Last updated 1 October 2026
Data processing agreement
How trckable Cloud handles the analytics your sites collect, on your behalf. It is part of the terms of service.
In short
- You decide what your sites measure. We handle that data only for you.
- No visitor IP address is ever stored.
- The companies that help us run Cloud are listed below. You hear about a change 30 days ahead.
- Your data is stored in the EU: servers in Amsterdam, backups in the EU.
- When you delete your account, your data is deleted 30 days after you ask, and you can restore it until then (or at once, if you email us) and leaves our backups within 30 days of that.
Who is who#
This agreement is between you, the Cloud customer, and Trckable, registration code (NIPT) M31812005D, Rr. Kristaq Prifti, Tirana, Albania. It is written to meet Article 28 of the GDPR.
It covers the personal data in the analytics your sites collect. For that data you are the controller and we are the processor. For your own account data (your email address, name and billing details) we are the controller, as our privacy policy describes.
It applies as soon as you use Cloud, and needs no signature. If you need a signed copy, ask at legal@trckable.com.
What we process#
- Purpose: running Cloud for you: collecting, storing, adding up, showing, exporting and deleting your sites' analytics.
- Whose data: the visitors of your sites.
- What data: the pages viewed, where the visit came from, the browser, operating system, device type, screen width, language and country, how long the page was in view, and the events you chose to count. If you turn on cookies, a random visitor id. The privacy policy has the full list.
- Never stored: the visitor's IP address. It is used for a moment to work out the country, then thrown away.
- How long: while your account exists, unless you delete it sooner.
What we do#
- We process your data only on your instructions: these terms and the settings you choose in Cloud. We do not sell it, use it for advertising or use it to train AI models.
- We tell you if an instruction seems to break data protection law.
- Everyone who works with your data for us is bound to keep it confidential.
- We help you answer the people who ask you about their data. Cloud gives you a tool to find and erase a visitor's data, and you can delete a site's data at any time.
- We help you with data protection impact assessments and with data protection authorities, when you ask.
- If we learn of a personal data breach that affects your data, we tell you without undue delay, with what we know so far.
- If a public authority asks us for your data, we tell you first, unless the law forbids it.
- We answer your written questions about how we follow this agreement, and give you the information you need to show that you can rely on it.
Security#
- Everything travels over HTTPS.
- Cloud has no passwords. You sign in with a one-time code sent to your email, or with Google. Sessions last up to 30 days.
- Cloud's cookies are HttpOnly and Secure.
- Keys you give trckable for connected services, such as a payment provider, are stored encrypted.
- Cloud is backed up every night. The backups are encrypted (AES-256-GCM) and copied to storage at another company.
- Our own access to customer accounts goes through an admin area that asks for a second confirmation before sensitive actions, and every such action is logged.
- Each sub-processor below is bound to data protection duties like these.
Sub-processors#
You allow us to use these companies to handle your data:
| Company | For | Based in |
|---|---|---|
| Railway | Hosting: running Cloud and keeping its data, on servers in Amsterdam (EU) | United States |
| Cloudflare | Passing on Cloud's traffic, and storing its encrypted backups, in the EU | United States |
| Resend | Sending and receiving Cloud's emails, such as alerts and reports | United States |
| OpenAI | Answering questions in Peek, only when you use it. Not used to train models | United States |
Paddle, which handles payments as the Merchant of Record, does not see your analytics.
Where data leaves the European Economic Area, the transfer is covered by the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
We email you at least 30 days before we add or replace a sub-processor. If you do not agree, you can cancel and ask us for your data before then.
Deletion#
Email support@trckable.com and we send your whole account as one file within 7 days.
When you delete your account, everything in it is deleted 30 days after you ask, and you can restore it until then (or at once, if you email us). It leaves our backups within 30 days of that. An account whose trial, or cancelled plan, ended without a new plan is read-only for 14 days, then paused, and deleted 30 days after the end, after emails at each step. You can also delete a single site's data at any time.
After that, we keep only what tax law requires, such as invoices. It holds no analytics.
Contact#
Questions about this agreement, or a request about your data: legal@trckable.com. The legal notice has our details. The laws that apply are those in the terms.
If this agreement changes in a way that matters, Cloud customers hear about it by email at least 30 days before it applies.