DPIA support

Last updated 20 October 2026 · Tolla, operated by Dmitrii Russu, 8006 Zürich, Switzerland

This page helps Tolla's customers carry out their data protection impact assessment (DPIA) for using Tolla. As the controller, your company is responsible for the assessment; as your processor, Tolla supplies the facts about the processing, the risks we see and the safeguards built in. It follows the structure of Article 35(7) GDPR and Article 22 of the Swiss FADP. Copy what fits into your own assessment, and adapt it to how you use Tolla.

Do you need a DPIA?

Probably, if you use account linking on people in the EU, the UK or Switzerland. Data protection authorities expect a DPIA when processing meets two or more of the EDPB criteria. Using Tolla meets several:

• Evaluation or scoring: Tolla estimates how likely two accounts belong to the same person.
• Matching or combining datasets: usage, payments and identity signals from different sources are combined.
• Systematic monitoring: usage is recorded continuously, and, with the browser snippet, devices are recognised.
• Possibly large scale, depending on how many users you have.
• Possibly affecting access to a service, if you use the results to limit free accounts, or turn on a change that gives some users a smaller free allowance.

If you only use the cost and conversion analyses, without identity signals, the case for a DPIA is much weaker.

1. Description of the processing

Purpose. Understanding the economics of your free tier: what each free user costs, who converts, and which accounts probably belong to the same person, so you can design your free tier and limit abuse of it. If you turn a change on, your product also asks Tolla what the rule you approved says for each user, for example a smaller free allowance for repeat accounts, and applies the answer.

People concerned. Your users and prospective users (people who sign up for or use your product).

Data, all sent by you or read from your Stripe account:

No special categories of data (such as health data), no prompt or file content, and no data about children may be sent (Terms, section 5).

Sources. Your servers (SDK, API or OpenTelemetry), your Stripe account (read-only key), and, if you install it, the browser snippet on your sign-up and sign-in pages.

Recipients. Only you. Tolla uses two subprocessors for hosting and the database, in Frankfurt, Germany (see Subprocessors). Tolla never uses your data for other customers.

Retention. Identity session data: your setting, 30 to 730 days (180 by default), deleted daily once older. Debugging event log: 30 days. Everything else: until you delete it or close your workspace, then within 30 days.

Data flow. Your server or Stripe → TLS → Tolla's API (Frankfurt) → identity values hashed on arrival → stored per workspace in an encrypted database (Frankfurt) → analyses shown to your team in the Tolla app.

2. How account linking works

Tolla compares the hashed signals of your accounts. When two accounts share a signal, that signal adds evidence that they belong to the same person. The base weights are:

Each weight is adjusted before it counts:

• Rarity: a value shared by many accounts is ignored, because it is probably an office, a university or a mobile network rather than one person. For example, an IP address shared by 25 or more accounts adds nothing.
• Recency: short-lived signals such as IP addresses count less the further apart the two accounts were seen (half-life 14 days for an IP address).
• Repetition: a value seen together across several sessions counts a little more.

The adjusted weights combine as 1 − Π(1 − w). A link is shown from 50% confidence and marked strong from 80%. Behavioural hints (an account created right after another hit its free limit, a similar usage pattern) can raise or lower the confidence of a pair that already shares a signal, but never create a link on their own.

Accuracy. Links are probabilities. Where enough accounts have a card or another hard identifier, Tolla measures on your own traffic how often its links are right, and shows that precision on the Linked accounts page.

Known sources of error:

• False links: people in one household sharing a computer or card; colleagues behind a small office network; one person's devices used by family members.
• Missed links: people who change device, email, card and network together.

3. Necessity and proportionality

4. Risks and safeguards

With these safeguards, and your own measures marked You, we consider the remaining risk acceptable. Your assessment must reach its own conclusion.

5. Your checklist

1. Choose and document the legal basis (usually legitimate interest), with a short balancing test.
2. Add the processing to your privacy policy (text below) and your record of processing activities.
3. If you install the browser snippet: load it only after sign-up and sign-in, list its cookie in your cookie notice, and decide whether to wait for consent (data-consent="wait"). Ask for consent before turning on the device fingerprint for EU visitors.
4. Set the retention period in Settings → Workspace.
5. Call the deletion API when a user deletes their account or asks to be forgotten.
6. Make sure a person reviews decisions based on links, and that users can contest them.
7. If you turn changes on: say in your terms or pricing page that free allowances can depend on how the free plan is used, and how to ask for a review.
8. Review the assessment once a year, or when you start using new signals or turn on a new kind of change.

6. Text you can copy

For your privacy policy:

To understand the cost of our free plan and to prevent abuse of free accounts, we use Tolla (Dmitrii Russu, Zürich, Switzerland) as a processor. Tolla receives information about how you use our product (such as usage, costs and payments) and, to recognise accounts that belong to the same person, your email address, IP address and a device identifier, which are stored only in pseudonymised (hashed) form. The data is stored in the EU. Based on how the free plan is used, it may give some accounts a smaller or larger free allowance, according to rules we set; you can ask us to review yours. Our legal basis is our legitimate interest in sustainable pricing and preventing abuse. No decision with legal or similarly significant effect is taken without human review. You can object to this processing and ask for deletion by contacting us.

For your cookie notice (only if you install the browser snippet):

Questions about this assessment: dmitrii@russu.net.