隐私政策

Effective date: October 18, 2026

Summary

• Two roles. For our customers' accounts and for visitors to privatusanalytics.com, Two Phase LLC is the controller. For the analytics our customers collect about their visitors, the customer is the controller and we are their processor.
• Visitors to our customers' websites: no cookies, no local storage and no fingerprinting. IP addresses and user agents are used in memory for a moment and never stored. Location is country only. A request to a honeypot page, a hidden page that a site owner sets up to catch bots and that people cannot reach, keeps only keyed hashes of them (see below).
• People who give a testimonial to a business that uses Privatus Analytics: that business is the controller of what you send, and we process it for the business. See the section on testimonials below for what is collected, how long it is kept and how to ask for removal.
• Our own website uses the same cookieless analytics. Public pages set no cookies. Signing in sets strictly necessary cookies only.
• We do not sell or share personal information, and we don't use it for advertising.
• Data is stored and processed in the United States. You can download your account data or delete your account from Account settings, or email [email protected].

Who we are and our two roles

Privatus Analytics is operated by Two Phase LLC, a Wyoming limited liability company (“we”, “us”). This policy explains how we handle personal data.

• As a controller we decide how and why data is used for: our customers' accounts, workspaces, billing and support, our newsletter and emails, our programs, and visitors to privatusanalytics.com.
• As a processor (a “service provider” under the CCPA) we process analytics data on behalf of our customers, who decide which websites to measure and how. Our Data Processing Agreement governs that processing. It also covers the words, names and files of people who give testimonials to our customers (the Testimonials feature). The next sections explain what that involves, so that visitors to our customers' sites and the people who give testimonials know what happens to their data.

Visitors to our customers' websites

When you visit a website that uses Privatus Analytics, the site's owner is responsible for the analytics and you should read their privacy notice. Here is what our tracker and servers do.

• No cookies or device storage. The tracker sets no cookies and uses no localStorage, sessionStorage or IndexedDB, and no fingerprinting techniques. The only exception is an opt-out flag (privatus_optout) saved in the site's own localStorage if you choose to opt out, so your choice is remembered.
• IP address and user agent in memory only. Your browser sends these with every request. We use them only during that request, to filter bots and data-center traffic, to apply the site owner's exclusion rules, and to recognize a visit within one day. Then they are dropped. They are never written to our database, logs, queues or backups.
• The exception: honeypot pages. A site owner on our Pro, Business or Enterprise plan can set up honeypot pages to detect bots. A honeypot page is reached only through a link that is hidden from view, from the keyboard and from screen readers, so automated software finds it and people do not. For a request to a page the site owner has marked as a honeypot, we store keyed hashes of the IP address and user agent, never the values themselves, which cannot be turned back into them, and the names of the request headers with the few values that describe the browser's setup (its languages and client hints), together with the page, country, browser and what the script observed. None of it can identify you. We use it only to tell bots from people, never show it to the site owner, and delete it after 12 months. If you believe a request of yours was recorded this way, write to us and we will delete it.
• Visits are recognized with a keyed hash of the site, IP address and user agent, made with a random salt that changes every day. The salt is held only in memory with an expiry and is never saved, so the hash can't be recalculated or linked across days. Stored visits get a random identifier that isn't derived from your data.
• Location is country only. The country comes from the country code our network provider, Cloudflare, adds to each request. We don't look up or store anything more precise, and we don't use your IP address for location.
• What is stored: the page (host and path, with query strings removed except campaign parameters and any the site allows, and with patterns that look like emails, tokens or long numbers scrubbed), the referring site, campaign (UTM) tags, browser and operating system family and major version, device type, a screen size range, browser language, country, time spent and scroll depth, and any custom events, properties, revenue, Web Vitals or click targets the site owner sends. Bots are counted in totals only, except for requests to honeypot pages as described above.
• Shopify stores. On a Shopify store that uses the Privatus Analytics app, a small script that Shopify runs in your browser also sends us three events (an item added to the cart, a checkout started and an order placed, with the order's total and currency), and no name, email address, phone number, postal address, order number or Shopify identifier.
• Privacy signals. The tracker honors Global Privacy Control by default, so a browser that sends it isn't counted. Site owners can also choose to honor Do Not Track.
• Retention is set by the site owner's plan: 3 months on the Free plan, and for as long as the customer subscribes on paid plans, unless the owner sets a shorter period or deletes the data.

Because we store nothing that identifies you, we usually can't find data about a particular visitor. If you have a request, contact the website's owner. We help our customers respond as the DPA describes.

People who give a testimonial

A business that uses the Testimonials feature of Privatus Analytics can ask you for a testimonial with a form, a link or an email, and then show it on its website. If you give one, the business is the controller of what you send and decides how it is used. We are its processor and handle it for the business, under our DPA. Read the business's own privacy notice as well. This section explains what our systems do.

• What a form collects. Only what the business's form asks for and you choose to give: your name, email address, job title, company and website, a link to a social profile, a photo, your words, a star rating, a video, an audio recording or photos, and your answers to its other questions. The form tells you what you are agreeing to, and we keep that with the testimonial as a consent record: the text you saw, your yes or no to showing your name, your photo and your video and to marketing use, the version of the form, how you gave it and the time. We store no IP address and no user agent with a testimonial or its consent record. Some forms use a bot check from Cloudflare (Turnstile), which looks at your IP address and browser signals only to pass or fail you. We store nothing from it.
• Request emails. If a business asks you for a testimonial by email, it typed your name and email address into the Service, and the email leaves through the business's own email provider, not ours. We record that your personal link was opened, that you answered and that you unsubscribed, each with a time and nothing about your device. The email holds one small image that records only the time the email was opened. It records no IP address, device, mail app or place.
• The opt-out list. If you unsubscribe from requests, or an email to you bounces or is reported as spam, we add a one-way keyed hash of your address to a list that applies to every business using the Service, so none of them sends you another request. For this list we are the controller. The hash can't be turned back into your address. You can ask to receive requests again from the confirmation page.
• Imported reviews. A business can import reviews written about it on public pages (review sites, social posts, its own website) or from a spreadsheet. We read the public page the business names and keep the review text, the reviewer's public name, the rating and the date as shown there. The business is responsible for importing only what it may.
• Where it can appear. Only after the business approves it, and only as far as your consent record allows, for example your name and photo only if you agreed. It can appear in widgets on the business's website, on a wall page, on a public page of its own and in pictures the business makes for social posts. Those widgets and pages set no cookies and count views, clicks and plays as daily totals with no identifier. The finished video, audio and image files of a testimonial are stored with our provider Cloudflare and can be opened by anyone who has the file's address, which is long and random so it can't be guessed.
• Translation. A business on a plan with translation can have your words translated by Google Cloud Translation. Only the words, title and highlight are sent, never your name, email address or company.
• How long it is kept. Until the business deletes it. A deleted testimonial stays in the business's trash for 30 days so a mistake can be undone, and is then permanently deleted with its files, edit history, consent record and translations. The business can also delete it permanently at once. Everything is deleted when the business deletes the site or its workspace. A form you started and never sent is removed 7 days after it expires, with the files uploaded for it. A spreadsheet uploaded for an import is deleted after 30 days.
• Your rights. Your rights to see, correct, remove or stop the use of your testimonial are rights against the business. Every public testimonial page has a link, "This is mine, remove it", where you give your email address and a short note. The business sees the request and decides. The Service sends you nothing back. If you can't reach the business or it doesn't respond, email [email protected] with the name of the business and the page, and we will pass your request on and help the business act on it, as the DPA describes. We usually can't find a testimonial from a name alone, so tell us where it appears.

Data we collect as a controller

Data	Why we use it	Legal basis (GDPR)	How long we keep it
Account: name, email address, password (stored only as a one-way hash), preferences, time zone, two-factor secrets and backup codes (encrypted), passkeys (public keys only), and accounts you connect for sign-in (Google, GitHub, Apple or your company's SSO)	Creating and securing your account	Contract	Until you delete your account
Sign-in records: browser and operating system name, IP address and times of each signed-in session, plus the number of sign-ins and the time of your latest and previous sign-in on your account record (no IP address)	Showing your active sessions, security and fraud prevention	Legitimate interests (security)	Session records, including their IP addresses: while the session is active and 30 days after it ends. Sign-in count and times: until you delete your account
Sign in with Apple, if you choose it: the name and email address Apple gives us (the address can be a private relay address that Apple makes for you), Apple's identifier for your account with us, and a token from Apple (stored encrypted) that we use only to tell Apple when you disconnect Apple or delete your account	Signing you in, and ending the connection at Apple when you leave	Contract	Until you disconnect Apple or delete your account
Mobile app logins: for each device where you are signed in to the app, the device's name and platform (iPhone or iPad, or Android), the app's version, how you logged in, and when it signed in and was last active. No IP address is kept with them	Keeping the app signed in, showing your devices under Account, Security so you can sign one out, and security	Contract, legitimate interests (security)	While the login is active and 30 days after it ends. Deleted at once when you delete your account
Mobile app notifications, if you turn them on: the push token Apple or Google gave your device (stored encrypted), the language and time zone of the device, and which kinds of notification and which sites you switched off	Sending the notifications you asked for, in your language	Contract	Until you turn notifications off in the app, log out of the app, sign the device out or delete your account. Also removed when Apple or Google tells us the token no longer works
Audit log: who changed what in a workspace, with the member's IP address and any API token used	Security and accountability for workspace admins	Legitimate interests, contract	30 days on Free and Pro, 1 year on Business, as agreed on Enterprise, and deleted with the workspace
Workspaces and content: workspace and site settings, members and invitations, goals, reports, dashboards, notes, API tokens (stored as a hash) and integrations you connect	Providing the Service	Contract	Until you delete them or the workspace
Billing: plan, billing email addresses, tax ID, Paddle customer and subscription references, and invoice records (number, amount, date)	Billing, tax and accounting	Contract, legal obligation	Invoice records as long as tax law requires, even after the workspace is deleted. The rest until the workspace is deleted
Support and contact messages: your name, email, company and message	Answering you and keeping a record of the conversation	Legitimate interests, contract	24 months after you send the message, then deleted automatically. Ask us to delete them sooner at any time
Newsletter: your email address, how you joined and when you confirmed or unsubscribed	Sending the newsletter	Consent (double opt-in: nothing is stored until you confirm from our email)	Until you ask us to delete it. After you unsubscribe we keep the record only so we never email you again
Product and marketing emails to account holders: which emails we sent you, when, and whether they were opened or a link was clicked (times and counts only, with no IP address or device data)	Onboarding and product news, and stopping mail you don't read	Legitimate interests (existing customers), with a one-click unsubscribe in every email	Until you delete your account. An unsubscribed address is then kept only as a one-way hash so a new account with it isn't emailed
Email report recipients: an address a customer added to a scheduled report, whether it accepted the invite, and who sent the invite. If you decline or unsubscribe, a one-way hash of your address	Sending the report only to people who accepted it, and never inviting you again after you decline or unsubscribe	Consent (you accept the invite. Members of the customer's workspace are added without one), and legitimate interests for the hash	Unanswered invites: 14 days. Otherwise until the customer removes you or the report. The hash: until you ask for reports again
Opt-out list for testimonial requests: a one-way keyed hash of an address that unsubscribed, bounced or was reported as spam, and which of the three it was	Making sure no business using the Service sends that address another testimonial request	Legitimate interests (respecting opt-outs and preventing unwanted email)	Kept, so the opt-out holds. The hash can't be turned back into the address
Waitlists: your email address and the list you joined	Telling you when the feature is ready	Consent	24 months after you join, or 30 days after the feature launches, whichever comes first, then deleted automatically. Ask us to delete it sooner at any time
Discount and program applications: organization name, website, proof link, license and notes, and our review	Reviewing and applying discounts	Contract, legitimate interests	Until the workspace is deleted
Affiliate program: your application, referral code, website, payout method, Wise email address, commissions and payouts. For people who sign up through a referral link, only the fact that they were referred (no clicks, IP addresses or devices)	Running the program and paying commissions	Contract, legal obligation (accounting)	Until the affiliate's account is deleted. Referral records stay for commission history, without the referred person's account once it is deleted
AI assistant questions and answers	Answering your questions about your analytics	Contract	30 days after the last message in a conversation. You can delete them sooner
Bing Webmaster Tools API key, if you connect Bing to a site (stored encrypted, never shown again)	Reading search performance for the site you choose, and nothing else	Contract	Until you disconnect Bing or replace the key. You can also revoke it in Bing Webmaster Tools at any time
Google Analytics, if you connect it for an import: your Google account email address, access tokens (stored encrypted) and the daily totals you import from the Google Analytics 4 property you choose	Importing your history so your charts don't start from zero, and nothing else	Contract	Imported totals until you delete the import or the site. Tokens until you click Disconnect on the import page, or the workspace or your account is deleted. You can also remove our access in your Google Account at any time
Google Search Console, if you connect it to a site: access tokens (stored encrypted) and the search performance of the property you choose (queries, pages, countries, devices, clicks, impressions and position)	Showing search performance next to your visits, and nothing else	Contract	Until you disconnect. The synced data is deleted with the connection, and the tokens once no site uses them. You can also remove our access in your Google Account at any time
Bot checks on our forms (Cloudflare Turnstile): your IP address and browser signals, processed by Cloudflare	Stopping spam and automated abuse on sign-up, sign-in, password reset, magic link, contact, newsletter, waitlist, status page and shared dashboard password forms	Legitimate interests (security)	We use only the pass or fail result and store nothing from the check

We don't ask for sensitive data, and we don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

Our own website

We measure privatusanalytics.com with Privatus Analytics itself, in the same cookieless way as our customers' sites. We use no third-party analytics, advertising pixels or social media trackers. Some pages load services from other companies only when you use them:

• Cloudflare Turnstile on sign-up, sign-in and other account forms, and on public forms once you start filling them in.
• Paddle checkout, on billing and payment pages only, which Paddle provides under its own privacy notice.
• Google, GitHub, Apple or your company's SSO provider, only if you choose to sign in with them.

The mobile app

The Privatus Analytics mobile app gives you access to your workspaces from your phone. What you can do in it is never more than your own role in the workspace allows, and it is described in the app and in our documentation, which we update as the app changes. It logs in through our website in your device's browser, and one login is kept per device, as listed in the table above.

• No analytics in the app. The app does not measure how you use it. It contains no analytics, advertising or tracking code and no advertising identifier.
• No third-party code on iPhone and iPad. On Android the app includes one third-party library, Google's Firebase Cloud Messaging, which is how Android delivers notifications.
• Notifications are sent through Apple (Apple Push Notification service) on iPhone and iPad and through Google (Firebase Cloud Messaging) on Android. They receive your device's push token and the notification's title and text, which can name a site, an uptime check, an alert or a workspace. A notification never contains data about a visitor to a website.
• The app lock (Face ID or fingerprint) is checked by your device. We receive nothing about it.
• On your device the app keeps its login and your settings for the app in the device's protected storage (the Keychain on iPhone and iPad, the Android Keystore on Android). Reports are held in memory while the app is open and are not saved to the device. Logging out removes the login.
• Leaving. You can sign a device out from the app or from Account, Security on the website, and delete your account from the app's Settings, which opens the deletion form on our website.

Cookies

Public pages set no cookies for anonymous visitors, and the tracker sets no cookies. When you sign in, or open a page with a sign-in or account form, we set strictly necessary first-party cookies: the session cookie, a “remember me” cookie if you ask for it, a preference cookie for the site you last viewed, and a short-lived cookie after you enter a shared dashboard's password. The cookie statement lists each one.

Emails we send

• Service emails such as sign-in links, security alerts, invitations, reports you set up, usage notices and receipts. We send these as part of the Service.
• Email reports that a customer sets up for someone outside their team start with one invite. Nothing more is sent unless you accept. Declining or unsubscribing stops every customer from inviting you again, until you ask for reports again yourself.
• The newsletter, only after you confirm your address from the email we send.
• Product emails to account holders, such as onboarding tips. Each one says why you get it, carries our mailing address and has a one-click unsubscribe link. Unsubscribing stops them all, and only you can turn them back on. We record whether they are opened or clicked, with times and counts only.

AI assistant

If you use the in-app AI assistant, your question and the analytics results needed to answer it (aggregated figures such as page paths, sources and counts, never IP addresses, and including imported Google Analytics totals or Google Search Console figures if you ask about them) are sent to Anthropic, PBC, which provides the model. Under Anthropic's commercial terms, API data is not used to train its models. We keep your conversations for 30 days after the last message. If you ask to import testimonials from a web page, or to find them on your own website, the text of that public page (and nothing about you or your visitors) is also sent to Anthropic so the testimonials can be read out of it. The MCP server works differently: it lets AI tools you choose read your data, and those tools are governed by their providers' terms.

Google user data

If you connect Google Analytics or Google Search Console, we ask for read-only access and use what we read only to provide the import and the Search report you asked for, inside your own workspace. We never change or delete anything in your Google account.

• We don't use this data for advertising, and we don't sell it.
• We don't transfer it to anyone, except as needed to provide these features to you, to comply with the law, or as part of a merger, acquisition or sale of assets.
• If you ask the AI assistant about this data, the figures needed to answer are sent to Anthropic as described under AI assistant. They are not used to train AI models, by us or by Anthropic.
• Nobody at Privatus Analytics reads this data unless you ask us for help with it, it is needed for security purposes, or the law requires it.
• To stop access, click Disconnect on the import page or the Search page, or remove Privatus Analytics in your Google Account's third-party access settings.

Privatus Analytics' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who we share data with

• Service providers who process data for us under contract: hosting (DigitalOcean), network and bot protection (Cloudflare), email delivery (Amazon Web Services), our mailbox for the email you exchange with us (Proton Mail, provided by Proton AG), error monitoring with request headers and tokens stripped (Sentry), the AI assistant (Anthropic) and, for the mobile app's notifications, Apple and Google. Each is listed with its purpose and location on our subprocessors page.
• Providers for Testimonials, which process data for our customers and for us under contract: Cloudflare (storing and delivering testimonial media) and, only on plans with translation, Google (translating the words of a testimonial, never a name or email address). The subprocessors page lists them with what each receives.
• Our accountant and professional advisors, such as lawyers, who see personal data only when their work for us needs it, for example invoice records for bookkeeping, and who must keep it confidential.
• Paddle, our merchant of record, sells you your subscription and handles your payment details as an independent controller. We never see your card number.
• Wise, if you are an affiliate paid through Wise, receives your Wise email address and the payout amount.
• Sign-in providers you choose (Google, GitHub, Apple or your company's identity provider). If you signed in with Apple, we tell Apple when you disconnect it or delete your account, as Apple requires.
• Authorities, only where the law requires it. We review each request, challenge overbroad ones and disclose as little as possible.
• A buyer of our business, under this policy, if we are ever sold or merged. We would tell you first.

We do not sell or share personal information, as those terms are defined in US state privacy laws, and we never use it for targeted advertising.

Where data is processed

We store and process data in the United States, including data about people in the EU, EEA, UK and Switzerland. For those transfers we rely on the European Commission's Standard Contractual Clauses, with the UK Addendum and the Swiss amendments, and on the protections in this policy, above all that visitors' IP addresses and user agents are never stored. We are not currently certified under the EU-US Data Privacy Framework. If that changes, we will say so here. Our mailbox is hosted by Proton in Switzerland, which the European Commission recognizes as providing adequate protection for personal data.

Security

We use encryption in transit (HTTPS with HSTS), encrypted database connections, encryption of secrets such as two-factor keys and integration credentials, one-way hashing of passwords and API tokens, two-factor authentication and passkeys, rate limits on sign-in, role-based permissions, a workspace audit log, and least-privilege staff access. Our staff can view a workspace only while its owner has granted time-limited support access, and every view is logged in the workspace's audit log. No system is perfectly secure. If a breach affects your personal data, we will notify you and the authorities as the law requires, without undue delay. More is on our security page.

Your rights in the EEA, UK and Switzerland

You have the right to:

• access your personal data and get a copy,
• have inaccurate data corrected,
• have your data erased,
• restrict how we use it,
• receive it in a portable format,
• object to processing based on legitimate interests, and to direct marketing at any time,
• withdraw consent at any time, without affecting processing before you withdrew it,
• complain to your data protection authority, such as the one where you live or work. We'd appreciate the chance to help first.

Your rights in California and other US states

In the last 12 months we collected these categories of personal information about customers and our website's users: identifiers (name, email address, IP address), customer records (billing contacts and tax ID), commercial information (plans and purchases), internet activity (sign-in sessions, audit log entries and email engagement) and account login credentials. We collected them from you and from your use of the Service, for the purposes and periods in the table above, and disclosed them only to the service providers and advisors listed above for business purposes.

• We do not sell or share personal information, and we have not done so in the last 12 months.
• We use sensitive personal information (your login credentials) only to provide the Service and keep it secure, so no right to limit its use applies.
• You have the right to know what we collect and how we use it, and to access, correct and delete it, and to opt out of any sale, sharing or targeted advertising (which we don't do). We honor Global Privacy Control signals.
• We won't discriminate against you for using these rights.
• You can use an authorized agent. We may ask the agent for proof of authority and ask you to confirm your identity.

People in other US states with privacy laws, such as Colorado, Connecticut, Virginia and Utah, have similar rights, including the right to appeal a decision about a request. Email us to appeal.

How to use your rights

• Download a copy of everything we hold about you from Account settings. It is a JSON file with your profile, memberships, API tokens, sign-in sessions (with their IP addresses), connected accounts and integrations, the emails we sent you and their opens and clicks, your AI assistant conversations, discount applications you submitted, your affiliate records, and the contact messages, newsletter, waitlist, invitation and status page records for your email address. Export a workspace's analytics and content from the workspace itself.
• If you gave a testimonial, ask the business that collected it, or use the "This is mine, remove it" link on its public page. See the testimonials section above.
• Delete your account from Account settings. It is removed at once, along with the workspaces you own, which are permanently deleted after 7 days.
• Unsubscribe from any marketing email with its link, or change your email settings in Account settings.
• For anything else, or if you don't have an account, email [email protected] or use the contact form with the Privacy topic.

We may need to confirm your identity, usually by replying from your account's email address. We respond within 30 days. If a request is complex and the law allows more time, we'll tell you why within those 30 days. Requests are free unless they are clearly unfounded or excessive.

Children

The Service is not directed at children under 16, and you must be 18 or older, or the age of legal majority where you live if that is higher, to create an account. We don't knowingly collect personal data from children. If you believe a child has given us personal data, email us and we will delete it.

Changes to this policy

We'll post any changes here and update the effective date. If a change is material, we'll email account owners at least 30 days before it takes effect.

Contact

The controller is Two Phase LLC, a Wyoming limited liability company.

• Email: [email protected]
• Physical address: Two Phase LLC, 680 South Cache Street, Unit 100, Jackson, WY 83001, USA
• Mailing address: Two Phase LLC, PO Box 14672, Jackson, WY 83002, USA
• Or use our contact form and choose the Privacy topic.

We have not appointed a representative in the EU or the UK. If we appoint one, we will name them here.