← Documentation

GDPR & privacy

Cookieless tracking

The SDK sets no cookies. It keeps a random anonymous ID in localStorage (so a returning visitor is counted once) and a session ID in sessionStorage (cleared when the tab closes). There is no fingerprinting, no cross-site identifier and no third-party tracker.

Because the anonymous ID persists on the device, some jurisdictions treat it like any other client-side storage under ePrivacy rules. Whether you need a consent banner depends on where you and your visitors are — confirm with your DPO. If you collect consent, call analytics.setConsent('denied' | 'granted').

IP anonymization

IPs are anonymized at the moment of ingestion (last octet of IPv4 / last 80 bits of IPv6 zeroed) before any storage. Country is derived from the original IP, then the IP is discarded. To disable anonymization (e.g. for legitimate interest on a private app), set IP_ANONYMIZE=0 on the ingestor environment.

Right to access (Data export)

End users contact your support; you fulfill via:

POST /api/gdpr/export
Authorization: Bearer <your-user-session-token>
Content-Type: application/json

{
  "siteKey": "YOUR_SITE_KEY",
  "anonId": "the-visitor-anon-id"      // or "userId": "..."
}

Response is a downloadable JSON with all events and session metadata for that subject. Role required: admin.

Right to deletion

POST /api/gdpr/delete
Authorization: Bearer <your-user-session-token>
Content-Type: application/json

{
  "siteKey": "YOUR_SITE_KEY",
  "anonId": "the-visitor-anon-id",     // or "userId": "..."
  "confirm": "DELETE"
}

Permanently removes events_raw + session_metadata rows. Records an entry in audit_log. Role required: owner. Rollups for past dates may still aggregate the now-deleted events; if you need them scrubbed, rerun the rollups for affected dates.

Data retention

  • Free: 30 days
  • Starter: 6 months
  • Growth: 1 year
  • Scale: 2 years

Backups follow the same window. Past retention, raw events are pruned; rollups remain (aggregate only, no PII).

Subprocessors

See our Privacy Policy for the current subprocessor list (Stripe, hosting, email).

DPA

Standard DPA available to Growth and Scale customers via email. Custom DPA on Scale and Enterprise. Email hello@useanalisa.com with the subject DPA.

GDPR & privacy · Analisa