This page is a summary. The signed agreement prevails over this page, and the privacy policy describes our processing in full.
1. Roles
For visitor data — data about the people who use the sites, apps and mini programs you measure — you are the controller and PathClue is the processor. Under China’s Personal Information Protection Law, you are the personal information handler and we are the entrusted party.
2. What we process
Page and screen views, events and their properties, referrer and campaign parameters, user agent, coarse location derived from the IP address, and an anonymous visitor identifier; plus any user IDs or profile fields you choose to send. In the default mode no cookies are used and IP addresses are never written to the database.
3. Your instructions
We process visitor data only to provide the service you configure — reports, alerts, exports and the features you turn on — and not for our own purposes such as advertising. Your settings in the console, including retention, consent requirements and data minimisation, are part of your instructions.
4. Security
Traffic is encrypted in transit; profile contact fields are encrypted at rest; access is role-based and tenant-isolated; administrative actions are logged; and production access is limited to staff who need it and are bound by confidentiality.
5. Sub-processors
We use sub-processors for cloud infrastructure, content delivery, transactional email and AI features, each bound by contract to equivalent data protection terms. A current list is available on request.
6. Location and transfers
Data is currently stored in the United States. Where personal data is transferred out of the region in which it was collected, we rely on recognised safeguards such as standard contractual clauses. Enterprise customers can self-host in their own region.
7. Data-subject requests and breaches
You can export or delete a person’s data from the console, and we help you respond to requests within the statutory deadline. We notify you of a personal data breach without undue delay and, where the GDPR applies, within 72 hours of becoming aware of it.
8. Retention and deletion
Visitor data is kept for your plan’s retention period, or shorter if you configure it, and then deleted. When you delete a site, a person or your account, the related data is deleted from production; backups roll over within 35 days.
9. Getting a signed DPA
Email hello@tapcub.com with your company name, address and the account email. We will send the agreement for signature.