GDPR Compliance

Analytico acts as the data controller for the personal data of its registered users (name, email, billing information).

For visitor data collected via the tracking pixel on your websites, you are the data controller and Analytico acts as the data processor on your behalf.

We process personal data under the following legal bases:

• Contract performance: Processing necessary to provide the service you signed up for (account management, fraud detection, reporting).
• Legitimate interest: Ensuring platform security, preventing abuse, and improving service quality.
• Legal obligation: Retaining certain records as required by applicable law.

• Identity data: Name and email address.
• Authentication data: Hashed password (never stored in plain text).
• Billing data: Transaction IDs and plan history.
• Usage data: Login timestamps, dashboard activity.

On your behalf, we process the following data about visitors to your tracked websites:

• IP addresses (used for geo-location and fraud scoring, not stored beyond 90 days).
• Browser user-agent strings.
• Page URLs visited and referrer URLs.
• Device type and country code (derived from IP, IP is hashed after lookup).

We do not process: names, email addresses, or any other identifying information about your visitors.

We follow the principle of data minimisation. The tracking pixel collects only what is technically necessary for fraud detection. We do not track user journeys across sessions or build visitor profiles.

As a registered user of Analytico, you have the following rights under GDPR:

• Right of access (Art. 15): Request a copy of all personal data we hold about you.
• Right to rectification (Art. 16): Correct inaccurate or incomplete personal data.
• Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
• Right to restriction (Art. 18): Ask us to restrict processing of your data in certain circumstances.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format (JSON/CSV export available from your dashboard).
• Right to object (Art. 21): Object to processing based on legitimate interest.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, email us at . We will respond within 30 days.

• Account data: Retained until you delete your account + 30 days for backup purposes.
• Website event data: Retained for 90 days by default. Older data is automatically purged.
• Aggregated analytics: Retained indefinitely (no personal data, statistical only).

Your data is stored on servers located in the EU/EEA where possible. If data is transferred outside the EEA, it is protected by Standard Contractual Clauses (SCCs) or equivalent safeguards.

We use a single strictly-necessary session cookie for authentication. No tracking cookies, no third-party advertising cookies. Our tracking pixel does not set cookies on your visitors' browsers.

In the event of a personal data breach that is likely to result in risk to individuals, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local Data Protection Authority (DPA). For EU residents, you can find your DPA at edpb.europa.eu.

For all GDPR-related queries, contact us at: