Privacy Policy

Last updated: September 30, 2026

Analisa (“Analisa”, “we”, “us”) provides web analytics services. This policy describes what we collect from two distinct groups:

  1. Customers — people who sign up for and use Analisa to track their own websites.
  2. End users — visitors of websites that have installed our tracking SDK.

If you came here from one of our customers' sites, the second section applies to you.

1. What we collect from customers

Account data

  • Email, hashed password and display name.
  • Workspace name and subscription status. Payment details are collected and held by Stripe — we do not store card numbers.
  • Audit log of admin actions (who created/changed/deleted what, when).

Usage data

  • Logged-in dashboard requests, for the purpose of rate limiting, abuse prevention, and product analytics on our own product.

2. What we collect from end users (visitors of customer sites)

By design, we collect less than Google Analytics. Specifically, for each tracked event we may store:

  • A random anonymous identifier and a session identifier. The SDK sets no cookies: it stores the anonymous ID in the browser’s localStorage and the session ID in sessionStorage on the customer’s own domain. Neither is derived from personal data.
  • Page URL, path, referrer, UTM parameters.
  • Browser, OS, device class (desktop/tablet/mobile) — derived from the User-Agent header.
  • Country code (derived from the IP address, which is anonymized at ingest — last octet of IPv4 / last 80 bits of IPv6).
  • Timezone, language, viewport size.
  • Custom event names and properties that the customer chose to send.

We do not collect: full IP addresses (after the anonymization step), browser fingerprints, ad-network IDs, cross-site tracking cookies, or behavioral profiles. We do not sell, rent, or trade end-user data to third parties.

3. Legal basis (GDPR)

For end-user tracking, our customers are the data controllers and we are the data processor. Customers must have a legal basis (consent or legitimate interest, depending on jurisdiction) to deploy the SDK on their site. The SDK does not use cookies, but it does store a random anonymous identifier in the browser’s localStorage; whether that requires prior consent depends on the jurisdiction (e.g. ePrivacy rules in the EU), so customers must verify with their own DPO.

4. Data retention

  • Account data: retained while the account is active; deleted on request by emailing hello@useanalisa.com.
  • Event data (raw events and aggregated reports) is kept for the history included in the customer’s plan — 30 days on Free, 180 days on Starter, 365 days on Growth and 730 days on Scale — and anything older is deleted by a periodic cleanup. Individual visitors’ data can be deleted at any time through our GDPR API endpoints.

5. Your rights

If you are an end user who wants to access or delete your data, contact the operator of the website you visited — they are the data controller. They can use our GDPR API endpoints (/api/gdpr/export, /api/gdpr/delete) to fulfill your request.

If you are a customer, you can export or delete the data of any tracked visitor through those same GDPR API endpoints. To delete your account, email hello@useanalisa.com.

6. Subprocessors

We use the following subprocessors to deliver the service:

  • Stripe — payments and subscription management.
  • Cloud hosting provider — compute, storage, object storage.
  • Email transactional provider — account emails, billing notifications.

A current list with addresses is available on request.

7. Security

Data is encrypted in transit (TLS). Passwords are hashed with bcrypt. Access control is enforced server-side on every API call, and access to production data is limited to the people who operate the Service.

8. International transfers

Data is stored with our cloud hosting provider and may be processed outside your country. Where required, cross-border transfers rely on appropriate safeguards such as Standard Contractual Clauses.

9. Changes

If we materially change this policy, we will email all account owners 30 days in advance.

10. Contact

Email hello@useanalisa.com. For DPA requests, mention “DPA” in the subject.

Privacy Policy · Analisa