Your visitors' data.Processed only for you.

Draft under legal review. This text has not yet been approved by Castomo's legal advisers and is published so customers can read the intended terms. Until the approved version replaces it, questions about it go to hello@castomo.com.

1. Parties and scope

This agreement is between the customer that subscribes to the hosted Observer service (the Controller) and Castomo prosta spółka akcyjna, ul. Powstańców Śląskich 5/212, 53-332 Wrocław, Poland, KRS 0001188843, NIP 8993033031 (the Processor). It forms part of the Terms of Service and applies to every subscription, the trial included. It does not apply to self-hosted Observer, where Castomo processes nothing.

2. Subject matter

The processing of personal data of visitors to the Controller's websites, collected by the Observer tag and the Controller's own server-to-server events, so that the Processor can provide the Controller with web and behaviour analytics.

3. Duration

For as long as the Controller's subscription runs, plus the 7-day grace period after it ends, plus the deletion period in section 11.

4. Nature and purpose

Collection, transmission, storage, aggregation, analysis and display of analytics data, and deletion, solely to provide the Service as the Controller configures it (its sites, privacy tiers, goals, funnels and the features of its plan). The Processor does not use visitor data for its own purposes, does not sell it, does not share it with advertising platforms and does not combine it across customers.

5. Data subjects and categories of data

Data subjects: visitors to the Controller's websites. (People in the Controller's team are castomo account holders; Castomo handles their data as a controller, as set out in the privacy notice.)

Data, depending on the privacy tier the Controller chooses for each site:

• Default tier T0: the page address (of any query, only campaign tags) and title; the referring site; browser, device type and operating system; browser language; a screen-size bracket; active time on the page; page-load timings (Core Web Vitals); the class of any script error; click and scroll positions; the visitor's country, looked up from the IP address; and a pseudonymous visitor code, computed from the IP address and browser with a key that changes every day and differs per site. Nothing is stored on or read from the visitor's device.
• Custom and server-to-server events the Controller sends, which the collector scrubs and checks against the site's allowlist.
• Tier T2 session replay (Pro and Business), only for visitors who opt in: a recording of the page's structure and the visitor's interactions, with every input value masked in the browser before it is sent.

The IP address is used for a moment to make the visitor code and look up the country, and is never stored. Special categories of personal data are not intended to be processed; the Controller must not send them (see the Terms, section 11).

6. Retention while the subscription runs

• Raw events: 24 hours. After that only aggregated rollups remain.
• Aggregated rollups: 25 months.
• Session replay recordings: 1 month on Pro, 13 months on Business.

These periods are enforced by the database's own expiry rules. The Controller can delete a site's recordings and other data in the Panel at any time, on any plan.

7. The Processor's obligations

The Processor:

• processes visitor data only on the Controller's documented instructions, which are these terms and the Controller's configuration in the Panel, including for transfers, and tells the Controller if it believes an instruction breaks data protection law;
• ensures that the people authorised to process the data are bound by confidentiality;
• takes the security measures in section 8;
• engages sub-processors only as set out in section 9;
• helps the Controller, by appropriate technical and organisational measures, to answer requests from data subjects exercising their rights;
• helps the Controller meet its obligations under Articles 32 to 36 of the GDPR (security, breach notification, impact assessments and prior consultation), taking into account the information available to it;
• deletes the data at the end of the service, as set out in section 11;
• makes available the information needed to show compliance with Article 28, and allows for and contributes to audits as set out in section 12.

8. Security measures

• No raw IP storage: the address lives only in memory for the moment it is needed, which an automated check in the build enforces.
• Pseudonymisation by design: the visitor code is an HMAC whose key rotates every day at midnight UTC and is separate per site, so visits cannot be linked across days or sites.
• k-anonymity: any report row covering fewer than 5 visitors is suppressed when it is read.
• Minimisation at the source: input values are masked in the browser, form analytics counts fields without reading them, and the collector scrubs personal data from page addresses and events.
• Short retention enforced by the database (section 6).
• Encryption in transit (HTTPS) between visitors, the collector and the Panel.
• Access only through castomo sign-in, scoped to the workspace's own sites and its members' roles, with an append-only audit log.
• Daily backups, copied off the server to separate infrastructure.

9. Sub-processors

The Controller gives general authorisation for the sub-processors below. The Processor will tell owners by e-mail at least 30 days before adding or replacing one, and the Controller may object on reasonable data protection grounds; if the objection cannot be resolved, the Controller may cancel the subscription. Each sub-processor is bound by data protection obligations equivalent to these.

Sign-in, workspaces and billing run on castomo's own platform, operated by Castomo itself, and do not receive visitor data.

10. International transfers

Visitor data is processed and stored only within the European Economic Area. The Processor will not transfer it outside the EEA without the Controller's prior instruction and the safeguards required by Chapter V of the GDPR.

11. End of the service: deletion

When the subscription ends and the 7-day grace period is over, the Processor deletes the Controller's visitor data within 30 days, and copies in backups are overwritten in the normal backup rotation within a further 30 days. Before the subscription ends, the Controller can read its reports and export what the Panel and, on Business, the API provide. The Processor keeps no copy unless the law requires it.

12. Breaches, information and audits

The Processor notifies the Controller without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach affecting the Controller's visitor data, with the information the Controller needs to meet its own obligations. On request, the Processor provides the information needed to show compliance with this agreement. Audits, by the Controller or an auditor it appoints who is bound by confidentiality, may take place once a year with 30 days' notice, during business hours and at the Controller's cost, unless a breach gives reason for an earlier one.

13. Order of documents

If this agreement and the Terms of Service disagree on the protection of personal data, this agreement prevails. Liability under this agreement follows the Terms of Service, unless the law provides otherwise.

14. Contact

Questions about this agreement, or a request for a signed copy: hello@castomo.com.