Data Processing Addendum

1. Purpose

This Data Processing Addendum ("DPA") supplements the Privacy Policy and forms part of the Terms of Service. It describes in technical detail how visitor data flows through Bit7s, what is collected, what is anonymized, and the retention for each data category. It is designed to satisfy GDPR Article 28 and CCPA service-provider obligations.

2. Roles

• Data Controller - You (the Bit7s account holder) control the marketing pages, short links, and QR codes you create. You decide what destinations to link to and what images to publish.
• Data Processor - Bit7s acts as a processor for the visitor analytics generated by your pages. We process visitor data on your behalf to deliver the analytics features you requested.

3. Data We Collect From Your Visitors

When a visitor opens one of your marketing pages (/p/<page_code>), clicks one of your short links (/b/<short_code>), or scans one of your QR codes, we process the following data points:

4. Data Flow Diagram

The diagram below shows exactly what happens to a visitor's IP address and other data as it passes through Bit7s.

┌─────────────────────────────────────────────────────────┐
│ Visitor opens /p/<page_code> or /b/<short_code>            │
└────────────────────────────┬────────────────────────────┘
                             ↓
┌─────────────────────────────────────────────────────────┐
│ Step 1: Raw IP collection                                │
│   • IP address received from HTTP request               │
│   • Stored temporarily for anti-abuse & unique-visitor   │
│   • Retention: 30 days                                   │
└────────────────────────────┬────────────────────────────┘
                             ↓
┌─────────────────────────────────────────────────────────┐
│ Step 2: GeoIP resolution                                │
│   • IP passed to GeoIP database (one-time lookup)       │
│   • Resolved country & city stored in access log         │
│   • IP kept for short-term anti-abuse only              │
└────────────────────────────┬────────────────────────────┘
                             ↓
┌─────────────────────────────────────────────────────────┐
│ Step 3: Aggregation into statistics                     │
│   • Daily country / city / device / OS counts           │
│   • Referer attribution                                  │
│   • Aggregated counts only, no individual visitor IDs  │
│   • Retention: 12 months                                │
└────────────────────────────┬────────────────────────────┘
                             ↓
┌─────────────────────────────────────────────────────────┐
│ Step 4: Anonymization / aggregation                     │
│   • After 30 days raw IP is permanently deleted         │
│   • After 90 days referer / UA strings are deleted     │
│   • Only aggregate counts remain (no PII)              │
└─────────────────────────────────────────────────────────┘

5. Retention Schedule

6. Anonymization Methods

• IP anonymization - After GeoIP resolution, the raw IP is no longer needed and is purged on the 30-day boundary.
• Aggregation - Analytics dashboards show counts (e.g., "234 visitors from United States") not individual visitor records.
• Hashing for uniqueness - To detect unique visitors within the 30-day window, we use a one-way hash of (IP + User-Agent + short_code). The hash is salted and cannot be reversed to recover the original IP.

7. Sub-Processors

We use the following sub-processors to deliver the Service. All are bound by data processing agreements:

Bit7s acts as a processor for visitor analytics; payment providers act as independent controllers of payment data under their own privacy policies. We will provide at least 30 days' email notice before adding a new sub-processor, during which you may object on reasonable data-protection grounds.

8. Data Subject Requests

If a visitor to one of your pages asks us to delete their data or exercise a privacy right, we will forward the request to you as the Data Controller. You are responsible for responding within the timeline required by applicable law (30 days under GDPR, 45 days under CCPA).

For account-level requests (your own data), email privacy@bit7s.com and we will respond within 30 days.

9. Security Controls

• All traffic encrypted via TLS 1.3.
• Database access restricted to application servers via private network.
• Passwords hashed with pbkdf2_sha256.
• Regular automated database backups with at-rest encryption.
• Role-based access control on production infrastructure.

10. Breach Notification

In the event of a confirmed data breach affecting personal data, we will notify affected users and the relevant supervisory authority within 72 hours, as required by GDPR Article 33.

11. Contact

Questions about data processing? Email privacy@bit7s.com or see our contact page.