Data processing agreement

Purpose

Hopla measures your page’s audience for you: number of views, visitors and clicks, source, country and device type. If you add the “Join my list” block, Hopla also collects for you the addresses of the people who sign up. If you add “Contact me”, Hopla forwards to your inbox the messages your visitors leave there. It does nothing else with this data and doesn’t use it for its own purposes.

Data processed

For each visit or click: the date, the link clicked, the source (referring site or campaign parameter), the device type (mobile, computer, tablet), the country as Cloudflare infers it from the connection, and an anonymous visitor fingerprint, recomputed every day from a server secret, the IP address and the browser. The IP address itself is never stored, no cookie is set on the visitor’s device, and the fingerprint doesn’t allow following them from one day to the next or from one site to another.

For the “Join my list” block: the email address, the first name if asked, the sign-up date and the source. These subscribers are kept until you remove them, or as long as your account exists. If you connect a tool in the Integrations tab (a newsletter such as Brevo, Mailchimp, Kit, MailerLite, beehiiv or Systeme.io, or a Make, Zapier or n8n webhook), each subscriber is sent to it on your instruction: this tool, which you choose, then acts for you, under your own contract with it. Your API key, or your webhook address, is encrypted on the server. Substack has no API: your subscribers only go there if you import them yourself.

For “Contact me”: the name if given, the visitor’s email address and message, sent right away by email to your account’s address, with their address so you can reply. Hopla keeps no copy.

Retention

Data is kept for 13 months at most, then erased automatically. It is erased immediately if you delete your account.

Hopla’s commitments

Process the data only on your instructions, that is, to show your analytics. Ensure the confidentiality of the people who have access to it. Apply suitable security measures: passwordless login through single-use links, protected sessions, anti-abuse limits. Use only the subprocessors listed on the “Subprocessors” page, and tell you of any change. Help you answer requests from the people concerned. Tell you without delay, and within 48 hours at the latest, of any data breach affecting your page. Erase the data at the end of the service, and let you export it before.

Your commitments

Inform your page’s visitors of the audience measurement (the “Privacy” link at the bottom of your page does it for you), and not add third parties’ personal data to your page without a legal basis. For a subscriber list: only write to people for what your block announces, and allow unsubscribing in every email.

Language

This is an English translation, provided for convenience. The French version is the one that legally applies: in case of any difference, it prevails.