Data Processing Addendum

1. Roles

For personal data in your workspace (for example names in your website’s content, people you invite, or figures from Google Analytics), you are the controller and Skail Consulting LLC (Skail Studio) is the processor. For the data we need to run our own business, such as billing contacts and sign-in records, we are a controller and the Privacy Policy applies. The same holds for what PageSoar’s heat map script records on your website (section 8). Under the CCPA we act as your service provider and do not sell, share, retain or use that data for any purpose other than providing PageSoar to you.

2. Instructions

We process workspace data only on your documented instructions, which are the Terms, your settings and what people in your workspace ask PageSoar to do, unless the law requires otherwise, in which case we tell you first where the law allows. The data concerns your website visitors, customers and staff, and is processed for as long as your workspace is open.

3. Confidentiality and security

People at PageSoar with access to workspace data are bound by confidentiality and see it only to operate and support the service. The measures we take are listed in Annex II below.

4. Subprocessors

You authorise the subprocessors on the subprocessors list. We will update that list and email workspace admins at least 14 days before adding or replacing one, and you may object; if we cannot meet the objection, you may end the affected service and receive a refund of prepaid fees for the time left. We hold each subprocessor to data protection terms at least as protective as these.

5. International transfers

Workspace data is stored in the United States. Where data moves out of the EU or EEA, the transfer relies on the European Commission’s standard contractual clauses (Decision 2021/914), incorporated here by reference: Module 2 (controller to processor) where you are the controller, and Module 3 (processor to processor) where you are yourself a processor for someone else. For both, clause 7 (docking) applies; in clause 9 option 2 (general authorisation, with the notice in section 4 above); clause 11’s optional wording does not apply; clauses 17 and 18 choose the law and courts of Ireland. For the UK, the UK International Data Transfer Addendum applies alongside them; for Switzerland, the clauses apply with the Swiss FDPIC as the supervisory authority. The annexes below complete them.

6. Helping you

We help you answer requests from people exercising their rights, and with security, impact assessments and consultations with authorities, as far as our part of the processing allows. We tell you without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting your workspace, with what we know.

7. Deletion and audits

When the service ends, we delete workspace data on your request, or return it first if you ask, unless the law requires us to keep it. We make available the information needed to show we meet this addendum and answer reasonable written audit questions once a year.

8. Heat maps on your website

If you put PageSoar’s heat map script on a website, it sends us, for each page view: the page’s path (the part of the address after the domain, without anything after a ? or #), whether the browser window is phone, tablet or desktop sized, its width, the height of the page, how far down the page the visitor scrolled and how much of it the first screen showed, and for each click its position on the page and which element was clicked, named by its tag, id and class names and its place among its neighbours, never by its text, with whether it looked clickable, whether the page answered the click within a second and whether it was clicked several times in quick succession, and the earlier pages of the same website shown in the same browser tab, at most 9, so the routes between pages can be counted, and, when the website marks the page as running an A/B test, the name of the test and of the version the visitor was shown, as the website names them, at most 3 tests a page. We never keep what anyone types into a form, the text on the page, the visitor’s network (IP) address, cookies, the browser’s identifying details (user agent), the address the browser reports the visitor came from (the referrer), so never a page on another website, or anything that links one visit to another. We keep each page view’s row 7 days; the daily counts the maps and the routes between pages are drawn from, 90 days, then delete them. The script does not run, and our server discards anything it is sent, when the browser sends Do Not Track or Global Privacy Control. A site’s consent banner can keep it off before it loads (window.pagesoarHeat = {optOut: true}) or stop it at any time (pagesoarHeat.stop()).

As the controller you decide whether to use it, tell your visitors in your own privacy notice, and ask their consent first where the law requires it. You can use or adapt this wording:

We use PageSoar to see, in total, how far visitors scroll and where they click on our pages and which pages they go to next, so we can improve them. It records the page, the pages of our site you saw before it in the same tab, the size of your screen, how far you scrolled and where you clicked. It never records what you type, your IP address or a cookie, and it does not run if your browser sends Do Not Track or Global Privacy Control. PageSoar’s privacy policy: https://pagesoar.com/privacy#privacy-heat

Report a security issue

Found a vulnerability? The Security page says where to write and what happens next. Give us time to fix it before telling anyone, and do not access data that is not yours.

Annex I: the parties and the processing

Annex II: technical and organisational measures

• Encryption in transit: every public address answers HTTPS only, with HSTS (frontdoor/fly.toml force_https; the front door sends Strict-Transport-Security).
• Encryption at rest: every workspace disk is a Fly.io volume created with encryption on.
• Isolation: each workspace runs on its own machine with its own disk, and its own key for connected credentials. A workspace holds no AI or market-data vendor key.
• Connected credentials (WordPress, Google) are kept in the workspace’s encrypted credential store.
• Passwords are stored only as scrypt hashes. Five wrong passwords lock an account for 15 minutes.
• Two-step sign-in (an authenticator app code, or a passkey verified on the person's device) is required by default for every workspace. A workspace that signs its people in through its own identity provider (OpenID Connect) relies on that provider's sign-in for them instead, and they cannot sign in any other way.
• Sessions are random, stored only as a hash, sent in HttpOnly cookies, and end after 12 hours, or 14 days when “Keep me signed in” is chosen.
• Roles within a workspace decide who may approve and publish; nothing is published without a person’s approval.
• Access logging: sign-ins, with their IP address, and administrative changes are recorded, and kept for 12 months.
• The heat map script’s data is built field by field from a fixed shape: no IP address, cookie, user agent, referrer, typed value or page text is stored, Do Not Track and Global Privacy Control are honoured on the server, and it is deleted on its own schedule (frontdoor/fd_heat.py).
• Records the service no longer needs are deleted on a schedule (Privacy Policy, “How long it is kept”).

Annex III: subprocessors

The list below is the one the subprocessors page shows.

Changes

• 17 October 2026: Heat maps: the name of an A/B test and of the version shown are processed when your site marks them.
• 16 October 2026: Heat maps: the earlier pages in the same tab are processed, and the suggested wording for your site says so.
• 15 October 2026: Adds heat maps: your visitors as data subjects, what is processed and kept, your duties as controller, and wording you can use on your own site.
• 8 October 2026: Annex II: a passkey counts as two-step sign-in, and a workspace's own identity provider can replace PageSoar's sign-in for its people.
• 25 September 2026: Selects the standard contractual clauses modules and adds Annexes I, II and III.
• 25 September 2026: First published.