Data Processing Addendum
Draft: provided for information until legal review is complete.
This Data Processing Addendum ("DPA") is part of the terms of use. It applies when you use seops Analytics on a site you added to seops, and to any other case in which seops processes personal data on your behalf and on your instructions. It is written to meet Article 28 GDPR and the processor rules of the Turkish Personal Data Protection Law (KVKK). Questions: contact@seops.app.
1. Parties and roles
- Customer (you): the account holder who adds a site to seops and installs the seops Analytics script on it. For the visitor data collected on that site you are the controller.
- seops (we): the operator of app.seops.app and i.seops.app. For that data we are your processor.
- For your own account data (e-mail address, sites, settings, billing) seops remains the controller; that processing is described in the privacy policy and is not covered by this DPA.
2. Subject matter, nature and purpose
Collecting page views and events from your site through a script, deriving aggregated statistics (visitors, sessions, pages, sources, countries, devices, events) and showing them to you in the dashboard, over the API and over the MCP connection you authorise. seops does not use the data for any other purpose, in particular not for advertising, profiling, cross-site tracking or training AI models.
3. Duration
From the first hit received for a site (or, for summary data imported from GA4, from the import) until the site or your account is deleted, plus the deletion period in section 11.
4. Categories of data and data subjects
| Data | Form in which it is processed |
|---|---|
| IP address | Used only in memory, during the request, to derive country, region and city and to compute the daily visitor hash. Never stored. |
| Browser user agent | Used only in memory to derive browser and operating system family and to filter known crawlers, and as an input of the daily hash. Never stored. |
| Daily visitor hash | SHA-256 of (daily salt, IP address, user agent, site key), first 16 hex characters. Different every day; cannot be reversed or recomputed once the salt is deleted. |
| Page path, referrer, UTM parameters, hostname, language, screen width class, time on page, scroll depth | The script sends the path without the query string; from the query only UTM tags, the presence (not the value) of an ad click ID and the site-search parameter you allow with data-search are sent and stored. |
| Country, region, city | Derived from the IP address by Cloudflare at the edge; stored as names. |
| Events you define | Name and up to 8 short properties, stored as you send them. You undertake not to send personal data in them (section 7). |
| Summary data imported from GA4 | Only if your site is linked to a Google Analytics 4 property when you switch it to seops Analytics: seops reads the property's daily aggregated reports through the Google Analytics Data API, with the read access you granted, from the property's creation date to the day before the first seops hit. Stored are daily totals and per-day counts by page, landing page, source and medium, country, city, device category, browser, operating system, language, hostname, UTM tags and event name. No visitor-level data, identifiers, IP addresses or user agents are read or stored. Days that seops measured itself are never overwritten. |
Data subjects: visitors of your site. Special categories of data: none are intended; do not send any.
5. Processing on documented instructions
seops processes the data only on your documented instructions. Your instructions are: these terms and this DPA, the settings you choose in the dashboard (additional hostnames, site-search parameter, goal events, source selection) and the events your site sends. If we believe an instruction infringes data protection law, we tell you. We will not process the data for our own purposes, except aggregated, non-personal usage figures (such as the monthly page view count per site) needed to run and bill the service.
6. Confidentiality
Only people who need access to operate the service have it, and they are bound by confidentiality obligations. Raw hits are not read by people in the ordinary course of operation; they are queried in aggregate.
7. Your obligations
- You install the script only on sites you own or are authorised to manage.
- You decide whether your site needs a consent banner or other legal basis under the law that applies to you, and you inform your visitors about the measurement, for example with the sentence in the privacy policy.
- You do not send personal data in event names, event properties or page paths (no e-mail addresses, names, account IDs, free text). If it happens, you tell us and we help remove it.
- You respond to data subject requests from your visitors; see section 9.
8. Security measures
- Transport encryption (TLS) between the visitor's browser, i.seops.app and the dashboard.
- Raw IP address and user agent are never written to storage or logs; only the daily hash and derived, coarse values are kept.
- The daily salt is generated with a cryptographic random number generator, stored in the database, used only on its own day (Turkey time, UTC+3) and deleted two days after that day ends (daily job at 00:05 Turkey time); after deletion the hash of a past day cannot be recomputed.
- Hits whose hostname does not match the site's domain or your additional hostnames are discarded without being written.
- Known crawlers are marked and excluded from visitor counts.
- Dashboard access requires Google sign-in; data is shown only to the workspace that verified ownership of the domain. Administrative access to the platform sits behind Cloudflare Access with per-request token verification.
- Database and storage are hosted by Cloudflare, encrypted at rest by the provider; nightly backups are kept on Cloudflare R2.
- Parameterised queries, same-origin write checks and request limits throughout the service.
9. Assistance with data subject requests
Because seops Analytics keeps no identifier that links hits to a person, neither you nor we can find one visitor's hits from a name, e-mail address or IP address. If a visitor exercises a right with you, we help you answer within a reasonable time with a description of the processing and this DPA; where a request can technically be fulfilled (for example deleting all data of a site), we do so on your instruction. Requests that reach us directly are forwarded to you without undue delay.
10. Personal data breach
If we become aware of a personal data breach affecting your data, we notify you by e-mail to the account address without undue delay and, where feasible, within 72 hours of becoming aware, with the information we have at that time (nature of the breach, categories and approximate number of records, likely consequences, measures taken) and we update it as we learn more. The notification is not an admission of fault.
11. Deletion and return
- Raw hits are kept for 90 days and then expire automatically.
- Daily summaries (counts and top lists, no visitor hashes) are kept for as long as the site exists in your account.
- When you delete a site or your account, or when these terms end, all data of the site is deleted within 30 days, including backups by rotation, except what we must keep by law.
- Before deletion you can export the reports from the dashboard or over the API.
12. Subprocessors
You authorise the subprocessors listed on the subprocessors page. For seops Analytics the only subprocessor is Cloudflare, Inc. (hosting, edge network, Analytics Engine, D1, R2). We impose data protection obligations on subprocessors that are no less protective than this DPA, and we remain responsible for their performance. We announce a new or replaced subprocessor by e-mail to the account address at least 30 days before it starts processing your data; if you object on reasonable data protection grounds and we cannot offer an alternative, you may stop using seops Analytics and delete the site, and the deletion rules in section 11 apply.
13. International transfers
Cloudflare runs a global network, so hits are received at the edge location closest to the visitor and stored in Cloudflare's infrastructure, which includes the United States. Transfers out of the EU/EEA and the United Kingdom rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) in Cloudflare's data processing terms, plus Cloudflare's participation in the EU-US Data Privacy Framework where applicable. For customers subject to KVKK, transfers abroad require one of the bases in Article 9 KVKK (adequacy decision, appropriate safeguards such as the standard contract published by the Personal Data Protection Board, or, in the limited cases allowed, explicit consent); the exact instrument seops offers for Türkiye will be confirmed after legal review.
14. Audit and records
On request, no more than once a year unless a supervisory authority requires it or a breach occurred, we provide the information reasonably needed to demonstrate compliance with this DPA: this document, the subprocessor list, a description of the security measures and the relevant Cloudflare compliance documentation. An on-site audit is possible only where the law requires it, at your cost, with at least 30 days' notice and without access to other customers' data. We keep a record of processing activities for this service.
15. Liability and precedence
The liability rules of the terms of use apply to this DPA. Where this DPA and the terms conflict on data protection, this DPA prevails. Where mandatory law gives a data subject or a party more rights than this DPA, the law applies.
16. Changes
If we update this DPA we change the date above and announce significant changes in the dashboard and by e-mail. Continued use of seops Analytics after the effective date means acceptance of the updated DPA.
Annex: sentence for your privacy notice
This site uses seops Analytics for visit statistics: no cookies are set, the IP address is hashed with a salt that changes daily and is not stored, and no visitor identifier is kept. Details: seops.app/legal/privacy
Bu site ziyaret istatistikleri için seops Analytics kullanır: çerez kullanılmaz, IP adresi günlük değişen bir tuzla özetlenir ve saklanmaz, ziyaretçi kimliği tutulmaz. Ayrıntı: seops.app/legal/privacy