How we process your visitors' data for you.

1. Who is who

You, the customer, are the controller of your visitors' personal data. Garage Projects AB (org. no. 559330-5500, Örnbogatan 19, 167 66 Bromma, Sweden), which runs 150 Strangers, is your processor. This agreement covers the personal data we process on your behalf when you use the service. It does not cover your account details or payments, which we handle as controller under our privacy notice.

2. What we process, and why

Purpose. To apply the changes you approved to your page, to assign visitors to the versions of an A/B test you run, and to count how many saw each version and how many completed the page's main action.

The data. Applying approved changes uses no personal data: the tag sets no cookie and sends no events for it. During an A/B test the tag sets one first-party cookie on your site (_150s_vid, a random id, 12 months) and sends two kinds of event: that the visitor saw the page under test, and that they completed its main action. Each event carries the random id, your site's id, the test's id, the version shown, the page address without its query string or fragment, and the time. IP addresses are discarded when the events are stored. No profile is built, and the id is not linked across sites or to any other data.

Your pages. To measure and build changes we fetch, record and screenshot your public pages. If they show personal data (a named testimonial, a team page), we process it only for that purpose.

Whose data. Visitors to your site, and people named on your public pages. No special categories of personal data are intended; do not put any on a page under test.

How long. For as long as you use the service, then as set out in section 7.

3. Your part

You decide the lawful basis for the test data and tell your visitors about it. By default the tag waits for your consent banner: until it signals consent, the visitor sees your original page, gets no cookie and is not counted. If you switch that off in your dashboard, you are responsible for having another lawful basis. Name 150 Strangers in your privacy notice as a processor for A/B testing.

4. Our part

• We process the data only on your documented instructions: these terms and the settings in your account.
• Everyone who can access it is bound to confidentiality.
• We protect it with the measures described on our Security page.
• We help you answer requests from your visitors and with any data protection impact assessment, as far as our part of the processing allows.
• We tell you without undue delay, and within 72 hours, after we become aware of a personal data breach that affects your data.
• We answer your reasonable questions about compliance in writing. An audit on site is possible with reasonable notice, at your cost.

5. Subprocessors

For the test data:

• Cloudflare: serves the tag and your site's configuration; sees visitors' IP addresses in those requests. Global network.
• PostHog: stores the test events, with IP addresses discarded. EU (Frankfurt).
• Supabase: stores your site's configuration and test settings. EU (Ireland).

For your pages and our work on them (no visitor data):

• Supabase: database and file storage. EU (Ireland).
• Cloudflare: the browsers that load your pages. Global network.
• OpenRouter: routes our AI model calls, with zero data retention. United States.
• OpenAI, through OpenRouter: builds and reviews changes. United States.
• DeepInfra, through OpenRouter: runs the model behind the synthetic persona panel. United States.
• Anthropic, directly and through OpenRouter: plans experiments. United States.
• Serper: web searches about your business, to find facts for you to sign off. Location not stated by the provider; treated as a transfer outside the EU.
• Resend: account email. United States, and EU (Ireland) for sign-in links.

We use each subprocessor under data protection terms that bind it to protect your data as this agreement does. Transfers outside the EU rely on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. We email Grow customers at least 30 days before adding or replacing a subprocessor; if you object, you can cancel before the change.

6. Requests from your visitors

The visitor id exists only in the cookie in the visitor's own browser. Neither we nor you can tell from the test data who a visitor is, so a request about one person usually cannot be matched to their events. We forward any request we receive to you.

7. When the service ends

• When the service ends, the tag stops applying changes and sending events. A returning visitor's browser may use its stored copy once more before it updates.
• We delete the recordings and screenshots of your pages, our work on them, and your site's configuration 90 days after the end, or sooner if you ask. We keep anonymized outcomes, which identify no site or person.
• The test events already stored in PostHog cannot be deleted one by one: PostHog does not support it. They are pseudonymous (a random id, no IP address) and are kept under PostHog's retention. After the end we use them only in anonymized totals.

8. The rest

Liability, changes and disputes follow the Grow terms: Swedish law, the Stockholm District Court. If this agreement and the terms differ on personal data, this agreement applies.