Data Processing Agreement.
pursuant to Art. 28(3) GDPR · Regulation (EU) 2016/679
Version 1.4 · Published 9 July 2026 · Amended 9 August 2026, 14 October 2026, 16 October 2026 and 21 October 2026 · Incorporated into the Main Agreement; no signature required.
Controller
The customer identified in the Main Agreement who operates a shop or digital property on the Apex platform (the "Controller")
Processor
Drip Trading GmbH, Kolpingstraße 32, 83278 Traunstein, Germany, operator of Apex, an A/B-testing and experimentation platform (the "Processor")
The Controller and the Processor (each a "Party", together the "Parties") have entered into an agreement for the use of the Apex platform (the "Main Agreement"). In performing the Main Agreement, the Processor processes personal data on behalf of the Controller. This Data Processing Agreement (the "DPA") sets out the Parties' obligations under Art. 28 GDPR and forms an integral part of the Main Agreement. In the event of conflict between this DPA and the Main Agreement with respect to the processing of personal data, this DPA prevails.
1. Subject Matter and Duration.
1.1 The subject matter of this DPA is the processing of website visitor interaction data by the Processor on behalf of the Controller for the purpose of delivering and analysing A/B tests and experiments on the Controller's digital properties via the Apex platform, including the heatmap, session replay, channel attribution and page performance features the Controller enables, and, where the Controller uses AI-assisted features, Controller-submitted storefront page content, prompts, screenshots and generated experiment content.
1.2 This DPA applies for the term of the Main Agreement. It terminates automatically upon termination or expiry of the Main Agreement, without prejudice to obligations that by their nature survive termination (in particular Section 11).
2. Nature and Purpose of Processing.
2.1 The processing comprises the collection, storage, aggregation, analysis and deletion of visitor interaction data, in particular:
- assigning visitors of the Controller's online shop to experiment variations (bucketing);
- measuring exposures, pageviews and click events attributable to experiments;
- measuring conversion events, including order identifier, order amount and currency, for the purpose of computing experiment results;
- attributing visits to the traffic channel through which visitors arrived;
- recording click positions, scroll depth and pointer movement for heatmaps and, where the Controller enables session replay for an experiment, recording page interactions as replay sessions;
- measuring storefront page performance (web vitals) and the timing of the Apex SDK.
2.2 The purposes of the processing are (a) the delivery, measurement and statistical evaluation of experiments configured by the Controller, including heatmaps, session replay, channel attribution and page performance measurement, and (b) where the Controller uses AI-assisted features (including the Apex Operator experiment builder, landing-page generation, QA audit, behaviour summaries and heatmap element naming), the processing of Controller-submitted page content, prompts and screenshots, and of the analytics data those features summarise, by the sub-processors listed in Annex 1 solely to provide those features. The Processor does not process the data for its own purposes, does not build cross-site profiles and does not sell or share the data with third parties other than the sub-processors listed in Annex 1.
3. Categories of Personal Data.
3.1 The processing concerns the following categories of data:
- pseudonymous visitor identifiers (randomly generated, no linkage to identity data);
- session identifiers;
- URLs of pages visited on the Controller's properties, referrer and campaign (UTM) parameters;
- device and browser type;
- country (coarse geolocation);
- order identifier, order amount and currency of conversion events;
- only where the visitor has given marketing consent, as signalled by the Controller's consent tool: advertising click identifiers (gclid, gbraid, wbraid, fbclid, ttclid, msclkid, li_fat_id, epik, ScCid, twclid) and advertising cookie values (_fbp, _fbc, _gcl_aw, _ttp), used solely to attribute visits to traffic channels;
- heatmap interaction data: click and viewport coordinates, scroll depth, a pointer dwell grid, and the clicked element's CSS selector, tag, accessible name and up to 80 characters of its visible text (never the content of form fields);
- page performance data (web vitals) and Apex SDK timing;
- custom event properties the Controller sends with its own events (limited in size; values of keys that indicate credentials, such as passwords or tokens, are redacted);
- where the Controller enables session replay for an experiment: recordings of page structure, visible page text, pointer movement, clicks, scrolling and navigation (Section 3.3).
3.2 As part of visitor analytics, the Processor expressly does not collect names, e-mail addresses, postal addresses, telephone numbers or payment data, and does not intentionally collect special categories of personal data within the meaning of Art. 9 GDPR. Apex separately processes merchant user names and e-mail addresses for account administration, authentication and team invitations, and its AI features may process merchant prompt text and merchant-provided storefront content that may contain personal data. The Controller shall configure its use of the platform so that it does not transmit personal data beyond what is necessary for the configured service.
3.3 Session replay is off by default and is enabled by the Controller per experiment for a sample of sessions. Recordings mask all form inputs, exclude checkout pages and payment and checkout fields, and mask elements marked as customer data. Because replay records the visible text of the page, a recording may contain personal data that the Controller's pages display, for example the name of a logged-in customer. The Controller shall mark further elements that display personal data for masking (data-drip-replay-mask) or blocking (data-drip-replay-block) before enabling replay.
4. Categories of Data Subjects.
The data subjects concerned by the processing are (a) visitors of the Controller's online shop and other digital properties on which the Controller deploys the Apex platform; (b) where the Controller uses AI-assisted features, the Controller's users who submit prompts and other content to those features; and (c) individuals whose personal data appears in the storefront page content or screenshots the Controller submits to those features.
5. Instructions of the Controller.
5.1 The Processor processes personal data only on documented instructions from the Controller, including with regard to transfers to a third country, unless required to do so by Union or Member State law to which the Processor is subject; in such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
5.2 The Main Agreement, this DPA and the Controller's configuration of the platform (experiments, goals, targeting, retention settings) constitute the Controller's complete instructions at the time of acceptance. Additional instructions must be given in writing or in a documented electronic format.
5.3 The Processor shall inform the Controller without undue delay if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions, and may suspend execution of the instruction until it is confirmed or amended.
6. Confidentiality.
The Processor ensures that all persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they process the data only on instruction. The confidentiality obligation survives termination of the respective engagement.
7. Security of Processing.
7.1 The Processor implements and maintains appropriate technical and organisational measures pursuant to Art. 32 GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risks for the rights and freedoms of natural persons. The measures in place as of the version date of this DPA are described in Annex 2.
7.2 The Processor may update the measures in Annex 2 provided the level of protection is not reduced overall.
8. Sub-processors.
8.1 The Controller grants the Processor general written authorisation to engage sub-processors. The sub-processors engaged as of the version date of this DPA are listed in Annex 1.
8.2 The Processor shall inform the Controller of any intended addition or replacement of sub-processors at least 30 days in advance in writing or by e-mail to the Controller's designated contact. The Controller may object to the change on reasonable data protection grounds within that period. If the Parties cannot resolve an objection in good faith, either Party may terminate the Main Agreement with respect to the affected services with reasonable notice.
8.3 The Processor imposes on each sub-processor, by way of contract, data protection obligations essentially equivalent to those set out in this DPA. Where a sub-processor fails to fulfil its data protection obligations, the Processor remains fully liable to the Controller for the performance of that sub-processor's obligations.
9. Assistance with Data Subject Rights.
9.1 Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Controller's obligation to respond to requests for exercising data subject rights under Chapter III GDPR.
9.2 In particular, deletion and export of the analytics data associated with a given pseudonymous visitor identifier are available to the Controller via the Processor's documented API. The Processor executes such deletion or export requests within 30 days of receipt.
9.3 If a data subject contacts the Processor directly, the Processor shall forward the request to the Controller without undue delay and shall not respond on the merits unless instructed by the Controller or required by law.
10. Personal Data Breach Notification.
The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach affecting personal data processed under this DPA. The notification shall, to the extent then known, describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects. The Processor shall reasonably assist the Controller in fulfilling its obligations under Art. 33 and 34 GDPR.
11. Deletion and Return of Personal Data.
Upon termination of the Main Agreement, the Processor shall, at the choice of the Controller, delete or return all personal data processed on behalf of the Controller and delete existing copies, unless Union or Member State law requires storage of the personal data. Absent an election by the Controller within 30 days of termination, the Processor will delete the data. Deletion shall be confirmed to the Controller in writing upon request.
12. Audit and Information Rights.
12.1 The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Controller or an independent third-party auditor mandated by the Controller and bound by confidentiality. Auditors who are competitors of the Processor are excluded.
12.2 Audit requests shall be made with reasonable advance notice (at least 14 days, except following a personal data breach), during regular business hours, no more than once per calendar year unless required by a supervisory authority, and in a manner that does not unreasonably disrupt the Processor's operations. The Processor may first satisfy audit requests by providing current certifications, audit reports or other suitable documentation.
13. International Transfers.
13.1 The primary database is hosted by Supabase in AWS region eu-west-1, Ireland, European Union. Experiment analytics are stored and aggregated by Tinybird in Google Cloud region europe-west2, London, United Kingdom. That transfer is covered by the European Commission's UK adequacy decision, Commission Implementing Decision (EU) 2025/2574 of 19 December 2025 amending Implementing Decision (EU) 2021/1772, in force until 27 December 2031. The transfer to Tinybird Inc. in the United States is covered separately by the Standard Contractual Clauses stated in Annex 1. Session replay recordings are stored in Cloudflare R2 with the location hint Eastern Europe; the applicable mechanism is stated in Annex 1.
13.2 Where sub-processors are entities established in the United States or process personal data outside the EU/EEA, transfers are based on an adequacy decision pursuant to Art. 45 GDPR — in particular the EU-U.S. Data Privacy Framework for certified recipients — to the extent the certification covers the data categories concerned — and/or on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914, Module 2 or Module 3, as applicable), including supplementary measures where required. Annex 1 states, per sub-processor, the mechanism in force, including where no mechanism can currently be evidenced.
13.3 The transfer mechanism applicable to each sub-processor is stated in Annex 1.
14. Liability and Governing Law.
14.1 The liability of the Parties under and in connection with this DPA is governed by the liability provisions of the Main Agreement, without prejudice to the Parties' statutory liability towards data subjects under Art. 82 GDPR.
14.2 This DPA is governed by the laws of the Federal Republic of Germany, excluding its conflict-of-laws rules, unless the Main Agreement elects otherwise. Exclusive place of jurisdiction is Traunstein, Germany, unless the Main Agreement elects otherwise.
Acceptance
This DPA forms an integral part of the Main Agreement and is accepted by the Parties upon execution of the Main Agreement; no separate signature is required. A countersigned copy of this DPA is available from the Processor on request.
Changes in Version 1.4 (21 October 2026)
Section 10 requires notification of a personal data breach without undue delay after awareness and removes the fixed 72-hour period. Section 12 specifies that independent third-party auditors mandated by the Controller must be bound by confidentiality and excludes competitors of the Processor. Annex 1 clarifies Anthropic's United States model inference and the EU Standard Contractual Clauses and Swiss Addendum in its published DPA. Annex 2 adds tenant separation, backup and restore, encryption at rest and incident management measures.
Changes in Version 1.3 (16 October 2026)
Annex 1 now names Stripe, for subscription billing and payments, and Slack, for notifications to the Processor's team about Apex accounts. This corrects Annex 1 after the fact: both were already processing the data described in their entries before this version listed them, so the advance notice in Section 8.2 was not given for these two additions. A Controller may still object to either on reasonable data protection grounds, and the Parties will handle the objection as Section 8.2 describes.
Changes in Version 1.2 (14 October 2026)
Section 3.1 now lists the data categories processed for channel attribution, heatmaps, page performance, custom event properties and session replay, and new Section 3.3 sets out the session replay safeguards. Annex 2 states the fixed retention periods. Annex 1 names Supabase Pte. Ltd as Supabase's contracting entity under its current DPA, adds R2 replay storage to Cloudflare, heatmap screenshots to Browserbase, heatmap element naming to OpenRouter and the matching categories to Tinybird, and records Cloudflare's current Data Privacy Framework status. Where a change adds a sub-processor or a purpose for an existing sub-processor, the notice and objection procedure in Section 8.2 applies.
Annex 1 — Approved Sub-processors.
The following sub-processors are engaged by the Processor as of the version date of this DPA (Section 8.1):
| Entity | Purpose | Categories of personal data | Location of processing | Transfer mechanism |
|---|---|---|---|---|
| Cloudflare, Inc. | Delivery of the Apex SDK and snippet, event ingestion, DNS, TLS termination, and custom-domain routing for merchant storefronts. Cloudflare R2 object storage holds session replay recordings for experiments where the merchant enables session replay. Receives dashboard runtime error logs forwarded by Vercel for error grouping. | Pseudonymous visitor ID, session ID, page URL, event type, device type, and country. IP address is processed transiently at the edge for routing, geolocation, and abuse rate limiting; it is salted and hashed for rate-limit keys and is never written to the analytics store. Session replay recordings (R2): page structure and visible page text, pointer movement, clicks, scrolling and navigation, with form inputs masked and payment and checkout fields and pages excluded. | Global edge network; requests from EU visitors terminate at EU edge locations. Session replay recordings are stored in an R2 bucket with the location hint Eastern Europe (EEUR), a placement hint rather than a jurisdictional restriction, and expire automatically after 30 days. | EU-U.S. Data Privacy Framework: Cloudflare, Inc. participates in the EU-U.S. framework, the UK Extension and the Swiss-U.S. framework, covering HR and non-HR data; its status on the Data Privacy Framework List is "Active - Re-certification under Review" for all three (checked 14 October 2026). The EU Standard Contractual Clauses also apply under §6.2 of the Cloudflare DPA. |
| Vercel, Inc. | Hosting of the Apex dashboard (Next.js application) and its API routes. | Merchant user name, email address, authentication session cookies, request and function logs, and experiment configuration data. | Serverless functions execute in Vercel's London region (lhr1), United Kingdom; static assets are served from Vercel's global CDN. | EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914), applied module by module according to role. This is the mechanism in force under the Vercel DPA, which does not mention the Data Privacy Framework. |
| Supabase Pte. Ltd | Primary PostgreSQL database and authentication service: merchant accounts, shop and organisation membership, experiment and goal configuration, audit log, and privacy-request records. | Merchant user name, email address, password hash, role and shop membership, audit log entries, and support-related records. Supabase Storage also holds files such as screenshots of the merchant's storefront pages (for example for heatmaps) and files merchants upload. No storefront visitor event data. | Project data: AWS eu-west-1, Ireland, European Union. Since Supabase DPA Version 1 of 1 August 2026, the contracting entity and data importer (Schedule 2 §1.7(c)) is Supabase Pte. Ltd, 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513. Selecting an EU region controls where project data sits; it does not change the importing entity or its jurisdiction. | EU Standard Contractual Clauses only: Implementing Decision (EU) 2021/914, Schedule 2 of the Supabase DPA electing Module Two (controller to processor) and Module Three (processor to processor). Schedule 2 §2 adds the UK Addendum and Schedule 2 §3 a Swiss Addendum that adapts the clauses to the Swiss Federal Act on Data Protection, with the Swiss Federal Data Protection and Information Commissioner as competent authority for Swiss transfers. Supabase is not certified under the EU-U.S. Data Privacy Framework in any status. Singapore has no EU adequacy decision, so a transfer impact assessment applies; Supabase publishes one. |
| Tinybird Inc. | Analytics event store and query serving for experiment results. | Pseudonymous visitor ID, session ID, optional merchant-supplied user_id, experiment and variation assignment, page URL, referrer, UTM parameters, event type, device type, country, timestamp, custom event properties, order key, order revenue amount, and currency. Only with the visitor's marketing consent as signalled by the merchant's consent tool: advertising click identifiers (gclid, gbraid, wbraid, fbclid, ttclid, msclkid, li_fat_id, epik, ScCid, twclid) and advertising cookie values (_fbp, _fbc, _gcl_aw, _ttp), used solely to attribute visits to traffic channels. Heatmap interaction data: click and viewport coordinates, scroll depth, a pointer dwell grid, the clicked element's CSS selector and tag, its accessible name and up to 80 characters of its visible text (never the content of form fields). Storefront page performance data (web vitals and SDK timing). Session replay index data (session, entry page, device, duration and interaction counts; no recording content). Retention: event, attribution and heatmap data 365 days, page performance data 180 days, replay index data 60 days. | Google Cloud europe-west2, London, United Kingdom. The contracting entity is Tinybird Inc., 41 East 11th Street, 11th Floor, New York, NY 10003, USA. | EU Standard Contractual Clauses only under the Tinybird DPA, Module Two, with Clause 17 Option 1 electing Spanish law and Clause 18(b) the courts of Spain. Tinybird is not certified under the EU-U.S. Data Privacy Framework in any status. The United Kingdom storage location is covered separately by Commission Implementing Decision (EU) 2025/2574 of 19 December 2025, amending Implementing Decision (EU) 2021/1772, in force until 27 December 2031. |
| Upstash, Inc. | Redis cache and rate-limit counters for the dashboard: authorization decision caching and API rate limiting. | Merchant user, shop, organisation, and API-key identifiers held in short-lived cache keys and counters. No storefront visitor event data. | Both mechanisms are in force. The Upstash DPA incorporates the EU Standard Contractual Clauses (2021/914), Modules Two and Three, with Irish law and courts; §3.2(B)(1) also commits Upstash, Inc. to use the Data Privacy Framework to receive European data in the United States. Upstash, Inc. is certified and active for the EU-U.S., Swiss-U.S., and UK Extension frameworks, covering HR and non-HR data. | |
| OpenRouter, Inc. | Single gateway for Apex AI features, including the Apex Operator variation builder, landing-page generation, QA audit, and naming of the clicked elements shown in heatmaps. Requests are routed to the downstream model providers named below. | The merchant's prompt text and the content of the merchant's own storefront pages, including DOM text, extracted page structure, and screenshots. This content may incidentally contain personal data published by the merchant. AI summaries can include analytics-derived data: aggregated experiment behaviour summaries and insights and, only for shops that enable session replay, serialized replay sessions (page text, clicks and navigation, with form inputs masked). Heatmap element naming sends the text and attributes of clicked elements as rendered on the merchant's storefront page, the page URL and the experiment name. | USA. Routing region depends on the downstream model provider; EU gateway routing requires OpenRouter's enterprise tier, which Apex does not use. Text requests are restricted to zero-data-retention provider endpoints, and OpenRouter provider data collection is denied. Image generation is the exception: the image model has no zero-retention endpoint; provider data collection is still denied. Organizations can enable EU-only AI, which restricts text inference to EU endpoints (Google Cloud Vertex AI Europe, Amazon Bedrock eu-west-1, Microsoft Azure EU) with zero data retention and disables image generation; requests still pass through OpenRouter’s gateway, which does not store prompt content. | EU Standard Contractual Clauses (Commission Implementing Decision 2021/914), Module Two (controller to processor) only, entered by section 13.2 of OpenRouter's Data Processing Agreement with Drip Trading GmbH, as OpenRouter's contracting customer, in the data-exporter role. That DPA is incorporated into OpenRouter's Terms of Service (section 10.2) and applies to all organizational use of the service; OpenRouter confirmed this in writing on 29 July 2026. The UK Addendum is completed in section 13.3 and Swiss transfers in section 13.4. OpenRouter is not on the EU-U.S. Data Privacy Framework list. Disclosed gap: where Drip Trading GmbH acts as processor on behalf of merchants, the role-matching Module Three election is not offered in OpenRouter's self-serve DPA; obtaining a mutually executed DPA with a Module Three election is a tracked follow-up. |
| Anthropic Ireland, Limited (EEA counterparty; Anthropic, PBC elsewhere) — downstream model provider | Model inference for text generation, reached only through OpenRouter. Default text model. | As for OpenRouter above. | Model inference is processed in the United States; Anthropic's default routing may also process data in Europe, Asia and Australia. Anthropic's contracting entity for customers in the EEA, Switzerland, and the UK is Anthropic Ireland, Limited; an Irish counterparty does not restrict model inference to Ireland or the EU. EU-only AI routing through downstream EU endpoints is described in the OpenRouter entry above. | EU Standard Contractual Clauses, Modules Two and Three, elected in Schedule 3 of the Anthropic DPA, covering onward transfers from Anthropic Ireland, Limited to Anthropic, PBC and other US affiliates. Schedule 3, Part C includes a Swiss Addendum for personal data subject to Swiss data protection laws. These are the safeguards in Anthropic's published DPA; the OpenRouter entry above discloses the separate gap in the gateway's role-matching transfer terms. Anthropic is not on the EU-U.S. Data Privacy Framework list in any status. |
| OpenAI Ireland Ltd. (EEA counterparty; OpenAI OpCo, LLC elsewhere and for UK data) — downstream model provider | Model inference for image generation, reached only through OpenRouter. | As for OpenRouter above. | OpenAI's contracting entity where the customer is established in the EEA or Switzerland is OpenAI Ireland Ltd., an EU entity. European data residency for API projects exists but is sales-gated and configured per project. | EU Standard Contractual Clauses adopted 4 June 2021, Module Two (controller to processor) and Module Three (processor to subprocessor), with the UK Addendum for UK data, under OpenAI DPA §4.1–§4.2. OpenAI is not on the EU-U.S. Data Privacy Framework list in any status. |
| Browserbase, Inc. | Managed headless browser sessions used by Apex Operator to load and inspect the merchant's own storefront pages when building an experiment, and to capture screenshots of the merchant's storefront pages that heatmaps are drawn on (using access cookies the merchant configures for protected pages, where set). | Rendered content of the merchant's storefront pages, which may incidentally contain personal data published on those pages. No Apex analytics event data. | Browser sessions run in eu-central-1 (Frankfurt, Germany), with session recording and logging disabled. The contracting entity remains Browserbase, Inc. (USA). | Executed Art. 28 DPA: Drip Trading GmbH completed and signed the Browserbase Data Processing Addendum on 17 August 2026; per its Section 15 the DPA became binding upon receipt, which Browserbase confirmed in writing on 19 August 2026. Section 9.2 of the executed DPA incorporates the EU Standard Contractual Clauses with both Module Two (controller to processor) and Module Three (processor to subprocessor), the latter matching Drip Trading GmbH's processor role, completed with Clause 9 Option 2, Irish governing law (Clause 17 Option 1) and the courts of Ireland (Clause 18(b)); Exhibits B and C supply Annexes I and II. Browserbase is not on the EU-U.S. Data Privacy Framework list, so the SCCs are the operative mechanism. |
| Better Stack | Uptime monitoring, availability checks, and log aggregation. | Application and request logs, which can contain shop IDs, merchant user IDs, and request paths. No storefront visitor event data is forwarded. | Better Stack states that by default all data is stored in EU regions in ISO/IEC 27001-certified data centres; custom locations are an enterprise option. Its EU subprocessors include Google Ireland Limited and Hetzner Online GmbH. The corporate entity is nevertheless US-established. | EU Standard Contractual Clauses only. Schedule D of the Better Stack DPA incorporates Module Two or Module Three by role, Clause 9 Option 2, with disputes before the courts of the data exporter's EU Member State, otherwise Ireland; UK SCCs apply as a fallback. Better Stack is not certified under the EU-U.S. Data Privacy Framework in any status. |
| Plus Five Five, Inc. (d/b/a Resend) | Transactional email for account verification, password reset, and team invitations. | Merchant user email address, name, message content, and delivery metadata. | USA. Resend offers no EU processing option; its DPA states that primary processing takes place in the United States and that transfer there is necessary to provide the service. | EU-U.S. Data Privacy Framework, with two qualifications, plus the SCCs. Resend's status is "Active - Re-certification under Review" for the EU-U.S. framework and UK Extension; there is no Swiss-U.S. certification, and coverage is non-HR data only. The DPA also applies the EU SCCs, Module Two, to ex-EEA transfers. |
| Stripe Payments Europe, Limited (Ireland); data importer Stripe, LLC (USA) | Subscription billing, checkout, invoicing, tax calculation, and payment processing for Apex plans. | Billing contact name and email address, billing address, tax ID, the organisation and shop the subscription belongs to, subscription, invoice and payment records. Full card numbers and other payment credentials are entered on Stripe's own checkout page and never reach Apex; Apex keeps the card brand and last four digits that Stripe returns. No storefront visitor event data. | Stripe Payments Europe, Limited is the contracting entity for users in the European Economic Area (Stripe Services Agreement, section 12). Stripe transfers personal data to Stripe, LLC in the United States to provide its services (Stripe DPA section 6.1), and its affiliates and subprocessors may process it in other countries (section 6.2). | EU-U.S. Data Privacy Framework first: Stripe's Data Transfers Addendum (last updated 18 November 2025) states that Stripe, LLC is self-certified under the Data Privacy Framework and that it takes precedence where more than one mechanism could apply. Otherwise the EU Standard Contractual Clauses (Module One, Two or Three, by role) or the UK International Data Transfer Addendum apply, as set out in that addendum. |
| Slack Technologies Limited (Ireland) | DRIP team notifications about Apex accounts: new sign-ups, access and Slack Connect channel requests, and operational alerts about a shop's tests. Slack Connect channels shared with a client are created on the client's request. Where a merchant configures its own Slack incoming webhook, Apex composes those notifications (for example the experiment name, lift and confidence of a decision), keeps a delivery record, and posts them to the merchant's own Slack workspace; that workspace is the merchant's own service, not a Drip sub-processor. | Merchant user name and email address, shop name and domain, and experiment names, results summaries and alert details in notification messages. No storefront visitor event data. | Slack Technologies Limited, Dublin, is the processor of customer data for workspaces of customers outside the U.S. and Canada (Slack privacy policy). Slack transfers data to other countries, among them the United States, Australia, Canada, India, Japan and South Korea. | EU Standard Contractual Clauses approved by the European Commission, incorporated in Slack's standard data processing addendum (Slack privacy policy, effective 5 July 2023). |
| Ably Realtime Ltd. (United Kingdom) | Realtime message channel powering the inbox surface in the Apex dashboard. | Merchant user and shop identifiers and message payload metadata, in transit. No persistent storage of storefront visitor data. | United Kingdom entity. Ably states that processing can be global, in various regions around the world; dedicated regional capacity is available on request. An EU-only or UK-only claim cannot be made today. | UK adequacy decision under Art. 45 GDPR for the primary leg: Commission Implementing Decision (EU) 2025/2574 of 19 December 2025, amending Implementing Decision (EU) 2021/1772, in force until 27 December 2031. For onward transfers outside the EEA/UK, Ably DPA §12 applies the EU Standard Contractual Clauses and, for UK GDPR transfers, the UK Addendum. Ably is not on the EU-U.S. Data Privacy Framework list and, as a UK entity, is not eligible for that US certification programme. |
Changes to this list — Additions or replacements are subject to the 30-day notice and objection procedure in Section 8.2. The current list is available to the Controller at any time on request.
Annex 2 — Technical and Organisational Measures.
Measures implemented by the Processor pursuant to Art. 32 GDPR, as of the version date of this DPA:
A2.1 Encryption in transit. All data transmission between visitor browsers, the Processor's systems and sub-processors is encrypted using TLS (current industry-standard versions and cipher suites).
A2.2 Pseudonymisation by design. Visitor identifiers for analytics are randomly generated on the client and carry no linkage to names, accounts or contact data. Where the Controller elects to supply an optional user_id or order identifiers, the Processor processes them as supplied, solely under the Controller's instructions; the Controller is responsible for ensuring the values it supplies are pseudonymous and do not directly identify a person. Content the Controller submits to AI-assisted features (page content, prompts, screenshots) is processed only for the feature invoked and is listed in Annex 1.
A2.3 Access controls. Access to production systems and personal data is restricted to authorised personnel on a need-to-know basis, protected by individual accounts, strong authentication and role-based permissions.
A2.4 Data residency. The primary database is hosted in AWS region eu-west-1, Ireland, European Union. Experiment analytics are stored and aggregated in Google Cloud region europe-west2, London, United Kingdom; that transfer is covered by the European Commission's UK adequacy decision, Commission Implementing Decision (EU) 2025/2574 of 19 December 2025 amending Implementing Decision (EU) 2021/1772, in force until 27 December 2031.
A2.5 Data retention. Event-level data is deleted automatically after fixed retention periods: event, channel attribution and heatmap data after 365 days, page performance data after 180 days, session replay index data after 60 days and session replay recordings after 30 days. Deletion for an individual visitor identifier under Section 9.2 removes that visitor's event, attribution, page performance and replay index data; replay recordings are removed by their 30-day expiry.
A2.6 Logging and monitoring. Administrative access and relevant system events are logged; systems are monitored for availability, anomalies and security-relevant events.
A2.7 Sub-processor due diligence. Sub-processors are assessed for appropriate technical and organisational measures prior to engagement and bound by data processing agreements pursuant to Art. 28(4) GDPR; the list is reviewed periodically.
A2.8 Tenant separation. Application access to shop data is scoped by shop and organisation membership and role-based permissions. Shop API keys are bound to a specific shop and their permitted operations.
A2.9 Backup and restore. Supabase provides database backup and restoration capabilities; its database backups do not include files stored through the Storage API. The Processor's documented database recovery plan calls for confirming backup availability, selecting an approved recovery point and validating schema, data integrity and tenant isolation before restoring service.
A2.10 Encryption at rest. Supabase states that customer data hosted on its platform is encrypted at rest using AES-256.
A2.11 Incident management. The Processor maintains an incident response runbook covering severity classification, assignment of an incident owner, mitigation, evidence capture and recovery verification. Personal data breach notification is governed by Section 10.