Data processing agreement

This data processing agreement (DPA) forms part of the Tyton terms between the customer using Tyton and Kitra LLC, 30 N Gould St, STE R, Sheridan, WY 82801, USA. Our working location is Ulpiane, Dëshmorët e Kombit, Prishtina 10000, Kosovo; contact hello@usetyton.com. It applies when Tyton processes personal data in customer-directed website tracking for which the customer is a controller, or a processor authorized by its controller. The customer gives the instructions; Kitra LLC acts as processor or subprocessor as appropriate. Tyton's own account, billing, and service-security data is governed by our privacy policy as controller processing.

We process covered data only on the customer's documented instructions, including configurations and actions the customer approves in Tyton, and as needed to provide the service. This includes any instruction to deliver events to Meta or a customer-selected destination. If law requires other processing, we will inform the customer before doing it unless legally prohibited. We will tell the customer if we believe an instruction violates applicable data protection law. The customer is responsible for the lawfulness of its instructions and for any required notices and consent.

Subject matter and purpose: receiving website events, matching browser and server observations, deduplicating, delivering customer-authorized conversions, and displaying diagnostics. Nature of processing: collection, transmission, hashing, storage, comparison, access, and deletion. Duration: while the customer uses the relevant service, followed by the return or deletion process below and any legally required retention.

Data subjects may include the customer's site visitors, leads, and buyers. Data categories may include event names, IDs, times, page addresses, purchase values and currencies, browser or Meta identifiers, and matching identifiers such as hashed email or phone numbers. Network information may pass through the delivery path. Hashes and identifiers may remain personal data. The service is not intended for special-category or criminal-offence data; the customer must not send it unless we have agreed a suitable basis and safeguards.

We limit access to people who need it to operate or support the service and bind them to confidentiality. We use project-scoped credentials, access controls, encryption for stored delivery credentials and temporary checkout context, and diagnostics designed to limit exposure of event data. We review access and security measures in light of the risks, including confidentiality, integrity, availability, and recovery. These measures are not a claim of certification or a guarantee against incidents.

We will notify the customer without undue delay after becoming aware of a personal data breach affecting covered data. We will share information reasonably available to help the customer meet its own notification duties, investigate and contain the incident, and provide further information as it becomes available. The customer remains responsible for any notices it must give to authorities or individuals.

The customer gives general authorization for subprocessors needed to provide Tyton. Our infrastructure includes Supabase for database and authentication and Cloudflare for network and infrastructure services. We will maintain information about subprocessors, give notice of intended additions or replacements, and allow the customer to object on reasonable data-protection grounds before the change. If an objection cannot be resolved, the customer may end the affected service. We impose data-protection obligations on subprocessors appropriate to the processing and remain responsible for their performance. Meta destinations and AI agents chosen independently by the customer are not automatically our subprocessors.

Our primary Supabase database was confirmed in Frankfurt, Germany on 23 September 2026, but Cloudflare, other providers, and our operations may involve international processing. We will use an applicable transfer mechanism where data protection law requires one and provide information about it on request. This DPA does not by itself execute EU standard contractual clauses or promise EU-only processing.

Taking account of the processing and information available to us, we will reasonably help the customer respond to data-subject requests, assess security and data-protection impacts, and consult regulators where required. We will make information reasonably needed to demonstrate our compliance with these processor obligations available and allow and contribute to audits by the customer or its appointed independent auditor, subject to reasonable confidentiality, security, and scheduling arrangements.

At the end of the service, at the customer's choice, we will return or delete covered personal data and delete existing copies unless law requires storage. We may use available export and deletion methods and will explain any legal retention or backup turnover that affects completion. The customer should request any export before closing access. If this DPA conflicts with the general terms about covered processing, this DPA controls for that processing.