Skip to content

Data processing agreement (DPA)

Updated October 12, 2026

Metrimato is designed so that visitor identifiers such as IP addresses and browser identification strings are not stored as part of the analytics data. Technical request data may be processed transiently while an incoming request is handled. We provide a data processing agreement as part of the contract, for clarity.

Subject of processing

Metrimato produces visitor statistics for the customer from anonymised event data. The data is collected from the customer's site according to the customer's instructions.

Duration and nature of processing

Processing lasts for the term of the contract. Data is deleted once the retention period chosen by the customer ends, or immediately when the account is deleted.

Subprocessors

A data centre service in Finland, Lettermint for delivering account management messages, Stripe for the payment and invoicing of the Metrimato subscription, and Cloudflare Turnstile for bot protection on the public invite request form. Neither Stripe nor Cloudflare has any access to the analytics data of the tracked sites: Stripe processes the subscription to Metrimato and nothing else, and Cloudflare sees no customer data at all. The complete list is below, by name.

Phenomenal Development Oy Development and operation of the service Finland Admin access to the production environment, and the customer's account details in a support situation
Lettermint Email delivery (password resets and other service messages) Netherlands (EU) The email addresses of the account's users and the content of the messages. No visitor data
Stripe Payments Europe, Limited Payment and invoicing of the Metrimato subscription Ireland (EU). Stripe group companies may also process payment data outside the EU under standard contractual clauses Only the Metrimato subscription: billing contact details, billing address and payment transactions. Card details are given directly to Stripe and never pass through Metrimato. Never any analytics data, Stripe has no access to the visitor data of the tracked sites at all
Cloudflare, Inc. Turnstile bot protection on the invite request form United States The IP address and technical browser details of the person filling in the invite request form, for the duration of the check. No customer data and no visitor data
OpenAI Optional More sales content analysis Processing may take place outside the EU/EEA Aggregate traffic figures and selected public page text. No visitor identifiers or individual journeys. Used only for analysis started or explicitly enabled by the customer

We tell customers about a new supplier 30 days before it is taken into use. We use no analytics, advertising or AI services to process customer data.

Technical and organisational measures

  • Anonymisation at the moment of receipt, identifying details are never written to disk
  • Encrypted transfer
  • Access control and a record of admin actions
  • Automatic deletion of data once the retention period ends

Transfers outside the EU

Individual visit and event records stay in the EU/EEA. Optional AI analysis sends aggregate traffic figures and selected public page text to OpenAI, which may process them outside the EU/EEA. No visitor identifiers or individual journeys are sent. Other external processing includes the following: Cloudflare protects the service's own invite request form against bots and sees the IP address of the person filling it in, and Stripe handles the payment of the Metrimato subscription as an Irish company whose group companies may process payment data outside the EU under standard contractual clauses. Stripe's processing covers the subscription only, never the analytics data of the sites.