Data Processing Agreement

This DPA forms part of the Agreement between EverConvert ("Processor") and the Customer ("Controller") and applies wherever EverConvert processes Personal Data on the Customer's behalf via the Revenue Tracking feature.

1. Roles

The Customer is the Controller; EverConvert is the Processor of the buyer/visitor Personal Data processed through Revenue Tracking. The Customer's payment platforms and automation tools (Zapier, n8n, etc.) operate under the Customer's own control.

2. Subject matter, nature & purpose

EverConvert processes Personal Data solely to provide revenue attribution: matching a buyer's purchase to the headline/variant the visitor saw, and reporting net revenue per variant. Processing is limited to this purpose and to the Customer's documented instructions (this DPA + the product configuration).

3. Categories of data & data subjects

Data subjects: the Customer's website visitors and buyers. Personal Data: a one-way HMAC hash of the email (no raw email stored at rest); order metadata (amount, currency, order id, timestamp); pseudonymous visitor identifiers. Raw email is transmitted in transit (on-page beacon + the Customer's payment webhook), hashed server-side, and discarded: never stored, logged, or placed in audit records.

4. Processor obligations

EverConvert will:

5. Security measures

6. Sub-processors

The Customer authorises the following sub-processors: Supabase (hosting, database and edge compute), Cloudflare (content delivery and bot filtering), Resend (transactional email) and Slack (internal operational alerting). The Customer's own connected tools (payment platforms, Zapier, n8n and similar) are engaged by the Customer, not EverConvert. EverConvert will give prior notice of any new sub-processor and a reasonable opportunity to object.

7. Data-subject rights & erasure

EverConvert will assist the Customer with data-subject requests and, on request, erase a specified buyer's data (by recomputed hash) and record a suppression marker so later events for that buyer aren't re-created.

8. Retention

Raw email is never stored. Visitor-level interaction records are retained for 30 days and then deleted automatically. Variant-assignment records are retained for 30 days after a test completes, subject to an overall 120-day cap. Aggregated, non-identifying results (counts, conversion rates, revenue totals per variant) are retained for as long as the Customer's account is active so historical test results remain available, and are deleted on request.

9. International transfers

Data is hosted with Supabase on Amazon Web Services infrastructure in Europe, with Cloudflare providing content delivery at the network edge. Any transfer outside the UK/EEA relies on an appropriate transfer mechanism (UK IDTA or EU Standard Contractual Clauses). The exact hosting region for the Customer's instance is available on request.

10. Audit

EverConvert will make available information reasonably necessary to demonstrate compliance (Art. 28(3)(h)), subject to reasonable notice and confidentiality.

11. General

This DPA takes effect when the Customer first activates Revenue Tracking and continues for as long as EverConvert processes Personal Data on the Customer's behalf. It forms part of, and is governed by, the Terms of Service, including their liability provisions and governing law. Where this DPA conflicts with the Terms of Service on the processing of Personal Data, this DPA prevails.