Privacy Policy

1. Customers: what we collect

• Account details: your email address, and your name and profile picture if you sign in with Google.
• Sign-in sessions: a session record with the IP address and browser it was created from, so you can stay signed in and we can spot misuse.
• Your sites and settings: domains, site names, icons, proxy domains and dashboard settings.
• Billing: your plan, subscription status and the customer and subscription IDs from Dodo Payments, our merchant of record. Dodo Payments collects your card details and billing address under its own privacy policy; we never see your full card number.
• Support: whatever you send us by email.

We use this to provide and secure the service, bill you, answer your questions, and send service emails (sign-in links, receipts, important changes). We don't send marketing emails without your consent. Our legal bases are performing our contract with you, our legitimate interest in running a secure service, and legal obligations such as keeping tax records.

2. Website visitors: what the script collects

When a website uses Datasense, our script sends us anonymous, aggregated-by-design measurements. We process them on behalf of the website owner, who is the controller; see our Data Processing Agreement.

• the page URL, page title, referrer and campaign (UTM) parameters;
• browser, operating system and device type, read from the user agent;
• country, and where available region and city, looked up from the IP address at the moment the request arrives;
• JavaScript errors on the page: message, stack trace, page and browser;
• custom events, goals and revenue events that the website owner chooses to send;
• visits from known bots and AI crawlers, identified by their user agent.

By default we use no cookies, local storage identifiers or fingerprinting, and we never store IP addresses. To count unique visitors, the visitor's IP address and user agent are hashed together with the site and a salt that changes every day. The raw IP is discarded right away, and the hash can't be reversed or used to follow someone across days or across websites. A per-tab session id is kept in the browser's session storage and disappears when the tab closes.

A website owner can instead choose our cookie script, which keeps a random visitor id and a 30-minute session id in first-party cookies on their own domain, so a returning visitor is recognized across days. The id is random, isn't shared across websites, and is hashed with the site before we store it. Sites using it are responsible for asking for consent where the law requires it. The Cookie Policy lists exactly what it stores.

You can opt out of being counted on any site that uses Datasense by turning on your browser's Do Not Track setting where the site respects it, by using a content blocker, or by contacting the website owner.

3. Who we share data with

We don't sell personal data or share it for advertising. We use these service providers (subprocessors):

• Oracle Cloud Infrastructure: servers and the analytics database.
• Cloudflare: DNS, network protection, TLS and visitor location headers.
• Neon: the database for accounts, sites and settings.
• Dodo Payments: payments, invoices and tax, as merchant of record.
• Resend: sign-in and service emails.
• Google: sign-in, only if you choose “Continue with Google”.

We may also disclose data when the law requires it, to protect our rights or users' safety, or to a buyer if Datasense is sold, under this policy. Country lookups use a database stored on our own servers, so visitor IPs aren't sent to a third party for that.

4. International transfers

Our providers may process data outside your country, including in the United States, India and the EU. Where data from the EU, the UK or Switzerland is transferred, we rely on adequacy decisions or Standard Contractual Clauses.

5. How long we keep data

• Account, site and settings data: while your account is open, and deleted within 30 days of closing it.
• Analytics data: while the site is in your account. Deleting a site deletes its data.
• JavaScript errors: the latest 100 per site; older ones are replaced as new ones arrive.
• Billing records: as long as tax and accounting law requires.
• Backups roll over and are overwritten within 30 days.

6. Security

All traffic is encrypted with HTTPS. Access to production systems is limited to the people who run Datasense, and each customer can only see their own sites. No system is perfectly secure; if a breach affects your personal data, we'll tell you without undue delay.

7. Your rights

Depending on where you live (for example under the GDPR, UK GDPR, India's DPDP Act or US state laws), you may have the right to access, correct, delete or export your personal data, to object to or restrict processing, and to withdraw consent. Email [email protected] and we'll respond within 30 days. You can also complain to your local data protection authority.

If you are a visitor of a website that uses Datasense, please contact that website first: they control the data. Because we don't store IPs, we usually can't link analytics data to you; on a site using the cookie script, the site can help you find the data tied to the visitor id in your browser.

8. Children

Datasense isn't meant for anyone under 16, and we don't knowingly collect their personal data as customers.

9. Changes

We may update this policy. If the changes are material, we'll email customers before they take effect. The date at the top shows the latest version.

10. Contact

The data controller for customer data is Datasense, India. Reach us at [email protected]. See also our Cookie Policy and Terms of Service.