Tacilytics1. Parties and subject
Controller: the holder of the Tacilytics Cloud account (“you”). Processor: Fabian Budde, Am Eickhagen 9, 59909 Bestwig, Germany (“we”). We process personal data on your behalf to provide Tacilytics Cloud under the terms of use (section 8). This agreement runs as long as your account exists, and until the data has been deleted.
2. Nature, purpose and data
Purpose: counting and showing visits and events on your websites and apps. Data subjects: visitors of your websites and users of your apps. Data: page address, referrer, UTM parameters, browser, operating system, device class, language, timezone and the country derived from it, visit duration and scroll depth, names and properties of events you send (for example a purchase value), and a pseudonymous visitor hash for the current day. IP addresses and the user agent are only used in memory to form this hash and are never stored; the random value behind the hash is replaced every day. No cookies or similar identifiers are stored on the visitor's device.
3. Your instructions
We process the data only on your documented instructions. The terms, this agreement and the settings you make in the dashboard are your instructions. If we think an instruction breaks data protection law, we tell you. We only process the data in other ways if EU or German law requires it; then we inform you first, unless the law forbids that.
4. Confidentiality
Only people who need it for the service have access, and they are bound to confidentiality.
5. Security (Art. 32 GDPR)
- Data minimisation by design: no IP addresses, no cookies, daily changing visitor hash.
- Servers in Germany in an ISO/IEC 27001 certified data centre (Hetzner Online GmbH); access only via SSH keys and encrypted connections.
- All connections to the service use TLS. Passwords are stored as scrypt hashes; two-factor authentication and passkeys are available.
- Each account sees only its own websites; this separation is covered by automated tests.
- Regular updates of operating system and software; backups of the database.
6. Sub-processors
You agree to these sub-processors: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (servers and data centre in Germany). We inform you by email at least four weeks before adding or replacing a sub-processor; you can object, and if we cannot agree you may cancel at the time of the change. We bind every sub-processor to the same obligations. Stripe is not a sub-processor for your visitors' data; it handles your payment as an independent controller.
7. Support
We help you, as far as possible with appropriate technical and organisational measures, to answer requests from data subjects and to meet your obligations under Articles 32 to 36 GDPR. Most requests you can answer yourself in the dashboard: filtering, export as CSV, deleting a website deletes its data.
8. Data breaches
We inform you without undue delay, and where possible within 48 hours, after we become aware of a personal data breach that concerns your data, with the information we have.
9. Deletion and return
You can export your data at any time. When you delete your account, we delete the data at once. If your account is paused, we delete it thirty days later, after a warning by email. Backups are overwritten within 30 days.
10. Proof and audits
We make available the information needed to show that we meet these obligations, and we allow audits by you or an auditor you appoint, with reasonable notice, during business hours and without disclosing other customers' data. Documents and answers in writing come first.
11. Other
If there is a conflict, this agreement takes precedence over the terms of use for data protection matters. German law applies.
Last updated: 15 October 2026.