Privacy Policy
This Privacy Policy explains how OpenWebTrack ("we", "us") handles personal data when you use the OpenWebTrack Cloud hosted service. It covers two roles: how we process data as a processor for the analytics events collected on our customers' websites, and how we process data as a controller for your use of our service itself.
1. Quick summary
- The cloud service is built on a privacy-first analytics script. By default it does not set cookies and does not require a consent banner on your visitors.
- We collect only what we need to operate, secure and bill the service.
- Data is hosted in the EU. We do not sell personal data.
- You can export and delete your data at any time.
2. Data we process as a controller (about you, the customer)
When you sign up, use, or contact us, we process:
| What | Why | How long |
|---|---|---|
| Account email and name | To create and authenticate your account | Until you delete your account |
| Billing details (processed by our payment provider) | To charge subscription fees | As required by tax/accounting law (typically 7–10 years) |
| Support emails and chat | To respond to your requests | Up to 24 months |
| Aggregated service usage telemetry | To improve the product | Up to 13 months |
Lawful basis
Contract (to deliver the service) and legitimate interests (to keep it secure and improve it).
3. Data we process as a processor (about your visitors)
When you install the OpenWebTrack script on your website, the script sends events to our cloud. We process those events on your behalf as a processor.
What the script collects
- Page URL, referrer, screen size, browser, operating system, country, region and city (derived from IP, then discarded).
- A daily-rotating anonymised visitor hash (cookieless mode) or a first-party cookie (cookie mode).
- Custom events and properties you configure through the dashboard.
- Revenue events you send, if you enable revenue tracking.
What we do not collect
- Names, emails or any directly identifying data, unless you explicitly send it as a custom event.
- Advertising IDs or cross-site identifiers.
- Full IP addresses are not stored; only a coarse geo location.
Lawful basis
You, the customer, are the controller of your visitors' data. You must ensure you have a lawful basis (such as legitimate interest under GDPR, or appropriate consent under ePrivacy) to track them. Our default cookieless mode is designed to support legitimate interest without consent. See GDPR & Cookieless Tracking for guidance.
4. Sub-processors
We use a small set of sub-processors to operate the service. We notify customers of changes.
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloud hosting provider (EU region) | Hosting and storage | European Union |
| Payment provider | Card processing and billing | European Economic Area / United States (with Standard Contractual Clauses) |
| Email delivery provider | Transactional and report emails | European Union / United States (with SCCs) |
| Error monitoring (optional) | Application performance monitoring | European Union |
5. International transfers
Primary data storage is in the EU. Where a sub-processor is outside the EU/EEA, we rely on Standard Contractual Clauses or the EU-US Data Privacy Framework to protect your data.
6. Cookies
The OpenWebTrack website itself uses only strictly necessary cookies for authentication. The analytics script is cookieless by default and does not set cookies on your visitors unless you opt into cookie-based tracking.
7. Security
- All traffic is encrypted in transit (TLS 1.2+).
- Data is encrypted at rest.
- Access to production systems is restricted to authorised personnel with audit logging.
- We run regular backups and disaster-recovery drills.
8. Data retention
Raw event data is retained for the period included in your plan (default 6 or on months). Aggregated rollups may be retained longer. You can change retention or delete data at any time from the dashboard.
9. Your rights
As a customer
You can access, correct, export, port, restrict or delete your account data from the dashboard, or by emailing support@openwebtrack.com.
As a visitor of a customer's site
If you want to exercise rights over the data a customer has collected about you (access, deletion, portability), please contact that site operator directly. They are the controller. Where required, we assist them in responding.
10. Children
The service is not directed at children under 16 and we do not knowingly process their data through it.
11. Changes to this policy
We will post updates here and notify active customers of material changes by email at least 14 days before they take effect.
12. Contact
For privacy questions or to exercise your rights, email privacy@openwebtrack.com.