What this is
This agreement is between you, the customer, and Mirat Soft Private Limited, which makes SplitStat. It is part of our terms of service. By accepting the terms, you accept this agreement too.
It covers personal data we process for you while we run the service: mainly what our snippet records about the visitors to your website. It applies wherever the law needs a contract like this, including the GDPR in the European Union, the UK GDPR, and the Swiss data protection law.
Who is responsible for what
For the visitors to your website, you are the controller and we are the processor. You decide why their data is processed. We process it for you.
For your own account, such as your team's names and email addresses and your billing details, we are the controller. Our privacy policy covers that, not this agreement.
What we process
We process visitor data only to run A/B tests, split URL tests and rollouts on your website, and to show you the results. The annex lists the details: whose data, which data, and for how long.
You must not send us sensitive data, such as health, religion or payment card numbers, or names, email addresses or phone numbers of your visitors. Our terms forbid it, and the service is not built to protect it.
Your instructions
We process visitor data only on your instructions. Your instructions are these terms, this agreement, and the settings you choose in your account, such as which tests run and whether visitors are asked for cookie consent first.
If the law makes us process data in a way you did not ask for, we will tell you first, unless that law forbids us to. If we think one of your instructions breaks data protection law, we will tell you.
Our people
Only the people who need to reach your data to run the service can reach it. Each of them is bound to keep it confidential.
Security
We protect your data with the measures in the annex, and we keep them up to date. We may change them, but never in a way that makes your data less safe.
If we become aware of a breach that affects personal data we process for you, we will tell you without undue delay. We will tell you what happened, what data is affected, what we are doing about it, and who you can talk to. We will give you what you need to tell your regulator and your visitors.
Sub-processors
You allow us to use the companies on our sub-processors page to help run the service. Each one is bound by a written contract that protects your data at least as well as this agreement does. We are responsible for what they do.
Before we add a new sub-processor that would handle your data, we will email the account owner at least 30 days ahead. You can object within those 30 days, with a reason based on data protection. If we cannot resolve it, you can close your account, and we will charge you nothing further.
Helping you
If one of your visitors asks to see, correct or delete their data, we will help you answer. If they ask us directly, we will pass the request to you rather than answer it ourselves.
We will also give you reasonable help with your own security, with impact assessments, and with your regulator, as far as it concerns our service.
Showing we comply
We will give you the information you need to show that this agreement is followed. Write to [email protected] and we will answer your questions in writing.
If written answers are not enough, or a regulator asks for it, you may audit us. Give us 30 days' notice. An audit happens at most once a year, unless there has been a breach or a regulator requires one. You pay for it, and the auditor must keep what they learn confidential.
When the service ends
Export anything you want to keep before you delete your account. After that, we delete the visitor data we hold for you within 90 days, or sooner if you ask, unless a law makes us keep it. It leaves our backups as each backup expires. We confirm the deletion if you ask.
Transfers outside Europe
We are based in India and our servers are in the United States. So data about visitors in the European Union and the European Economic Area leaves Europe when we process it.
To protect it, this agreement includes the European Commission's standard contractual clauses (Decision 2021/914), Module Two: controller to processor. You are the data exporter and we are the data importer. The parts the clauses leave open are filled in like this:
- Clause 7, the docking clause, does not apply.
- Clause 9: option 2, general written authorisation, with the 30 days' notice in the sub-processors section.
- Clause 11: the optional wording does not apply.
- Clauses 17 and 18: the law and the courts of Ireland.
- Annexes I and II: the annex to this agreement. Annex III: our sub-processors page.
If the clauses and the rest of this agreement disagree, the clauses win.
The UK and Switzerland
For data from the United Kingdom, the clauses above apply together with the UK Information Commissioner's International Data Transfer Addendum. Its tables are filled in from this agreement, and either of us may end it as its section 19 allows.
For data from Switzerland, the clauses apply with Swiss law in place of EU law where needed, the Swiss data protection authority as the regulator, and the courts of Switzerland as an option for people in Switzerland.
If documents disagree
If this agreement and the terms disagree about personal data, this agreement wins. If the standard contractual clauses disagree with either, the clauses win.
Liability
The limits on liability in our terms apply to this agreement too, as far as the law allows.
Annex: the details
The parties. The data exporter is you, the customer named in your account. The data importer is Mirat Soft Private Limited, India. Contact: [email protected].
Whose data. People who visit your website while our snippet runs on it. The members of your team who use your account are covered by our privacy policy instead.
Which data.
| Recorded | Never recorded |
|---|---|
| A random visitor id and session id | IP address, which is used to find the country and then left out |
| The page address and the referring address | Name, email or phone number |
| Device type: desktop, mobile or tablet | The full browser user agent string |
| A two letter country code | City, region or coordinates |
| Which version of a test was shown | Keystrokes, form contents or screen recordings |
| Events you choose to track, their time, and any value and currency | Anything from another website |
Our snippet keeps the visitor id, the session and how the visit began in first-party cookies and local storage on your website. Our privacy policy lists them.
Sensitive data. None. You must not send it.
How often. Continuously, while the snippet runs on your website.
What we do with it. We record it, assign visitors to versions of a test, count it into results, and show those results to you. Only if your team uses our AI features, we send that feature's material to our AI provider: page content for suggestions and ideas, and a test's totals and results for a summary or an answer about them. Never the events of a single visitor.
How long.
| What | Kept for |
|---|---|
| Individual visitor events | 90 days, then deleted automatically |
| Daily totals built from those events | As long as your account exists. They are counts, with nothing about any one person in them |
| Which version a visitor was shown | As long as the test exists |
| Requests to our AI features and their answers | 90 days, unless a suggestion was applied to a test, which keeps it as long as the change |
| Web server logs, which include IP addresses | 14 days, then deleted automatically |
| Everything, after your account is deleted | 90 days, then deleted, or sooner if you ask |
Security measures.
- Traffic is encrypted in transit.
- Visitor IP addresses are never stored with visitor data. The country is read at the network edge and the address is left out before anything is written down.
- Visitor ids are random, mean nothing outside your website, and are never joined across customers.
- Passwords are hashed and cannot be recovered by us. Sign-in can be protected with single sign-on.
- Access to production is limited to the people who need it.
- Every change inside a workspace is written to an audit trail your own team can read.
- Raw events are deleted on a fixed schedule, by a job that runs every night.
- Visitors can be asked for cookie consent first, and a browser that sends the Global Privacy Control signal is never tested or counted.
Sub-processors. Listed on our sub-processors page, with what each one does and sees.