Data processing agreement
Last updated 5 November 2026
This agreement is between you, the customer (the “controller”), and Victor Abuchi, Kuopio, Finland, who runs Statiku (the “processor”). It's part of the terms of service and applies whenever Statiku processes personal data for you, as Article 28 of the General Data Protection Regulation (GDPR) requires. If you need it signed on paper, email contact@victorabuchi.com.
1. What, why and for how long
| Purpose | Providing Statiku to you: counting visits and app use, showing reports and the live view, sending your alerts, and importing your history. |
|---|---|
| People | Visitors of your websites and users of your apps. |
| Data | A visitor code (a hash with a key that changes daily); page addresses, referrers and campaign tags; country (kept) and approximate city (in memory only, while they visit); browser, system and device type; the events you choose to send; app install IDs, versions and licence state; exact location only when a visitor agrees to share it (held in memory, to about 10 metres, while they visit). IP addresses are used in memory and never stored. |
| Special data | None. Don't send special categories of data, or details that identify people, to Statiku. |
| Duration | For as long as you use Statiku, until you delete the site or your account. |
2. What we promise
- We process the data only on your documented instructions: these terms and the settings you choose in Statiku, unless EU or Finnish law requires otherwise, in which case we'll tell you first if the law allows.
- Everyone who can reach the data is bound to keep it confidential.
- We protect it with the measures in section 6.
- We help you answer requests from the people whose data it is, and with data protection impact assessments and consultations, as far as we reasonably can.
- We tell you of a personal data breach without undue delay, and within 48 hours of learning of it, with what we know and what we're doing about it.
- When you delete a site or your account, its data is deleted from our database at once; copies in our backups are gone within 7 days.
- We give you the information you need to show that this agreement is kept, and allow an audit by you or an auditor you choose, at your cost, with reasonable notice, at most once a year unless a breach calls for more.
3. Sub-processors
You authorise us to use these sub-processors. We bind each to data protection obligations as strict as these, and remain responsible for them. We'll email you at least 30 days before adding or replacing one; if you object for good reason and we can't solve it, you may end the terms and get back what you paid for the time that remains.
| Sub-processor | What for | Where the data is |
|---|---|---|
| Oracle (Oracle Cloud Infrastructure) | Servers and database | Stockholm, Sweden |
| OpenStreetMap Foundation | Street names for the locations visitors agree to share; only on sites that turn exact location on | United Kingdom |
4. Transfers
Your visitors' data is stored in the EU. Where a sub-processor outside the EU can reach it, the transfer relies on an adequacy decision of the European Commission (the United Kingdom; US companies certified under the EU-US Data Privacy Framework) or on the Commission's standard contractual clauses.
5. Your part
You're responsible for having a lawful basis for counting your visitors, for telling them about it in your privacy policy, and for asking for consent where your law requires, including before you turn on exact location.
6. How the data is protected
- Everything travels encrypted (HTTPS). The database runs in Stockholm on disks that our host, Oracle, encrypts.
- IP addresses are never stored. The key behind each day's visitor codes is deleted after a day, so codes can't be traced back to anyone or linked across days.
- No cookies or identifiers are stored on visitors' devices.
- Approximate cities and shared locations are held only in memory, while the visitor is on the site.
- Customers' passwords are hashed with scrypt; sign-in tokens, reset links and invitations are kept only as hashes; tokens from other services are sealed with AES-256-GCM.
- Sign-ins and password resets are limited against guessing; requests that change data must come from Statiku's own pages; addresses Statiku fetches for you can't reach private networks.
- Each customer sees only their own sites, and only the people they invite see them too.
- The database can be restored to any moment in the last days, and restores are tested.