GDPR

Our reasoning

Roles

You decide to measure your site, so you are the controller. We process visitor data only on your instructions, as your processor under Article 28. For our own customers' account and billing data, we are the controller.

Lawful basis

Because no cookies, profiles or cross-site tracking are involved and the data is minimized, audience measurement with Privatus fits legitimate interests (Article 6(1)(f)) for most sites. We provide a legitimate interests assessment template to help you document the balancing test.

Minimization

IP addresses and user agents are used only in memory and never stored. Query strings are dropped except for campaign parameters and your allowlist, and a PII scrubber removes emails and similar values from URLs and events before storage. See every stored field.

International transfers

Data is stored and processed in the United States, including for EU and EEA visitors. Their IP addresses and user agents are used in memory only while each request is handled, and are never stored. The transfers are covered by the Standard Contractual Clauses in our DPA, and by our EU-US Data Privacy Framework certification once it is listed (in progress). Where your data lives.

Visitors' rights

We can't single out a visitor in stored data, so requests to access or delete one person's data usually can't be matched. Your privacy notice should explain this.

Where the law is uncertain

Regulators haven't settled every question about cookieless analytics. In particular, whether a daily pseudonymous key counts as personal data after the day ends, and how far legitimate interests stretches, can be read differently by different supervisory authorities.