Terms of Service

1.About these terms

These Terms of Service are an agreement between you and Mücahid Ali Karaman, a sole proprietorship registered in Türkiye, with its registered address at Meşrutiyet Mah. Karanfil Sk. Zafir İş Merkezi No: 4/91, 06420 Çankaya, Ankara, Türkiye, which operates Rabolic (“Rabolic”, “we”, “us”). They apply to rabolic.com, the Rabolic dashboard at app.rabolic.com, the ingest API, the SDK script we serve from cdn.rabolic.com and everything else we offer under the Rabolic name (together, the “Service”).

If you use the Service for a company or another organization, you confirm that you may accept these terms for it, and “you” includes that organization.

How we handle personal data about you is described in our Privacy Policy. How we handle the personal data you send us about your own users is set out in the data processing terms below. Both are part of these terms.

2.Who can use Rabolic

Rabolic is a service for businesses and professionals who measure their own websites, apps and services. You must be at least 18 years old and able to enter into a binding contract.

3.Your account

Give accurate information when you sign up and keep it up to date. Keep your password safe, don’t share your account, and turn on two-factor sign-in. You are responsible for what happens under your account, including what is done with keys you create.

If you think someone else has access to your account, change your password, end your other sessions from your account settings and tell us at support@rabolic.com.

4.Organizations, projects and members

Your work lives in an organization. The organization holds the subscription, its projects (usually one per website or app) and its members. Members are unlimited on every plan.

Owners decide who joins, with which role and which projects they can see, and can require two-factor sign-in for everyone. Only owners choose the plan and turn overage on. The organization is responsible for the people it invites and for removing access that is no longer needed.

5.The Service

Rabolic receives events from your websites, apps and servers, resolves them into people across devices, and shows them in reports: events and trends, funnels, retention, sessions, revenue and attribution, and real-time events. We keep improving it, so features may change. If we remove something you rely on in a paid plan, we will tell you in advance where we reasonably can.

Features marked as beta or preview may be incomplete and may change or end at any time.

6.SDKs, keys and the ingest API

The Rabolic SDKs are open source under the MIT license (https://github.com/rabolic/sdks). That license governs the SDK code; these terms govern your use of the Service the SDKs send data to.

Each project has publishable keys, which are meant to be in your website or app, and secret keys, which belong only on your servers. Keep secret keys secret: anything sent with a key counts as sent by you. You can revoke a key at any time from the project settings.

Rate limits and payload limits apply to the ingest API to keep the Service working for everyone.

7.The trial

• A new organization starts a 3-day trial. No card is needed.
• The trial starts with the organization’s first accepted event, not at sign-up. Until then it waits, so setting up uses none of it.
• During the trial, the organization has the Growth plan’s features and limits, with a cap of 250,000 events over the whole trial. Events over the cap are dropped and counted as dropped.
• One trial per person: only the first organization a person creates gets one. Organizations they create later need a plan before they accept events. Being invited to an organization doesn’t affect this.
• When the trial ends without a plan, ingestion stops: events are dropped and counted, and the SDKs get the same response as over a cap, so they don’t retry. The dashboard becomes read-only: reports open, but nothing can be created or changed except the plan. Choosing a plan, leaving or deleting the organization, and privacy requests still work.
• The organization’s event data is kept for 7 days after the trial ends, then deleted. The organization, its members, projects and settings stay, so it can subscribe and start again.
• We email the owners when the trial starts, 24 hours before it ends, when it ends, and 2 days before the data is deleted. Data is never deleted sooner than 2 days after that last email.
• Choosing a plan at any point, including after the trial ends and before the data is deleted, restores ingestion at once.

8.Plans and payment

• Prices are in US dollars, per organization. A yearly plan costs 10 months’ price. Event allowances are per billing month, on yearly plans too.
• Plans differ only in event volume, projects, data retention, overage rate, alerts and support. Every plan includes every report and SDK, and unlimited members.
• Plans bought at checkout are billed monthly or yearly in advance and renew automatically at the end of each period until canceled.
• Business is sold by agreement: write to sales@rabolic.com. Its price, event volume, data retention, overage rate and projects are agreed in writing and set on your organization by hand. Where that agreement differs from these terms, the agreement applies.
• Orders are handled by Dodo Payments, our merchant of record. Dodo sells you the subscription, takes the payment, issues the invoice, and calculates and collects any VAT or sales tax that applies. Its own terms apply to the payment. We never receive or store your full card number.
• Prices shown on rabolic.com do not include VAT or sales tax. Dodo Payments adds any tax that applies at checkout, based on where you are, and shows it before you pay.
• We may change prices. A new price applies from your next renewal after we have told you about it at least 30 days ahead, and never to a period you have already paid for.
• Payments are non-refundable, except where the law requires a refund or as described in Suspension and ending.

9.Billable events

A billable event is one that passed validation, was accepted by ingest, and is counted once after deduplication. Malformed, unauthorized, rejected, duplicate and dropped events are not billed.

Usage is counted per UTC day and shown in the dashboard per organization, project, environment and platform, together with the dropped and rejected counts. Invoices and overage use these daily counts.

10.Usage over your plan (overage)

• Overage is off by default. When the organization reaches 100% of its plan’s events for the billing period, further events are dropped until the next period, and the organization is told.
• Only an owner can turn overage on, and must set a monthly spending limit in US dollars, between $1 and $1,000,000. The settings show the plan’s rate per extra 1M events.
• With overage on, events are accepted up to the allowance plus what the spending limit buys at the plan’s rate (the limit divided by the rate, in millions of events). Past that, events are dropped until the next period.
• Overage is charged per event at the plan’s rate, which is quoted per 1M events, so a month’s overage never exceeds the spending limit.
• Overage is billed monthly, for monthly and yearly plans alike. On a monthly plan it is billed with the renewal. On a yearly plan the owner first authorizes a payment mandate on a Dodo Payments checkout page; overage applies only once that mandate is active, and each month’s overage is charged to it. A month’s overage below Dodo Payments’ minimum charge is not charged.
• We notify the organization in the dashboard and by email at 80% and 100% of its allowance, and when the spending limit is reached.
• Business has no limit at ingest; its overage is billed under its agreement, not through Dodo Payments.

11.Plan changes, cancellation and failed payments

Data is never deleted, and ingestion never stops, without the notices described above. You can cancel from the billing page in the dashboard.

12.Data retention and deletion

Analytics data is kept for your plan’s data retention and then deleted automatically:

• Events, the session summaries built from them (start and end, source, landing and exit, device and location, duration) and revenue transactions are deleted once they are older than the retention, counted from their own time.
• A person’s profile and linked identities are deleted once none of their events is left inside the retention. People who are still active are kept.
• When the retention changes with your plan (an upgrade, a downgrade when it takes effect, or a change agreed for Business), the new retention applies to the data already stored as well. A shorter retention therefore deletes the older data.

Besides the retention:

• Deleting a person (a privacy request in the dashboard) removes their profile, linked identities, events and transactions, including people merged into them. It completes within 30 days.
• Deleting a project removes it from the product at once; its events, sessions, people and transactions are deleted from storage within 24 hours.
• An owner can delete the organization. Its subscription is canceled, it is closed at once, its memberships end, and its projects are deleted as above.
• After a trial or a canceled plan ends, the event data is deleted as set out in The trial and Plan changes: after 7 and 30 days respectively.
• Daily usage counts and billing records are kept as long as tax and commercial law require.
• Copies in backups are removed as the backups expire, within 30 days.

13.Your data

Everything you or your SDKs send to Rabolic, and what a payment provider you connect sends on your behalf, is “Customer Data”: events and their properties, anonymous ids and user ids, profile properties, sessions, and revenue transactions. You keep all rights to it.

You give us a worldwide, non-exclusive, royalty-free license to host, store, copy, process and display Customer Data only as needed to provide the Service to you. We don’t sell Customer Data, use it for advertising, share it with other customers or use it to train AI models. We use counts of your events, not their contents, to bill you, apply your plan’s limits and run the Service.

You are responsible for Customer Data: that you may collect it, that you may send it to us, and that it is accurate.

14.Your duties toward the people you measure

The people who use your websites, apps and services (“end users”) are your users, not ours. You decide what to collect about them and why, so you are responsible for the legal basis of that collection. In particular, you must:

• tell end users in your own privacy notice that you use Rabolic for analytics, what you collect and why, and that Rabolic processes it for you;
• obtain consent where the law requires it before you store or read information on their devices or measure them, for example under the EU ePrivacy rules for the web SDK’s rb_aid cookie and localStorage. The web SDK can wait for consent (consent: ‘pending’), send nothing (‘denied’), or run without storing anything on the device (persistence: ‘memory’);
• not send special categories of personal data (such as health, religion or belief, political opinions, sexual orientation, ethnic origin, trade union membership, genetic or biometric data), data about criminal convictions, or data about children below the age at which they can consent on their own, unless you have a legal basis for it and the processing is lawful;
• not send passwords, payment card numbers, government identity numbers, precise location or the contents of form fields; and keep names and email addresses out of event properties unless you need them;
• answer end users’ requests about their data. The dashboard lets you delete a person and export a person’s data, and we will help you where we can.

15.Acceptable use

Don’t use Rabolic to:

• collect or send data you have no right to collect or send, or measure people without the notice or consent the law requires;
• send events about websites or apps you don’t own or operate, or with someone else’s keys;
• track people across websites and apps that are not yours, build profiles for advertising, or identify people from data meant to be anonymous;
• send malware, or probe, attack or overload our systems, or test their security without our written permission;
• get around plan limits, rate limits, the trial rules or access controls, for example by creating organizations to get more trials;
• copy, resell or reverse-engineer the Service, or scrape it, except as the API and the SDKs’ license allow;
• break the law, or help someone else do so.

We may limit or suspend access when we reasonably believe these rules are being broken, and we will tell you why unless the law or a security risk prevents it.

16.Data processing terms

This section is the data processing agreement between you and us for Customer Data that is personal data, under Article 28 of the EU and UK General Data Protection Regulation (GDPR) and Article 12 of the Turkish Personal Data Protection Law No. 6698 (KVKK). You are the controller (or a processor acting for your own client, in which case we are your sub-processor), and we are your processor. For account data about you and your team, we are the controller, as described in the Privacy Policy.

Details of the processing

Instructions

We process Customer Data only on your documented instructions: these terms, your settings and your use of the Service. If the law requires us to process it otherwise, we will tell you first unless the law forbids it. If we believe an instruction breaks data protection law, we will tell you.

Confidentiality

Only people who need access to run the Service can reach Customer Data, and they are bound to keep it confidential.

Sub-processors

You authorize the sub-processors listed in the Privacy Policy. We give each of them data protection obligations no weaker than these. We will tell owners by email, and update the list, at least 30 days before we add or replace a sub-processor. If you object on reasonable data protection grounds and we can’t resolve it, you can cancel, and we will refund the unused part of any prepaid period.

Security

We protect Customer Data with the measures described in the Privacy Policy, including encryption in transit, hashed keys and tokens, encrypted payment secrets, two-factor sign-in, role-based access per project, tenant isolation in every query, and nightly backups to separate storage. We keep these measures up to date and don’t reduce their overall level of protection.

Assistance

The dashboard lets you delete a person and export a person’s data, also while your organization is read-only. We will help you, as far as we reasonably can, to answer data subjects’ requests, and with data protection impact assessments and consultations with authorities about the Service.

Personal data breaches

If we become aware of a personal data breach affecting Customer Data, we will tell you without undue delay, with what we know about its nature, the data and people concerned, its likely consequences and what we are doing about it, and keep you updated.

Deletion at the end

When the Service ends for your organization, we delete Customer Data as set out in Data retention and deletion, unless the law requires us to keep it. A bulk export of event data is not available yet; until it is, you can export individual people from the dashboard before the data is deleted.

Information and audits

We make available the information you need to show that this section is met, and answer reasonable questions about it at privacy@rabolic.com. Audits beyond that are by agreement, with reasonable notice, at your cost, and under confidentiality.

Where data is processed

Customer Data is stored on our servers in Germany, and backups in Western Europe. Transfers outside the European Economic Area or Türkiye happen only through the sub-processors listed, with the safeguards described in the Privacy Policy.

17.Our intellectual property

The Service, its software and design and the Rabolic name and logo belong to us or our licensors. These terms don’t give you rights to them, except to use the Service as described here. The SDKs are licensed to you under the MIT license.

If you send us feedback or ideas, we may use them without any obligation to you.

18.Third-party services

The Service works with services we don’t control, such as Dodo Payments for checkout, Google for sign-in, and payment providers you connect to a project to import revenue. Their own terms apply to your use of them, and we are not responsible for them.

19.Suspension and ending

You can stop using the Service at any time: cancel the subscription, and an owner can delete the organization.

We may suspend or end your access if you seriously or repeatedly break these terms, if you don’t pay, or if the law requires it. Where we can, we will tell you first and give you a chance to fix the problem. If we end the Service for you without cause, we will give you at least 30 days’ notice and refund the unused part of any prepaid period.

20.Disclaimers

We work hard to keep Rabolic reliable, accurate and secure, but we provide it “as is” and “as available”. To the extent the law allows, we don’t promise that it will be uninterrupted or error-free, or that reports will be complete: events can be lost before they reach us, for example when a browser blocks them or a device stays offline too long.

21.Limitation of liability

To the extent the law allows, we are not liable for indirect or consequential losses, such as lost profits, revenue, data or goodwill, and our total liability for all claims relating to the Service is limited to the amount you paid us in the 12 months before the event that gave rise to the claim.

Nothing in these terms limits liability that can’t be limited by law, including liability for intent or gross negligence, or any rights you have as a consumer under mandatory law.

22.Responsibility for claims

If someone makes a claim against us because of Customer Data you sent, or because you broke these terms or the law, including toward your end users, you will cover the reasonable costs and damages that result, to the extent the claim is caused by you.

23.Changes to these terms

We may update these terms. If a change matters to you, we will tell you in the dashboard or by email at least 30 days before it takes effect, unless the law requires it sooner. If you don’t agree, you can cancel before the change takes effect; continuing to use the Service after that means you accept the new terms.

24.Governing law and disputes

These terms are governed by the laws of the Republic of Türkiye. The courts and enforcement offices of Ankara have jurisdiction over any dispute. This doesn’t take away the protection of mandatory law you have as a consumer where you live, or your right to bring a claim there.

If any part of these terms is found invalid, the rest stays in effect. If we don’t enforce a right straight away, we don’t give it up.

25.Contact

Support: support@rabolic.com. Sales: sales@rabolic.com. Privacy and data protection: privacy@rabolic.com. Mücahid Ali Karaman, Meşrutiyet Mah. Karanfil Sk. Zafir İş Merkezi No: 4/91, 06420 Çankaya, Ankara, Türkiye.