ethogram

Data Processing Agreement

Last updated

When your server sends us requests from your website, some of that data may be about people. Under the GDPR that makes you the controller and us your processor, and the law wants a written agreement between us. This is it, in plain words.

Think of it as a house-sitting agreement: it's your house, we look after it the way you asked, and we don't throw parties in it. It's part of our Terms of Service, so by accepting those you've accepted this too. No signature needed.

Who's who

You are the customer with an Ethogram account who decides which sites to connect and what to send us: the controller.

We are Ethogram, based in Porto, Portugal: the processor. For your own account details (your name, email, billing), we are the controller instead, and our Privacy Policy covers that.

What we process

  • What: the requests and events your collector sends us (“Customer Data”), and the visits, insights and reports we build from them.
  • Why: to run Ethogram for you: name the agents visiting your sites, record what they did, and show you where they get stuck.
  • About whom: the visitors to your sites, people and the operators behind AI agents.
  • Which data: for agents, request details such as time, path, status, user agent, headers, IP address and network. For people, time, path, status, user agent, the referring site and a visitor key that changes daily, kept per visit so you can open each visit and see its requests in order. This is pseudonymous personal data. The full list is in Data we keep.
  • For how long: as long as your account exists, and see “How long we keep it” below.

What we promise

  • We only process Customer Data on your instructions, which are these terms and the way you set up Ethogram. If the law ever makes us do otherwise, we tell you first, unless the law forbids that.
  • Everyone at Ethogram who can see Customer Data is bound to keep it confidential.
  • We protect it with measures that fit the risk: encrypted connections, hashed keys, access limited to the people who need it, and credentials stripped before anything is stored.
  • We help you answer requests from people exercising their GDPR rights, and with security and impact assessments where our part matters.
  • We may use Customer Data in aggregated form to improve Ethogram. We use it for research only after anonymising it, so it no longer identifies anyone.

What you promise

You have a lawful basis for the data you send us, you tell your visitors what they need to know, and you only connect sites you own or manage. Don't send us data we don't need, such as passwords or special category data, in paths, queries or headers.

Subprocessors

We rely on a short list of companies to run Ethogram. Each is bound by data protection terms at least as strict as these.

  • Stripe (Payments; location: United States, with an EU entity in Ireland): Takes card payments, runs subscriptions and sends invoices. Sees billing details, not your site's traffic.
  • Anthropic (AI analysis; location: United States): Writes daily briefs and visit explanations from your agent traffic and insights, using Claude.
  • Railway (Database; location: United States, US East (Virginia)): Runs the Postgres database where everything is stored.
  • Cloudflare (Hosting, email, DNS and CDN; location: Global network): Runs the Ethogram app, delivers our emails (sign-in links, invites, receipts, alerts and daily briefs) and answers DNS for our domain.

We update this list when things change.

Moving data abroad

The Ethogram app runs on Cloudflare's global network, and its database is hosted in the United States, on Railway in US East (Virginia). Our subprocessors handle Customer Data in the locations listed above. Transfers from the European Economic Area to them rely on the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework, depending on the provider.

If something goes wrong

If we find a personal data breach affecting Customer Data, we tell you without undue delay, with what we know about what happened, what data and people it touches, and what we're doing about it. We keep you posted as we learn more, so you can meet your own duties to the authorities and the people affected.

How long we keep it

While your account exists, Customer Data has no expiry date. It stays for as long as the project that recorded it exists, so you can look back as far as you like, and it stays if your plan ends and you come back later.

When you're done, delete the project from its settings and its Customer Data is deleted with it. Once you delete your account, your data is deleted within 30 days, except invoices, which Portuguese tax law requires us to keep for 10 years. Projects you share with another owner stay with them. Want a copy first, or want us to delete something specific? Write to legal@ethogram.si.

Compliance questions

Ask us anything you need to show you're compliant, and we'll answer in writing.

The fine print

This agreement lasts as long as we process Customer Data for you. The liability limits in the terms apply. It's governed by the laws of Portugal, like the terms. We update this page when things change.

Contact

Ethogram, Porto, Portugal. Data protection questions: legal@ethogram.si.