Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer that uses ProductLense ("Customer", "you") and RedAnalytica, a sole proprietorship registered in India (GSTIN 24AHRPH4502J1ZD) based in Ahmedabad, Gujarat, India ("Processor", "we"). It applies whenever we process personal data on your behalf through the hosted service at https://app.productlense.app. It is accepted when you accept the Terms; no signature is needed. If you need a countersigned copy, email grievance@productlense.app.

1. Definitions

"GDPR" means Regulation (EU) 2016/679 and, where applicable, the UK GDPR and the UK Data Protection Act 2018. "DPDP Act" means India’s Digital Personal Data Protection Act, 2023 and its rules. "Personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the GDPR; "Data Fiduciary", "Data Processor" and "Data Principal" have the meanings given in the DPDP Act. "Customer Personal Data" means personal data we process on your behalf under the Terms. "Subprocessor" means a third party we engage to process Customer Personal Data.

2. Roles

For Customer Personal Data, you are the controller and Data Fiduciary, and we are your processor and Data Processor. For account data about you and your team, we are an independent controller under our Privacy Policy, and this DPA does not apply to it.

3. Instructions

We process Customer Personal Data only on your documented instructions. The Terms, your configuration of the service (sites, script settings, billing connections, ad spend, team members, deletion and export actions) and this DPA are your complete instructions. If we believe an instruction breaks the GDPR, the DPDP Act or another data protection law, we will tell you and may suspend that processing. If the law requires us to process data otherwise, we will tell you first unless the law forbids it.

4. Your obligations

You are responsible for having a lawful basis for the data you send, for giving the notices and obtaining any consents that your visitors and customers are owed, for not sending special categories of data, government identifiers, payment card numbers or passwords in events, props or identify traits, and for the accuracy of the data you send.

5. Confidentiality

Everyone who can access Customer Personal Data on our side is bound by confidentiality. Access is limited to RedAnalytica’s proprietor and anyone later engaged by RedAnalytica under written confidentiality obligations, and only as needed to run and support the service.

6. Security

We implement the technical and organisational measures in Annex 2 and keep them appropriate to the risk. We may update them as long as the overall level of protection does not decrease.

7. Subprocessors

You give general authorisation for us to engage subprocessors. We use carefully selected service providers for hosting, content delivery, payment processing and transactional email. A current list of subprocessors is available on request at privacy@productlense.app. We will notify you by email at least 30 days before a new subprocessor starts processing Customer Personal Data. You may object on reasonable data protection grounds within that period; if we cannot address the objection, you may terminate the affected service and receive a refund of prepaid fees for the unused period. We impose data protection terms on each subprocessor that protect the data at least as well as this DPA, and we remain responsible for their performance.

8. Data subject requests

Taking into account the nature of the processing, we help you respond to requests from data subjects and Data Principals. “Export data” in site settings downloads a zip of the site’s daily aggregates, its payments without customer names or emails, and its ad spend. Analytics data is purged within minutes of deleting a site or account, and always within 7 days; backup copies expire within 30 days. If we receive a request directly, we forward it to you without undue delay and do not respond ourselves unless you instruct us to.

9. Assistance

We provide reasonable help with your data protection impact assessments and prior consultations with supervisory authorities, to the extent they concern our processing and you cannot get the information from this DPA, the site export (“Export data” in site settings), the privacy documentation or the security page.

10. Personal data breaches

We notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice describes what happened, the data and approximate number of people affected, the likely consequences, and the measures taken or proposed. We provide further information as it becomes available and help you meet your own notification obligations to authorities, including the Data Protection Board of India, and to individuals.

11. International transfers

Customer Personal Data is stored in Germany. Administrative access happens from India, and some subprocessors are in the United States. For transfers of personal data from the EU or EEA to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module 2 (controller to processor), which are incorporated by reference with these choices: Clause 7 (docking) applies; Clause 9 option 2 (general authorisation, 30 days’ notice); the optional wording in Clause 11 does not apply; Clauses 17 and 18 choose the law and courts of Ireland; Annex I is Annex 1 of this DPA and Annex II is Annex 2. For transfers from the UK, the International Data Transfer Addendum issued by the UK Information Commissioner applies, with the same details. For Switzerland, references to the GDPR include the Swiss Federal Act on Data Protection.

12. Audits

We make available the information needed to show compliance with this DPA, through this document, the security page and written answers to reasonable questionnaires. If that is not enough, or a supervisory authority requires it, you may audit our compliance once in any 12 months, on 30 days’ written notice, during business hours, at your cost, through an auditor bound by confidentiality who is not our competitor.

13. Deletion and return

Analytics data is purged within minutes of deleting a site or account, and always within 7 days; backup copies expire within 30 days. Before deleting, you can use “Export data” in site settings to download a zip of the site’s daily aggregates, its payments without customer names or emails, and its ad spend. We keep data longer only where the law requires, and then only for that purpose.

14. DPDP Act

Where the DPDP Act applies, we process personal data only for the purpose you specify and on your behalf; we do not retain it beyond what is needed for that purpose; we apply reasonable security safeguards to prevent personal data breaches; we notify you of breaches so you can inform the Data Protection Board of India and affected Data Principals; and we delete data when you ask or when the purpose ends, in line with section 13.

15. Liability and order of precedence

Each party’s liability under this DPA is subject to the limitations in the Terms, except where the law does not allow it. If this DPA conflicts with the Terms about personal data, this DPA prevails. If it conflicts with the Standard Contractual Clauses, the Clauses prevail.

16. Term

This DPA applies for as long as we process Customer Personal Data and ends automatically when that processing ends.

Annex 1: Details of processing

Annex 2: Technical and organisational measures

• Minimisation. No cookies or device storage on visitors; IP addresses used in memory only and never stored; visitor ids hashed with a salt that rotates daily and is not kept; query strings stripped in the browser except attribution parameters.
• Encryption. TLS for all traffic; billing provider credentials encrypted at rest with a key held only in the server environment; encrypted backups; API keys stored as SHA-256 hashes.
• Access control. Production access limited to named people with individual keys; a firewall admits only web traffic from the content delivery network; dashboard sessions are HttpOnly SameSite cookies on a separate origin from the marketing site; magic-link tokens expire after 15 minutes and work once.
• Isolation. Every row and query is scoped by site id; tests cover cross-site access.
• Integrity. Webhooks verified with each provider’s signature; replays rejected by event id; inputs validated with strict decoders.
• Availability. Nightly backups of ClickHouse and Postgres with 30-day retention, and restore tests; health checks and monitoring; infrastructure defined as code.
• AI. Ask and the daily insight run on our own servers; no outside AI model receives Customer Personal Data or questions. Answers are written from fixed templates and every figure is checked against the query result.
• Retention. Automatic deletion of raw events after 90 days.