Website Auditor
Our Terms and Privacy Policy were updated on October 18, 2026. Read the Terms and the Privacy Policy.
Version dpa-2026-10-18 · effective October 18, 2026

Data Processing Agreement

This Data Processing Agreement ("DPA") applies when you ("Customer") use Website Auditor's AI referral counter (the "Counter"). It is between you and Armstrong HoldCo LLC ("Provider", "we"), forms part of our Terms and Conditions, and takes effect when you accept it below. Where this DPA and the Terms differ about Counter data, this DPA prevails; where the Standard Contractual Clauses apply, they prevail over both.

1. Roles

For Counter data, Customer is the controller (and the "business" under the California Consumer Privacy Act) and decides to add the Counter to its website and why. Provider is Customer's processor, service provider and contractor, and processes Counter data only on Customer's documented instructions, which are this DPA and Customer's use of the Counter's settings. Where Customer adds the Counter to a website for its own client, Customer is that client's processor and Provider is Customer's sub-processor; Customer must have a contract with its client that is at least as protective as this DPA.

2. What is processed

  • Subject matter and purpose: counting visits that reach Customer's website from the named AI assistants (ChatGPT, Perplexity, Gemini, Copilot and Claude) and reporting daily aggregate counts to Customer, so Customer can see which pages assistants send people to and improve them. This is the only business purpose.
  • Nature: the Counter's script runs in the visitor's browser on Customer's website, checks where the visit came from, any utm_source or utm_medium tag, and whether the page was freshly opened, and only for a visit from a named assistant sends one request to Provider. Provider adds it to a daily total.
  • Data: the name of the assistant; the landing page's path, with identifiers removed, or only "/" (the default, until Customer confirms its website is not about health or another sensitive subject); Customer's site key; and, as part of every web request, the visitor's IP address and browser details, which Provider's own code does not read, log or keep.
  • Data subjects: visitors to Customer's website. Every page that carries the Counter loads its script from Provider, so each visitor's browser makes that request; only visitors who arrive from a named AI assistant send a count.
  • Duration and retention: for as long as Customer uses the Counter. Provider keeps only daily totals per website, assistant, page and signal, for 13 months, then deletes them.

3. Provider's obligations

No own use. Provider shall not process Counter data, or data derived from it, for its own purposes, including to compile statistics across customers, benchmarks, research, publications, or to train or improve models or classifiers, except (i) as necessary to provide, secure, bill for and support the Counter for Customer, and (ii) as Customer specifically authorises in writing for a named purpose. Provider shall not combine Counter data with personal information it receives from or on behalf of anyone else, or collects from its own interactions, and shall not attempt to re-identify anyone from it.

California and other US state laws. Provider shall not sell or share Counter data, shall not retain, use or disclose it for any purpose other than the business purpose in section 2 or outside the direct business relationship between Customer and Provider, shall comply with the applicable obligations of the California Consumer Privacy Act and provide the same level of privacy protection it requires, and shall tell Customer if it can no longer meet its obligations. Customer may take reasonable and appropriate steps to ensure Provider uses Counter data consistently with this DPA and, on notice, to stop and remediate unauthorized use. These terms are intended to meet 11 CCR § 7051 and the processor-contract requirements of other US state privacy laws; nothing in this DPA relieves either party of its own obligations under those laws.

Confidentiality and security. Provider ensures that the people who can access Counter data are bound by confidentiality, and maintains the measures in section 5. Provider tells Customer promptly if it believes an instruction infringes data protection law.

Assistance. Provider holds no identifier for any visitor, so it cannot find one person's data; it will forward to Customer any request it receives from a visitor and help Customer, taking into account the nature of the processing, with data subject requests, impact assessments and consultations with authorities.

4. Customer's obligations

  • Lawful use and notice. Customer decides whether its use of the Counter is lawful, chooses the install mode the setup screen offers for its visitors, publishes a notice in its privacy policy that names website-auditor.io and says what the Counter does (Provider supplies text), and gives visitors any choice its law requires.
  • Where the Counter may not be used. Until Provider announces that it has appointed representatives in the European Union and the United Kingdom, Customer may use the Counter only on websites that are not directed at people in the European Economic Area or the United Kingdom. Customer may never use it: on websites of, or on behalf of, entities covered by HIPAA or their business associates (Provider signs no business associate agreements); on pages behind a sign-in, or account, portal, basket, checkout or payment pages; on websites or sections directed at children; or to measure the performance of advertising.
  • Paths. Customer keeps personal data out of its website's addresses, and turns paths on only for a website that is not about health, sexuality, finances, legal matters or another sensitive subject.
  • Instructions. Customer's instructions must comply with the law.

5. Security measures

  • All traffic is encrypted with TLS. The Counter sends no cookie, sets no identifier, and sends no referring address.
  • On both of the Counter's addresses (the script and the count), Provider's code never reads the visitor's IP address or browser details, there is no per-visitor rate limit, and their requests are excluded from Provider's hosting logs.
  • Paths are scrubbed of identifiers in the browser and again on the server; sign-in, account and checkout pages send nothing; sensitive paths are kept only as "/".
  • Counts are stored per website, readable only through that website's own account; no role can read them directly, and no view or function may read them across websites or with other data, which an automated check enforces.
  • Access to production systems is limited to the people who run the service.

6. Sub-processors

Customer authorises these sub-processors, each bound by written terms at least as protective as this DPA:

Provider will email Customer before adding or replacing a sub-processor. If Customer objects, its remedy is to stop using the Counter, and Provider will delete its counts under section 9.

7. International transfers

Provider and its sub-processors are in the United States. Where Counter data includes personal data protected by the laws of the European Economic Area, Switzerland or the United Kingdom, the following apply. If and while Provider is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, Provider relies on that certification. Whenever it is not certified, or the framework does not cover the transfer or ceases to be valid, the Standard Contractual Clauses apply automatically: the European Commission's clauses (Decision (EU) 2021/914), Module Two (Module Three where Customer is a processor), with the option in clause 7 not used, option 2 of clause 9(a) (general authorisation, with the notice in section 6), the option in clause 11 not used, the competent supervisory authority under clause 13 determined by Customer's establishment or, failing that, Ireland's, and the law and courts of Ireland under clauses 17 and 18; for the United Kingdom, the International Data Transfer Addendum issued by the Information Commissioner, with its tables completed from this DPA; and for Switzerland, the same clauses read with references to the Swiss Federal Act on Data Protection and the Federal Data Protection and Information Commissioner. Sections 1, 2, 5 and 6 of this DPA complete the clauses' annexes.

8. Personal data breaches

Provider will notify Customer without undue delay after becoming aware of a personal data breach, or of any violation or attempted violation of the security of Counter data: with an initial notice within 24 hours of becoming aware and no later than 48 hours, followed by what Provider knows of its nature, the data affected, its likely consequences and the measures taken.

9. Deletion

When Customer removes a website from its account, stops using the Counter or closes its account, Provider deletes that website's counts within 30 days and confirms in writing on request. Backups expire on the database provider's schedule and are never restored for any other purpose.

10. Audits

Provider makes available the information necessary to demonstrate compliance with this DPA, answers Customer's reasonable written questions about it once a year (or more often where a breach or a regulator requires), and allows audits, including inspections, by Customer or an auditor it mandates, on 30 days' notice, at Customer's cost, where the information provided is not enough.

11. Liability

Provider is responsible for claims arising from its breach of this DPA, its security failures, its sub-processors' failures and any use of Counter data for its own purposes. Customer is responsible for claims arising from its decision to use the Counter, its choice of install mode, its notices and consent, its use of the Counter where section 4 forbids it, personal data in its website's addresses, and its instructions, including claims under wiretap and state privacy laws. Each party's liability under this DPA is subject to the limits in the Terms, except where the law does not allow liability to data subjects or authorities to be limited.

12. Changes and term

Provider will email Customer at least 30 days before a change to this DPA takes effect and ask Customer to accept the new version; until Customer does, Provider stops counting for Customer's websites. This DPA lasts for as long as Provider processes Counter data for Customer. Questions about it: support@website-auditor.io.