fewly

Legal

Data Processing Agreement

Last updated November 2, 2026

Scope and roles

This Data Processing Agreement ("DPA") is part of the fewly Terms of Service. It applies when you, the customer, use fewly to process personal data of other people: the visitors who click your links and the contacts you track. For that data you are the controller and fewly is your processor, as described in Article 28 of the EU General Data Protection Regulation (GDPR) and similar laws.

By accepting the Terms you accept this DPA. If you need a signed copy for your records, email support@fewly.tech and we will countersign it.

The data and why we process it

  • People concerned: visitors who open your links and pages; contacts whose identifier you add to links; people who answer your surveys.
  • Data: hashed IP address, approximate location, device, browser, language, referrer, time of click, UTM tags, CRM contact identifiers you choose to add, conversion events and values you send, and survey answers.
  • Purpose: redirecting visitors, measuring clicks and conversions, sending events to the tools you connect, and producing your reports. We process it only on your documented instructions, which are your settings in fewly and these Terms.
  • Duration: for as long as you use fewly, then as described under Deletion and return.

Don't send fewly special categories of data, such as health details, in link parameters or conversion data. For health and similar clients, use an opaque CRM contact ID, not an email address or phone number.

Our obligations

  • We process personal data only on your instructions, and tell you if we think an instruction breaks the law.
  • Everyone at fewly with access to it is bound to confidentiality.
  • We don't sell it, and we don't use it for our own advertising or to train models.
  • We apply the security measures below and keep them up to date.

Security measures

  • Data is stored on servers in France (European Union), reachable only over encrypted HTTPS connections.
  • Visitor IP addresses are stored only as a keyed hash. CRM contact identifiers are encrypted at rest and erased from clicks after 180 days.
  • Logs record paths without query strings and are deleted after 14 days.
  • Passwords are stored as salted hashes. Accounts can use two-step verification, and workspaces can require it.
  • Access inside a workspace is limited by role: owner, admin, member and read-only viewer, with an activity log.
  • Database backups are taken every 15 days and only the two newest are kept.
  • Every destination is checked for malware and phishing, and private network addresses are refused.

Subprocessors

You authorise us to use these subprocessors. We will update this list at least 14 days before adding one, and you may object by contacting us.

  • Contabo GmbH: Servers, database and backups. France (EU).
  • Stripe: Payments and invoices. United States and EU.
  • Resend: Sending account and report emails. United States.
  • Google: Checking destinations against Safe Browsing; Sign in with Google if you use it. United States.
  • VirusTotal (Google): Checking destinations for malware, when enabled. United States.

We hold each of them to data-protection terms at least as protective as this DPA.

International transfers

Your data is stored in the EU. Where a subprocessor handles it outside the European Economic Area, the transfer relies on an adequacy decision or the European Commission's Standard Contractual Clauses.

Personal data breaches

If we become aware of a breach affecting your data, we will tell you without undue delay and within 72 hours, with what we know about what happened, the data involved and what we are doing about it, so you can meet your own obligations.

Helping you with requests

If someone asks you to see, correct or delete their data, we help you answer. You can delete links and their analytics yourself in fewly; for anything you can't do in the dashboard, email us and we'll do it within 30 days. We also help with data protection impact assessments where you need information only we have.

Deletion and return

When you close your account or a workspace, its data is deleted from the live database straight away and from backups within about 45 days. Before you close, you can export it, or ask us for a full export, which we send within 5 business days.

Information and audits

We will answer reasonable questions about how we protect your data and give you the information you need to show you meet Article 28. If that isn't enough, we'll agree a reasonable review with you, at a time and in a way that doesn't put other customers' data at risk.