Where analytics data is stored
Where Privatus Analytics stores and processes data (the United States), what counts as a transfer for EU, UK and Swiss visitors, and which safeguards apply.
Storage: United States#
Stored data (events, visits, your account and settings, backups and exports) is kept in the United States.
Processing: United States, in memory#
Every visitor request is processed on our servers in the United States, including requests from visitors in the EU/EEA, the UK and Switzerland. Requests reach us through Cloudflare's global network, which handles the IP address and User-Agent in transit and adds the visitor's country code.
On our servers the IP address and User-Agent are used in memory only (bot checks, your IP-range traffic rules and the daily visit key) while the request is handled. Then they are dropped. We never write them to our database, logs, queues, caches or backups.
What is transferred#
For visitors outside the US, each request is a transfer of personal data to the US: the IP address and User-Agent exist there in memory for the duration of the request. What is stored afterwards is the minimized event, which has no IP address, no raw User-Agent and no persistent identifier. See the data inventory.
Transfer safeguards#
- the Standard Contractual Clauses (2021/914, module 2) in our DPA, with the UK addendum and the amendments for the Swiss FADP,
- minimization: the IP address and User-Agent are processed in memory only and never stored.
We are not certified under the EU-US Data Privacy Framework.
EU hosting#
We don't offer EU storage or processing. If you need it, join the waitlist.
Subprocessors#
The current list, with each provider's location and purpose, is on the subprocessors page.