Updated 5 October 2026

This is a translation provided for convenience. Only the French version is legally binding.

Data Processing Agreement (DPA)

Version applicable during the private beta.

This data processing agreement (the "DPA") is entered into, in accordance with article 28 of the GDPR, between the Client, controller of the web analytics and, where applicable, of the SEO analysis of their sites, and Alexandre Ribes EI (La Boîte à Code), publisher of Quiet Metrics, acting as processor (see the legal notice).

1. Subject matter, duration, nature and purpose of the processing

The processor carries out, on behalf of the Client, the web analytics without any identification or tracking cookie of the sites the Client declares in their account: collection of hits, computation of ephemeral pseudonymous fingerprints, sessionisation, statistical aggregation, and reporting (dashboards, API, reports, exports). The processing lasts as long as the Client's subscription, reversibility included (§ 9).

When the Client authorises the SEO analysis of a site by publishing on it the proof of ownership provided for in article 5 bis of the Terms of Use, the processor also visits the public pages of that site with its robot, QuietMetricsBot, in order to record their technical search-engine characteristics, cross them with the web analytics and report them to the Client (dashboards, reports, MCP server).

2. Data processed and data subjects

Data subjects: the visitors of the Client's sites and, for the SEO analysis, the persons whose data the Client itself publishes on the public pages of its sites (see below).

The Client undertakes not to transmit directly identifying or sensitive data in custom events (Terms of Use, art. 4). The service allows neither cross-site nor cross-day tracking of visitors.

Terminal storage. The collection tools write on the visitor's device no identifier, and no value allowing them to be recognised from one visit to the next. Two values, and only two, may be written there:

• the opt-out marker qm_ignore, written at the visitor's express request and in order to stop the measurement: a first-party cookie of the Client's site doubled by a local storage entry, lasting 5 years. It is never transmitted to the processor and is not processed by it in any way;
• the visit continuity cookie qm_visit, written by the measurement so that a network change occurring during a visit does not cause the same person to be counted twice: a first-party cookie of the Client's site, lasting 10 sliding minutes, with no local storage counterpart. Its presence alone, and never its content, is signalled to the processor in order to attach the page view to the visit under way. It is not written on the device of a visitor carrying the opt-out marker, the measurement then being stopped before any write.

Neither of these two values contains an identifier, their content being the same for every visitor. The Client, responsible for the terminal equipment of the visitors to their site, will find the full description in the cookie policy.

SEO analysis. It does not target visitors: the robot only reads the public pages of the site, accessible without authentication, and submits no form on them. The only persons who may be concerned, incidentally, are those whose data the Client itself publishes on those pages, for instance an author's name in a title.

The HTML code of the pages is not kept. The robot stays within the scope whose ownership is proven. It respects the site's robots.txt file, as read at the start of each analysis, for every address, sitemaps and redirects included; only the address of the proof of ownership and that of the robots.txt file are requested in all cases. It is not counted in the web analytics.

3. Documented instructions

The processor processes the data solely on the Client's documented instructions, made up of: this DPA, the Terms of Sale and Terms of Use, and the settings made by the Client in their account (declared sites, exclusions, plan retention, goals, campaigns and custom events); for the SEO analysis, the proof of ownership published on the site, the paths the Client removes from it and the frequency of the SEO report. The processor immediately informs the Client if an instruction appears to it to infringe the GDPR or applicable law, and may suspend its execution pending a lawful instruction.

4. Confidentiality and personnel

Any person authorised to process the data is bound by an obligation of confidentiality. Access to production systems is restricted, named and logged.

5. Security (art. 32 GDPR)

The technical and organisational measures are set out in the annex to this DPA.

6. Sub-processing

The Client gives general authorisation for the use of the following sub-processors:

The SEO analysis is carried out from the same infrastructure, with no additional sub-processor.

Any change to this list is notified to the Client (email or member area) at least 30 days in advance, with a right to object; where a legitimate objection is not resolved, the Client may terminate with the reversibility of § 9. Sub-processors are bound by obligations equivalent to this DPA; the processor remains fully liable for their performance.

Any AI assistance features or MCP servers of the Service do not process personal data of visitors: they only cover aggregated results, the technical characteristics of public pages recorded by the SEO analysis and the account holder's messages. The corresponding AI providers therefore do not constitute sub-processors within the meaning of this DPA and are described in the privacy policy.

Four providers appear in the table of § 4 of the privacy policy without constituting sub-processors within the meaning of this DPA, since they do not take part in the web analytics carried out on behalf of the Client: Stripe (payment and billing of the subscription), Spirion (service-smtp.fr: delivery of service emails sent to the account holder), Proton (receipt of contact and support messages) and Cloudflare (anti-bot protection of the contact and registration forms). The corresponding data is that of the account holder or of a visitor to the quietmetrics.dev site, for which the publisher acts as controller, and not that of the visitors of the Client's sites. The periodic reports carried by Spirion contain only aggregated results and, for the SEO report, the technical findings recorded on the site's public pages and the audience trend of some pages; none contains any personal data of visitors within the meaning of § 2. Using one of these providers to process data of visitors of the Client's sites would require its prior addition to the table above, subject to the notice period provided for in this article.

7. Assistance to the Client

The processor assists the Client, taking into account the nature of the processing:

• Data subject rights: the design of the service generally makes the processor unable to identify a visitor (art. 11 GDPR: no identifying data kept, non-reversible fingerprints). It provides the Client with any information useful to answer a request, in particular the public How we count page.
• Requests received directly: any request manifestly relating to the Client's processing received by Quiet Metrics is passed on to the Client without answering it on the merits, save for a documented instruction or a contrary legal obligation.
• Impact assessments (DPIA) and prior consultations: technical documentation and cooperation on request.
• Security: reasonable cooperation in the event of an audit or an incident.

8. Notification of data breaches

The processor notifies the Client of any personal data breach without undue delay and at the latest within 48 hours of becoming aware of it, at the administrative address of the account and through any emergency channel communicated by the Client. The initial notification may be completed progressively and includes, to the extent available, the nature of the breach, the categories and volumes concerned, the likely consequences, the measures taken or proposed, and a point of contact.

9. Fate of the data at the end of the contract

At the end of the subscription and at the Client's choice:

• the personal data still held on their behalf is returned to them, or transferred to another designated processor, in a structured, commonly used format, then deleted along with the remaining copies;
• or it is deleted without prior return.

Unless immediate deletion is requested, the available statistics remain exportable in CSV during a reversibility period of 30 days. API access remains subject to the conditions of the plan, which reserves it for the Pro and Agency plans: it is therefore not guaranteed during reversibility, and CSV export is the route that is. During that period, the Client may request at legal@quietsystems.dev a structured return of the data still held and of the settings of their account. On its expiry, the account data is deleted, subject only to legal retention obligations; data archived for that purpose is isolated and no longer used to provide the Service. A deletion certificate is provided on request. The hashing salts are, in any event, destroyed in accordance with their daily rotation.

10. Audit and documentation

The processor makes available the documentation needed to demonstrate compliance with this DPA (technical documentation, records, description of the measures). The Client may carry out or mandate one audit per 12-month period, at their own cost, on 30 days' notice, on working days, without access to other clients' data and subject to a confidentiality agreement.

11. Records and cooperation with the supervisory authority

The processor keeps the record of categories of processing activities (art. 30.2 GDPR) and cooperates, on request, with the CNIL.

Annex: technical and organisational measures

• Pseudonymisation at ingestion: fingerprint = hash with a daily secret salt of (subscriber network, browser, site), the subscriber network being the whole address in IPv4 and the /64 prefix alone in IPv6. The day is understood in the Site's time zone, the very one in which its statistics are presented; the salt for a day D is specific to that time zone and destroyed at the latest 6 hours after midnight D+1 in that time zone. Fingerprints then become definitively non-reversible and non-linkable.
• Encrypted and bounded transit: the IP address and the User-Agent are never written to the measurement tables; the queue payload is encrypted, purged every 5 minutes beyond 15 minutes, and failures are purged in less than 2 hours.
• Encryption: TLS in transit; site secret keys encrypted at rest; passwords hashed (adaptive algorithm).
• Partitioning: fingerprints specific to each site (no cross-site linking); data access limited to the owning account (systematic authorisation checks).
• EU hosting: platform and data hosted in France (OVH). Daily backup of the database, encrypted, kept for 30 days in the publisher's monitoring tool, hosted on the same infrastructure. Commercial opening is conditional on an additional off-server copy and a documented restore test.
• Error reports: collection requests are excluded from the application's error reports; no data of visitors to the Client's sites appears in them.
• Access and logging: named production access, least-privilege principle, logging of administrative access.
• Incident management: escalation procedure, qualification of breaches, keeping of an incident record and contractual notification to the Client.
• Limitation by design: bounded collection payload (4 KB), cardinality caps, bot filtering, removal of the query string and masking of emails, UUIDs and opaque tokens in URL paths.
• SEO analysis robot: no page requested without proof of ownership of the site, checked at the start of each analysis (without it, only the address of the proof is requested); robots.txt file respected for every address, sitemaps and redirects included; one page per second at most; no connection to a private or reserved address; bounded response size; HTML code not kept.
• Bounded retention: daily automatic purging of detailed events and of statistical aggregates beyond the plan's retention; the aggregates are moreover free of personal data.