Data Processing Addendum

The data-processing terms that apply when TypeUI Insights handles your website analytics.

Effective date: August 20, 2026

What this means for you

When you use Insights, you normally decide why your website analytics is collected and how it is used. TypeUI processes that data to provide the service for you. In practical terms:

• you control installation, consent, events, access, and deletion;
• we process the data only to provide, protect, and support Insights;
• we use the providers listed below to run the service;
• we help with privacy requests and incidents where required; and
• your analytics is deleted according to the documented subscription, recovery, and backup periods.

The numbered sections below are the formal terms. This summary helps you navigate them but does not replace or change those terms.

This Data Processing Addendum ("DPA") forms part of the TypeUI Terms of Service or another written agreement between the customer ("Customer") and Bergside LLC ("Bergside") governing Customer's use of TypeUI Insights (the "Agreement"). It applies when Bergside processes Customer Personal Data on Customer's behalf through TypeUI Insights.

A person accepting this DPA for an organization represents that they have authority to bind that organization. Use of TypeUI Insights after the effective date constitutes acceptance of this DPA unless the parties have signed a different data processing agreement.

1. Definitions

"Applicable Data Protection Law" means privacy and data protection law applicable to the processing covered by this DPA, including the GDPR where it applies. "Customer Personal Data" means personal data, if any, processed by Bergside on Customer's behalf through TypeUI Insights. "GDPR" means Regulation (EU) 2016/679. "Subprocessor" means another processor engaged by Bergside to process Customer Personal Data.

The terms controller, processor, business, service provider, personal data, processing, data subject, and supervisory authority have the meanings given by Applicable Data Protection Law.

2. Roles and instructions

Customer is generally the controller or business and Bergside is generally the processor or service provider for Customer Personal Data. Customer instructs Bergside to process that data to provide, secure, support, meter, share when Customer enables a read-only shared dashboard, and delete TypeUI Insights as described in the Agreement, this DPA, the Insights Data Policy, and Customer's use and configuration of the Service.

Bergside will process Customer Personal Data only on Customer's documented instructions unless law requires otherwise. If legally permitted, Bergside will inform Customer before processing required by law. Bergside will notify Customer if it reasonably believes an instruction violates Applicable Data Protection Law.

3. Customer obligations

Customer is responsible for:

• having all rights, notices, lawful bases, and consents needed for the processing it instructs;
• configuring consent activation and withdrawal in accordance with applicable ePrivacy, cookie, and data protection rules;
• ensuring page paths, campaign values, event names, and captured pages do not disclose personal or sensitive information to Insights;
• responding to data subjects and supervisory authorities as controller;
• restricting dashboard access to authorized people and protecting its account credentials;
• choosing an appropriate shared-dashboard visibility mode, protecting any shared password, and providing notices or obtaining a lawful basis for analytics Customer deliberately makes available to others; and
• completing any required DPIA, transfer assessment, consultation, or records of processing.

4. Confidentiality and personnel

Bergside will limit access to Customer Personal Data to personnel and contractors who need access to provide or secure the Service and who are subject to appropriate confidentiality obligations. Bergside remains responsible for their compliance with this DPA to the extent required by law.

5. Security

Taking account of the nature, scope, context, and purposes of processing, Bergside will maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. The current measures are summarized in Annex II and on the Security page.

Customer acknowledges that no system is risk-free and that the Service is not an archival or backup service. Customer is responsible for maintaining independent copies or exports required for its legal, operational, or business purposes.

6. Subprocessors

Customer gives Bergside general authorization to use the Subprocessors listed in Annex III. Bergside will require each Subprocessor to protect Customer Personal Data through written obligations appropriate to the services it provides. Bergside remains responsible for Subprocessor performance to the extent required by Applicable Data Protection Law.

Bergside may update the list when needed to operate the Service. If a new Subprocessor materially affects Customer Personal Data, Bergside will provide reasonable notice through the Service, this page, or another appropriate channel. Customer may object on reasonable data-protection grounds by contacting Bergside promptly. The parties will work in good faith on a commercially reasonable alternative; if none is available, Customer may stop the affected processing and terminate the affected Insights service.

7. International transfers

Customer authorizes processing in the countries where Bergside and its Subprocessors operate, subject to Applicable Data Protection Law. Cloudflare uses a globally distributed network, and not every request or transient operation is guaranteed to remain in the EEA. Private preview and analytics-recovery storage is configured with Cloudflare's EU jurisdiction.

Where a restricted transfer requires a transfer mechanism, the parties will rely on an available lawful mechanism applicable to the relevant provider and transfer, such as an adequacy decision, the EU Standard Contractual Clauses, or another legally recognized safeguard. Customer remains responsible for its assessment of the transfer in its role as controller.

8. Data-subject and compliance assistance

Taking account of the nature of processing and information available, Bergside will provide reasonable assistance so Customer can respond to requests to exercise data-subject rights and meet applicable security, breach, DPIA, consultation, and accountability obligations. If Bergside receives a request relating to Customer Personal Data, it may direct the requester to Customer unless law requires a different response.

Insights intentionally does not expose a persistent visitor identity and may not be able to associate a name or email address with a particular pseudonymous session. Assistance is limited to data reasonably identifiable in the Service and may be subject to reasonable fees for disproportionate or exceptional work where permitted by law.

9. Personal data incidents

Bergside will notify Customer without undue delay after confirming a breach of security affecting Customer Personal Data where notification is required by Applicable Data Protection Law. The notice will include information reasonably available to Bergside about the nature, consequences, mitigation, and contact point. Notification is not an admission of fault or liability.

10. Return, retention, and deletion

During an active Insights subscription, Customer may view and export available analytics and may delete an Insights website from the dashboard. Detailed sessions, their page journeys, and connected custom events are retained on a rolling 90-day basis. Aggregate traffic, engagement, and UI-interaction analytics remain available during the active subscription.

When Insights access ends, collection pauses and remaining Customer Personal Data is retained for a 30-day recovery period. Reactivation during that period cancels scheduled deletion but does not restore information that already reached its normal 90-day limit. If access is not restored, the corresponding analytics, collector configuration, and private heatmap previews are automatically deleted.

Customer may instruct earlier deletion through the product. Deletion is irreversible through the Service and removes the live service copy immediately. A separate, product-inaccessible disaster-recovery copy may remain in private provider storage for up to 32 days under its protected retention period. Bergside may also retain limited information when required by law or in provider recovery systems until ordinary deletion cycles complete, provided that retained information remains protected and is not used for another purpose.

Shared-dashboard tokens, visibility settings, and password hashes follow the related website lifecycle and are removed when the website is deleted. Customer can also rotate the token or return the website to private. Temporary password-attempt records used for rate limiting are kept only for a short operational period, and shared access sessions expire automatically.

11. Audit information

On reasonable written request, Bergside will provide information reasonably necessary to demonstrate compliance with this DPA. If that information is insufficient and Applicable Data Protection Law requires an audit, Customer may request one no more than once per year, during normal business hours, with reasonable notice, and subject to confidentiality, security, and non-disruption requirements. Customer bears its audit costs and Bergside's reasonable costs unless an audit identifies a material breach by Bergside.

12. Liability

Each party's liability under this DPA is subject to the exclusions and aggregate limits in the Agreement. To the maximum extent permitted by law, Bergside is not liable for loss, corruption, delay, unauthorized access, unavailability, or deletion of Customer data. The sole monetary remedy for a direct claim arising from an Insights security incident, service unavailability, or data loss is limited to a refund of no more than the Insights fees actually paid for the most recent billing cycle, and Bergside's aggregate liability will not exceed that amount. Nothing in this DPA excludes or limits a data subject's compensation rights or any other liability or remedy that cannot lawfully be excluded or limited.

13. Order of precedence and duration

If this DPA conflicts with the Agreement on processing Customer Personal Data, this DPA controls. The Agreement otherwise remains in effect. This DPA continues while Bergside processes Customer Personal Data and the confidentiality and deletion obligations that by their nature survive termination remain effective.

Annex I — Processing details

• Subject matter: privacy-conscious website traffic, engagement, campaign, event, journey, and UI interaction analytics.
• Duration: detailed sessions, page journeys, and connected events use a rolling 90-day window; aggregate analytics use the active Insights subscription, followed by the documented 30-day recovery period unless Customer deletes data earlier or law requires retention.
• Nature and purpose: collection, validation, aggregation, storage, filtering, visualization, export, support, security, quota enforcement, Customer-directed read-only sharing, and deletion.
• Data subjects: visitors to Customer websites on which Customer enables the tracker.
• Data categories: the fields described in the Insights Data Policy, including pseudonymous session and page identifiers, normalized paths, timestamps, engagement, coarse device and location categories, acquisition and campaign values, custom event names and numeric values, quantized interactions, and customer-requested page previews.
• Sensitive data: not intended or permitted. Customer must not configure Insights to transmit special-category, sensitive, financial, health, authentication, children's, or similarly protected data.

Annex II — Technical and organizational measures

• HTTPS transport for public and authenticated product traffic.
• Authenticated accounts, workspace authorization, data-access controls, private dashboard access, optional MFA, and account-recovery controls.
• Authenticated service-to-service access controls for private operations.
• Input and origin validation, service limits, and automated abuse protections.
• A rolling workspace pageview allowance enforced before analytics storage, with whole-batch rejection when a write would cross the paid limit; sessions and events do not independently reduce the paid allowance.
• Data minimization, quantized interaction coordinates, constrained custom events, and exclusion of raw IP and complete user-agent values from Insights analytics.
• Restricted storage and authenticated access for customer-requested previews.
• Restricted recovery copies with protected retention controls.
• Private-by-default sharing, access controls, read-only shared views, and indexing controls for non-public modes.
• Access limitation, confidentiality obligations, dependency updates, testing, and provider security controls.
• Customer-controlled deletion and automated deletion after the recovery period.

Annex III — Subprocessors

Contact

Questions or requests concerning this DPA may be submitted through the Bergside contact page.