Skip to content
Start freeGo to your sites

Data processing agreement

We process your visitors' data only for you.

This agreement is part of our terms of service. It applies to every account, including stores that install the twelvebit Shopify app.

Updated 20 October 2026

1. The parties and the roles

This agreement is between you (the account owner, "you") and Twelvebit Technology Ltd, a company registered in England and Wales under company number 14829331, 167-169 Great Portland Street, Fifth Floor, London, W1W 5PF, United Kingdom ("we"). For the analytics data of your websites and stores, you are the controller and we are your processor. It applies under the UK GDPR, the EU GDPR (Article 28) and the data protection laws that apply to you.

2. What we process, and why

  • Purpose: to provide twelvebit to you: count visits, show where visitors come from, join payments and orders to the visits that led to them, and show the reports, alerts and exports that you ask for.
  • People: the visitors of your websites and stores, and the customers whose payments or orders reach twelvebit.
  • Data: random visitor and visit ids (none in cookieless mode), pages, referrers and campaign tags, country, region and city (from the IP address, which we do not store), device, browser and operating system, events and goals, and payments: amount, currency, product, time, and the provider's order or payment id. Email addresses and names only when you send them (identify calls, or a payment provider that you connect and that sends them). From the Shopify app: the order id and name, the checkout token, the Shopify customer id (a number) and whether it is a test order, never the customer's email, name, address or phone number.
  • Duration: for as long as the site is in your account. See section 7.
  • No special categories of personal data. Do not send them to twelvebit.

3. Your instructions

We process the data only on your documented instructions: these terms, your settings, and what you do in the dashboard, the API, the CLI and the MCP server. We do not sell the data, we do not use it for advertising, and we do not combine it with the data of other customers. If we think an instruction breaks the law, we tell you.

4. Confidentiality and security

  • Only the people who run twelvebit can open the production systems, and they are bound to keep the data confidential.
  • All connections use TLS, also the connection between the app and the database.
  • We store passwords and API keys only as hashes, and we encrypt the tokens and secrets of the stores and providers that you connect.
  • We do not store IP addresses. Cookieless mode stores nothing on the visitor's device.
  • On Shopify, the tracker follows the store's consent banner: it sets no cookie until the visitor allows analytics.

5. Subprocessors

You allow us to use the subprocessors listed in our privacy policy. Each one is bound by data protection terms that protect the data at least as well as this agreement. We update that list before a new subprocessor starts to process your analytics data, and we email account owners about the change at least 14 days before. If you object for a good reason, you can close your account and we delete your data.

Some subprocessors are outside the UK and the European Union. Where personal data goes to them, it is protected by the safeguards that the law accepts, such as standard contractual clauses or the UK international data transfer addendum.

6. Help with requests, breaches and checks

  • Requests from people: you can find a visitor and read all of their data in the dashboard and with the API (GET /api/v1/people/{id}). To delete one visitor's data, write to us and we delete it within 30 days. For Shopify stores we act on Shopify's requests to share or delete customer data.
  • Breaches: we tell you without undue delay, and within 48 hours, after we learn of a personal data breach that affects your data, with what we know and what we do about it.
  • Checks: we give you the information that you need to show that this agreement is followed, and we answer reasonable questions about our processing.

7. Deletion

  • When you delete a site, we delete its analytics data.
  • When you close your account, we delete your account data and your analytics data within 30 days.
  • When a store uninstalls the Shopify app, its orders stop at once. When Shopify asks us to delete the store's data (48 hours after the uninstall), we delete the store's orders and refunds. When Shopify asks us to delete a customer's data, we delete that customer's orders and refunds.
  • You can export your data with the API before you delete it.

8. Contact

Questions about this agreement or a request for a signed copy: privacy@twelvebit.io. If this agreement and the terms of service disagree on personal data, this agreement applies.