Data processing agreement

Parties and roles

The customer, who installs Probant on their site, is the controller of their visitors’ data. Probant processes it on the customer’s behalf, as a processor within the meaning of the GDPR. Probant’s publisher is identified in the legal notice.

Subject matter of the processing

Assigning visitors to the customer’s sites to variants, applying those variants in the page, measuring exposures and conversions, and computing the results of tests and rollouts.

Data subjects

Visitors to the sites on which the customer installs the Probant script or the server-side assignment helper.

Data processed

• A random visitor identifier, kept in the probant_id cookie, first-party to the customer’s site.
• Events: type (visit, exposure, conversion, or measurement), test, variant, metric, value, sent date, and received date. Each carries the context of the visit: device type, new or returning visitor, source category, campaign, and landing page path. An exposure also carries the browser family (Safari iOS, Chrome Android…), derived by the server from the request’s User-Agent header, to diagnose a sample ratio mismatch.
• In the visitor’s browser: the tests seen (probant_exp), the exposures already sent during the session (probant_seen), and the events waiting for the consent tool (probant_file).

Events contain no IP address, no full User-Agent header, and no referrer.

Visitor consent

By default, a workspace requires consent: the script sets no cookie, assigns no one, and sends nothing before the visitor agrees, which the customer passes on every page. A refusal or withdrawal deletes the cookie and the local traces.

Retention period

• Events: deleted nightly after 13 months, counted from their receipt by the server.
• Visitor cookie: 390 days at most after the first visit, never extended beyond that. The server helper, when the customer installs it, may set it again with the same expiry.
• Customer data at the end of the contract: see “End of the contract” below.

Place of processing

Database and compute in Amsterdam, with Scaleway, in the European Union. Depending on the feature used, Mistral may temporarily transfer data outside the European Union to the subprocessors it publishes; its data processing agreement limits these transfers to countries the EU recognizes as adequate, or covers them with standard contractual clauses. Stripe transfers payment data to Stripe, LLC, in the United States, under the Data Privacy Framework and, failing that, standard contractual clauses. Whatever region is chosen, Sentry may keep the data of Probant’s Sentry account (members, settings, audit log, project descriptions) in the United States; reported errors stay in Frankfurt. Details, service by service, are on the Subprocessors page.

Sub-processors

The list is published on the Subprocessors page. Probant does not engage another subprocessor without the customer’s prior specific or general written authorization. In the case of general written authorization, Probant informs the customer of any intended changes concerning the addition or replacement of other subprocessors, thereby giving the customer the opportunity to object to such changes (GDPR, Article 28(2)).

Security measures

• Database closed by default: row-level security enabled on every table, with no policy; access only through the application, server-side.
• API keys stored as SHA‑256 hashes; the secret key is rejected by the public API.
• Consent required by default, daily purge of old events.

Details are on the Security and GDPR page.

Data breaches

Probant notifies the customer of any personal data breach without undue delay after becoming aware of it (GDPR, Article 33(2)).

Assistance and audits

From the application, the customer can delete all of a visitor’s data from their identifier, and export a workspace’s data. Probant makes available to the customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR, and allows for and contributes to audits, including inspections, conducted by the customer or another auditor mandated by the customer (GDPR, Article 28(3)(h)).

End of the contract

The customer exports a workspace’s data, then deletes the workspace and its content from its settings. At the end of the provision of services, Probant, at the customer’s choice, deletes all personal data or returns it to the customer, and deletes existing copies unless Union or Member State law requires storage of the personal data (GDPR, Article 28(3)(g)).

Signature

How this agreement is signed is not yet set.