Data processing agreement

Effective September 28, 2026

When you measure your websites, links and pixels with lyli, you decide what’s collected and we process it for you. This agreement sets out how, as Article 28 of the GDPR (and the UK GDPR) requires. It’s part of our terms of service and applies automatically: there’s nothing to sign. If you need a signed copy, write to hey@lyli.io.

1. Parties and roles

This agreement is between the customer who uses lyli (“you”, the controller) and Björkén Media AB, org. nr 559486-2194, Gamla Kyrkogatan 4, SE-261 31 Landskrona, Sweden (“we”, the processor). It covers the personal data we process on your behalf through lyli (“your data”), described in Annex 1. The data we keep about lyli’s own users, as controller, is described in our privacy policy instead.

2. Your instructions

We process your data only to provide lyli to you under the terms of service and as you set it up (your sites, links, pixels and their settings), and on your other documented instructions. If we believe an instruction breaks data protection law, we tell you. We never sell your data or use it for anything else, except where the law requires it; we then tell you first unless the law forbids that.

3. Your responsibilities

You’re responsible for having a legal basis for measuring your visitors, telling them about it, and asking for their consent where your law requires it, for example before turning on recognition of returning visitors, which stores an id in their browser, or before recording replays, which lyli’s recorder waits for by default. You hide anything on your pages that shouldn’t be recorded; lyli always hides what’s typed into fields. You don’t send us special categories of data or data that identifies people directly, in page addresses, event names or properties, or campaign tags.

4. Confidentiality and security

Everyone who can reach your data is bound to keep it confidential. We protect it with the technical and organizational measures in Annex 2, and keep them up to date.

5. Sub-processors

You authorize the sub-processors listed in Annex 3. We tell you by email at least 30 days before adding or replacing one. If you object on reasonable data protection grounds and we can’t address it, you may end the affected service and we refund any prepaid fees for the time left. Each sub-processor is bound by data protection terms at least as protective as these, and we remain responsible for them.

6. Transfers outside the EU

Your data is stored in London, covered by the EU’s adequacy decision for the United Kingdom. Where a sub-processor processes it elsewhere, the transfer relies on an adequacy decision, the EU–US Data Privacy Framework where the sub-processor is certified, or the European Commission’s standard contractual clauses.

7. Helping you

Your visitors’ rights: the data lyli keeps about visitors is pseudonymous (see Annex 1), so we usually can’t tell whose it is. You can delete a website’s data yourself in its settings, and we help with any request that can be tied to a person.
Assessments: we give you the information you need for data protection impact assessments and consultations with authorities.
Personal data breaches: we tell you without undue delay, and within 48 hours of becoming aware of one that affects your data, with what we know and what we’re doing about it.

8. Deletion at the end

When your plan or trial ends, lyli keeps recording for 14 days, and your data is deleted 60 days after the end, unless the law requires us to keep it. Until then you can download your reports as CSV files. You can delete a website’s data, or the website, any time in its settings. Replays are deleted after the days you choose for them, at most 30.

9. Demonstrating compliance

We make available the information needed to show that we meet this agreement, and allow audits by you or an auditor you appoint, bound by confidentiality, on 30 days’ notice, at most once a year unless an authority requires it or there’s been a breach, at your cost.

10. Liability and precedence

Liability under this agreement follows the terms of service. If this agreement and the terms of service conflict about your data, this agreement wins.

Annex 1: The processing

Subject and purpose	Measuring the use of your websites, short links and pixels, and reporting it to you.
Duration	While you use lyli, and until your data is deleted as described in section 8.
Nature	Collecting, recording the visits you choose to replay, importing from Google Analytics when you ask, pseudonymizing, storing, aggregating, displaying and deleting.
People concerned	Visitors to your websites; people who follow your short links; recipients of emails and visitors of pages that carry your pixels.
Data	A pseudonymous visitor code. By default it’s a hash of the IP address and browser identification with a random value that changes daily and is deleted within two days, so it can’t be traced back or followed from one day to the next. If you turn on recognition of returning visitors, lyli’s script stores a random id in the visitor’s browser and lyli keeps only a hash of it. IP addresses are used only to make that code, find the approximate location and hold back floods of requests, and are never stored. Pages viewed (address path and hostname, without query strings), times, and page speed measurements. The referring site, and campaign tags with email addresses, phone numbers, network addresses and ids removed or replaced by codes. Country, city and a location rounded to about 11 km. Kind of device, browser and operating system (not the full identification). Custom events and their properties, and revenue amounts, as you send them. For pixels: the page they were on (without query strings) and, in emails, the mail app and whether the load came through a mail provider’s image proxy. History you import from Google Analytics: daily totals of page views, visits and visitors by page, landing page, hostname, source, campaign tags (cleaned as above), country and city, device, browser and operating system, and custom events. No single visits, IP addresses or user ids. If you turn on replays, for the share of visits you choose: a recording of what the visitor saw and did on your pages (the pages’ content and layout, mouse movements, clicks, scrolling and the window’s size), made in their browser with everything typed into fields hidden and the parts you mark left out, and kept for the days you choose (at most 30).
Special categories	None. You don’t send them (section 3).

Annex 2: Security measures

Data minimization: pseudonymous visitor codes with daily values deleted within two days; IP addresses and full browser identification never stored; locations cut to city level; query strings dropped; personal data removed from campaign tags; no cookies set by lyli’s script.
Encryption: all traffic over HTTPS (TLS); stored data encrypted by our hosting and database providers.
Replays: what’s typed is hidden in the visitor’s browser before anything is sent. Replays are shown only to your workspace’s members, in a frame where nothing of the recorded page runs, and never in shared views.
Access control: each workspace sees only its own data, checked on every request; changes to a workspace need its admins; sign-in by emailed one-time codes (stored hashed, expiring after 10 minutes, with attempt limits) or Google, with no passwords; signed-in devices listed and revocable; restricted keys for payment and email providers.
Integrity and resilience: rate limits against abuse and bots filtered out; database backups by our database provider; every change to lyli reviewed and tested before release.
Retention: automated daily deletion jobs, as described in section 8 and our privacy policy.

Annex 3: Sub-processors

Sub-processor	What for	Where
Vercel Inc.	Hosting lyli and receiving what your sites, links and pixels send	London, with a global network in front (United States company)
Neon (Amazon Web Services)	Storing your data	London

Payments (Stripe), emails (Resend) and the map on Realtime (Mapbox) don’t receive your visitors’ data. They’re listed in our privacy policy. When you import history from Google Analytics, we read it from your own Google Analytics account on your instruction; Google isn’t our sub-processor.