Privacy policy

When a website installs our script, we receive for each pageview or event:

• page URL, referrer and campaign (UTM) tags;
• browser, operating system and device type, derived from the user agent;
• country, region and city supplied by our hosting provider from the IP address (the IP address itself is not stored);
• a random visitor identifier kept in local storage and a session identifier in session storage.

Sites can run the script with data-storage="none" so nothing is stored in the visitor's browser. The website owner is the controller of this data; we process it on their behalf under our data processing agreement.

To run your account we store your name, email, sign-in records, subscription status and the settings of your websites. Payments are handled by our payment provider; we never see or store card numbers.

If you connect Stripe or Dodo, signed webhooks send us the paid amount, currency, time and the visitor identifier you attached, so revenue can be linked to the visit that produced it.

• to provide reports and the API to the website owner;
• to secure the service and prevent abuse;
• to bill and support customers.

We use Vercel for hosting, Supabase for the database and our payment provider for billing. Each is bound by data protection terms. Data may be processed outside your country under appropriate safeguards.

Event data is kept for the retention period of the website's plan, or until the owner deletes the website. Account data is kept while the account is open and then deleted, except where the law requires us to keep records.

You can access, correct, export or delete your data. Visitors of a tracked website should contact that website's owner, who controls their data; we will help the owner respond. Contact us for any request.