Data Processing Addendum

For that data you are the controller — or, where you process it for someone else, a processor who confirms that your instructions to us are authorised — and we are your processor. Under California’s and other US states’ privacy laws we are your service provider.

We record visits to your app, run test visits of it, derive journeys, labels and alerts from them, and show you the results, for as long as the app is connected plus the retention period in section 9. The data: what visitors do on your pages and how they interact, with what they type into form fields hidden in their browser; the pages they visit; their browser family, screen size and country; the screenshots and page content of test visits; and, in a recording made by an older version of oloy, the e-mail address of a visitor signed in to your app. oloy does not try to work out who a visitor is. The people: your app’s visitors and users.

We process this data only on your documented instructions — the Terms, this addendum and the settings you choose in oloy — including for international transfers, and we tell you if we think an instruction breaks the law.

Access to this data is limited to authorised personnel who need it to provide, support, secure and improve oloy, or where the law requires it, and everyone we let access it is bound to keep it confidential.

We protect this data with measures appropriate to the risk: data is encrypted in transit and at rest; what visitors type into form fields is hidden in their browser before anything is sent to us; recordings are deleted 30 days after they are made; and access is limited as section 4 says.

We use other providers to host, store and deliver oloy and to run the AI that tests apps and reads what we derive from visits, and you authorise us to use them. We will tell you which ones we use, what each does and in which country it processes data, when you ask at hi@oloy.ai, and we keep that answer up to date. You can object to a provider on reasonable grounds relating to data protection by writing to us; if we can’t resolve your objection, you can delete the affected app and end this addendum for it. We require each provider to protect your users’ data no less than this addendum does, and we remain responsible to you for them.

We help you answer your users’ requests about their data (you can delete a visit yourself; we delete on your instruction), and we help you with security, breach notification, impact assessments and consultations with authorities, as far as we reasonably can.

If we become aware of a personal data breach affecting your users’ data, we tell you without undue delay after we become aware of it, with what we know and what we are doing.

Recordings expire 30 days after they are made, and you can delete a visit sooner. When you delete an app, its recordings go with it. When your account ends, we delete your apps’ data within 30 days unless the law requires us to keep it.

On request we give you the information needed to show that we meet these obligations, and we allow an audit at most once a year, on 30 days’ notice, at your cost, by a reasonable method — a questionnaire or a review of our documentation first.

We and some of our providers are in a different country from your users, so their data may be transferred there. For data covered by the GDPR, the EU Standard Contractual Clauses (Module Two, or Module Three where you are a processor) are part of this addendum and are deemed signed by you and us when you accept the Terms, with sections 2, 5 and 6 and the list of providers we give on request as their annexes; for UK data the UK Addendum to those Clauses applies, and for Swiss data the Swiss amendments. We will provide a signed copy on request.

We process your users’ data only to provide oloy to you. We don’t sell or share it, don’t keep, use or disclose it for any other purpose, and don’t combine it with other data except as those laws allow. We comply with those laws and give the data the same protection they require of you; we tell you if we can no longer do so; you can take reasonable steps to stop and remedy any unauthorised use; and oloy stays off when a visitor’s browser sends a Global Privacy Control signal.

The limitation of liability in our Terms of Use applies to this addendum, except that nothing limits your users’ rights under the GDPR or the Standard Contractual Clauses.

For the processing it covers, this addendum prevails over the Terms, and the Standard Contractual Clauses prevail over this addendum where they are more protective. It lasts for as long as we hold your users’ data.

Questions about this addendum? Write to hi@oloy.ai.