on request at hello@pilotfox.app. We will tell you of any intended addition or replacement before it takes effect, by email to your organization's owners, so that you can object. If you object on reasonable data protection grounds and we cannot resolve it, you may stop using PilotFox and delete your data.
We bind each subprocessor by contract to data protection obligations at least as protective as this DPA's, and we remain responsible to you for their performance.
Services you connect yourself (your payment provider, Google Search Console, Slack, Discord, AI assistants over MCP) are not our subprocessors: you choose them, we send them or fetch from them what you set up, and your own terms with them apply.
Helping you with people's requests
PilotFox lets you answer most requests yourself: the Users report and the API show an identified user's profile, traits, sessions and events; Delete user data and the API erase them; Site settings → Import & export downloads a site's raw events; pilotfox.optOut() and Global Privacy Control stop tracking a browser (see Handling people's requests). Where these are not enough, we will help you on request, as far as we can.
Breaches and other help
We will tell you without undue delay after becoming aware of a personal data breach affecting customer data, with the information GDPR Art. 33(3) asks for as it becomes available, and help you meet your duties under Art. 32 to 36 (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to us.
Deletion or return
You can return and delete the customer data yourself at any time:
- Export: Site settings → Import & export, or the API, downloads a site's raw events as JSON Lines, up to 400 days at a time.
- Delete a person: Delete user data erases one identified user's data from a site.
- Delete a site: an owner or admin deletes it in Site settings. It stops accepting data at once; a background job then erases all its events, bot requests, session recordings, identity links, user profiles, imports, payments and subscriptions, connections, goals, funnels, segments, annotations, share links, affiliates and settings, and runs again an hour later for anything that arrived late.
- Delete an organization: an owner deletes it, and all its sites are erased the same way.
- Delete your account: Account → Delete account also deletes the organizations you are the only member of, and their sites are erased the same way.
When you stop using PilotFox, delete your sites, organizations or account, or ask us to at hello@pilotfox.app. Copies in backups are deleted when the backups expire, 30 days after they were made. We keep customer data longer only where a law requires us to.
Audits
We make available to you the information needed to demonstrate compliance with GDPR Art. 28, and allow for and contribute to audits, including inspections, by you or an auditor you mandate, on reasonable notice.
International transfers
Where we or a subprocessor process customer data outside the European Economic Area or the UK, we rely on an adequacy decision or on standard contractual clauses, and we will tell you on request which applies.
Liability, term and changes
Liability under this DPA follows the Terms of Service. This DPA lasts as long as we process customer data for you. We will publish any change to it on this page, with its date, and tell your organization's owners by email before a change that affects them applies.
Contact
PilotFox, hello@pilotfox.app: for data protection questions, notices under this DPA and objections.