Measurement and observability
GDPR Mixpanel
In an indie stack, Mixpanel is used for Product analytics. Entity cited: Mixpanel, Inc.. The sections repeat what the vendor publishes, without filling a gap. Last update of the facts: October 4, 2026. Verified on October 4, 2026.
Translation of the French sheet. The facts do not change. The date is the date the official pages were read.
DPA Mixpanel
Yes. Public DPA.
Stated role
The customer is controller and Mixpanel is processor or sub-processor of the Customer Content sent to the Application Services.
Personal data
Default events and properties, which depend on the configuration: city, region, country code, browser and version, device, current URL, timestamps. Information collected via cookies, pixels, and software that interacts with the computer or the mobile device.
Sub-processors of Mixpanel
Public list.
Transfers outside the EU
Hosting / location
Storage on servers in the United States by default, on European servers if the customer chooses EU residency, or in India if that option is purchased. Customer content is hosted in the United States, the EEA, or India according to the choice.
EU–United States Data Privacy Framework
Mixpanel, Inc. is registered. EU-U.S. Data Privacy Framework status: Active.
Cookies
Mixpanel collects usage information via cookies, including an encrypted login cookie, and uses cookies for authentication, marketing, performance, and the site experience.
Typical use, written by StackLégal and not by the vendor: Product analytics.
History
Last update: October 4, 2026.
First publication. The facts come from the official pages cited in the sources. Anything not stated there remains "not disclosed".
Clause to paste
Place it in the sub-processor section of your privacy policy. Review it: a “not disclosed” field must be completed before publication.
Sub-processor clause
Sources
Verified on October 4, 2026.
Frequently asked questions
Is Mixpanel a processor within the meaning of the GDPR?
The customer is controller and Mixpanel is processor or sub-processor of the Customer Content sent to the Application Services.
What DPA does Mixpanel publish?
Yes. Public DPA. https://mixpanel.com/legal/dpa/
Which further sub-processors does Mixpanel publish?
Public list. https://mixpanel.com/legal/subprocessor-list/
Where does Mixpanel state that it processes data, including outside the EU?
Storage on servers in the United States by default, on European servers if the customer chooses EU residency, or in India if that option is purchased. Customer content is hosted in the United States, the EEA, or India according to the choice.
Is Mixpanel registered under the EU–United States Data Privacy Framework?
Mixpanel, Inc. is registered. EU-U.S. Data Privacy Framework status: Active. https://www.dataprivacyframework.gov/participant/7814
Which personal data does Mixpanel mention?
Default events and properties, which depend on the configuration: city, region, country code, browser and version, device, current URL, timestamps. Information collected via cookies, pixels, and software that interacts with the computer or the mobile device.
Often in the same stack
These sheets come up in searches for a Next.js SaaS. Next.js itself is not a processor: GDPR Next.js.
Related tools
Full pack, from 39 € incl. VAT
The clause above covers only one tool. StackLégal generates the legal notices, terms of use, terms of sale, privacy policy, Article 28 DPA, and the public list, naming only the boxes that are checked. One-time payment via Gumroad. This is not legal advice.