Data Processing Addendum

Version beta-1, October 15, 2026.

1. Scope

This Data Processing Addendum ("DPA") is part of the Telltale Bot terms of service between Quantable LLC ("we") and the customer that accepted them ("you"). It applies when we process personal data for you in providing Telltale Bot. Words such as controller, processor, personal data, processing, personal data breach and data subject mean what the GDPR (and the UK GDPR) says they mean. If this DPA and the terms disagree about personal data, this DPA wins; if the Standard Contractual Clauses apply and disagree with either, the Clauses win.

2. Roles

You are the controller of the personal data in your sites' reports, or a processor acting for your own client, and we are your processor (or subprocessor). Section 7 of the terms ("Improving detection") is the one use for which we are a controller of that data in our own right; this DPA does not cover it, and you can opt out of it. We are also the controller of the data about your account and logins, as our privacy page says.

3. The processing

• Subject matter and purpose: judging whether visits to your sites are made by people, AI agents or bots; reporting that to you in the viewer, exports, scheduled email reports and your pages; and keeping the service secure.
• Nature: collection by our script on your pages, receipt by our server, scoring, storage, display and deletion.
• Duration: for as long as the terms last, then until deletion under section 10.
• Data subjects: visitors to your sites (people, and the AI agents and bots that act for them or on their own), and members of your sites, if you send a member ID.
• Personal data: technical information about the browser and device; how the page is used (the timing of activity, never what is typed); the page's address, referrer and campaign parameters; a member ID if you send one; and, added by our server, the IP address, information about its network (such as the operator and approximate location) and technical details of the connection. No cookies, names, contact details or special categories of data are collected, unless you put them in a page address or member ID, which our Acceptable Use Policy asks you not to.

4. Your instructions

We process the personal data only on your documented instructions: the terms, this DPA, and the settings you choose in the viewer (such as your sites, member IDs, the dataLayer fields and scheduled reports). If the law requires us to process it otherwise, we will tell you first unless the law forbids it. We will tell you if we think an instruction breaks data protection law. You are responsible for your instructions being lawful and for having a legal basis to have us process the data.

5. Our people

Only the Quantable people who run the service can see the personal data, only as the service needs, and each is bound to keep it confidential.

6. Security

We protect the personal data with the technical and organizational measures in Annex 2, which take account of the state of the art, the cost, and the nature, scope, context and purposes of the processing and its risks to people. We may change them, but not in a way that lowers the overall protection.

7. Subprocessors

• You authorize us to use the subprocessors on our subprocessors page (telltale.bot/subprocessors.html) and, under the rules below, others.
• We post a new subprocessor on that page and its RSS feed at least 30 days before it starts processing your data, except where a change must happen sooner to keep the service secure or running; then we post it as soon as we can and say why. You can object, on reasonable data protection grounds, by emailing support@telltale.bot before it starts. If we cannot address your objection, you may end the terms, and we refund what you have paid for time after that.
• Each subprocessor is bound by written terms that protect the data at least as this DPA does, and we remain responsible to you for its work.

8. Helping you

• Requests from people. The viewer lets you find and erase a visitor's data yourself (Site settings, Delete). If a person asks us directly about data we process for you, we will send them to you, and we will help you answer requests to exercise their rights that you cannot answer with the viewer.
• Your obligations. We will give you the information you reasonably need, given what we know of the processing, for your security, breach notification, data protection impact assessment and prior consultation obligations (GDPR Articles 32 to 36).

9. Personal data breaches

If we become aware of a personal data breach affecting your data, we will tell you without undue delay, and aim to do so within 48 hours. We will say what we know (what happened, the data and people likely affected, the likely consequences, and what we have done and will do) and add to it as we learn more. We will take reasonable steps to contain it and help you meet your own obligations. Telling you is not an admission of fault.

10. Deletion

Reports are deleted 30 days after they are received. When you close your account, we delete your sites' reports at once; when the terms otherwise end, within 30 days. Our encrypted backups roll off 14 days after either. We keep a monthly count of each site's pageviews, which identifies no one, for billing.

11. Information and audits

We will give you the information you reasonably need to show that we meet this DPA, including answers to reasonable security questionnaires. If that is not enough, or a supervisory authority requires it, you or an independent auditor bound to confidentiality may audit our processing, with at least 30 days' notice, during business hours, at most once a year (more often after a breach or when an authority asks), at your cost, and without access to other customers' data.

12. International transfers

We process the personal data in the United States (our server is in Chicago), and our content delivery network serves the script worldwide. Where the GDPR applies to the transfer of the personal data to us, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated into this DPA: Module 2 where you are a controller and Module 3 where you are a processor, with you as data exporter and us as data importer. In them: Clause 7 (docking) applies; under Clause 9(a), Option 2 applies, with the notice period in section 7 of this DPA; the option in Clause 11(a) does not apply; under Clause 13, the supervisory authority is the one that Clause 13(a) names for you; under Clauses 17 and 18, the law and courts are those of Ireland. Annex 1 completes Annexes I and III of the Clauses and Annex 2 completes Annex II.

Where the UK GDPR applies, the UK International Data Transfer Addendum (version B1.0) to those Clauses is incorporated, with Table 1 completed by Annex 1, Tables 2 and 3 by this section and the Annexes, and, in Table 4, either party may end it. Where the Swiss Federal Act on Data Protection applies, the Clauses apply with the Swiss Federal Data Protection and Information Commissioner as the authority, Swiss law where the Act requires, and "member state" read to include Switzerland.

13. US state privacy laws

Where a US state privacy law (such as the California Consumer Privacy Act) applies, we are your service provider or processor. We will not sell or share the personal data, or use, keep or disclose it outside our direct business relationship with you or for any purpose but those in this DPA and section 7 of the terms (improving our service, which that law allows), and will not combine it with personal data from other sources except as that law allows. We will comply with that law, tell you if we can no longer do so, and let you take reasonable steps to stop and remedy unauthorized use.

14. General

This DPA lasts as long as we process personal data for you. The limits of liability in the terms apply to it, except where the Standard Contractual Clauses or the law do not allow it.

Annex 1. The parties and the processing

• Data exporter: the customer named in the account that accepted the terms, contact at the email address of the login that accepted them. Role: controller (or processor).
• Data importer: Quantable LLC, 4041 N. High St., Suite 300-E, Columbus, OH 43214, United States; contact support@telltale.bot. Role: processor (or subprocessor).
• Description: as in section 3. Frequency: continuous, as your sites are visited. Retention: section 10.
• Subprocessors (Annex III of the Clauses): as listed on telltale.bot/subprocessors.html.

Annex 2. Security measures

• In transit: every connection to our servers uses TLS 1.2 or 1.3, with HSTS.
• Storage: reports are kept in a separate database for each site, on a server in Chicago, and deleted after 30 days. Network lookups for IP addresses run on our own server: no visitor IP address is sent to another company for them.
• Backups: nightly, and hourly for account data, encrypted before they leave the server with a key the server cannot read back, kept for 14 days in a separate location.
• Access: administrative access to servers by SSH key only, from an allowed network, with root sign-in disabled; staff sign-ins to the viewer and to every provider's console require two-factor authentication; customers see only their own sites, which automated tests check.
• Customer accounts: passwords stored as bcrypt hashes, optional two-factor sign-in, sign-in throttling, and sessions that end when a password changes.
• Testing: a staging server, reachable only from our own network, holds a recent copy of the data to test changes before they reach the service.
• Upkeep: operating system security updates installed daily, dependencies checked for known vulnerabilities on every deploy, and server logs kept for 30 days.
• Monitoring and response: health and uptime monitoring with alerts, and a written breach procedure.
• Minimization: the script records no keystroke content, sets no cookies, and stores nothing on the device beyond the tab's session; secrets in page addresses and request headers are redacted before storage.