Privacy, with clear boundaries.

Who operates Privacyside

Privacyside is operated by WebSuitable Inc. Questions and requests may be directed to help@privacyside.app. Our governing jurisdiction is Ontario, Canada.

Website analytics data

We process minimized website activity on behalf of website owners: approved public paths, event categories, traffic source/channel, approved campaign categories, broad device/browser/operating system categories, approximate country codes when available, and aggregate timestamps/counts. Full user agents are processed transiently and discarded; country reporting uses the hosting provider’s country signal without application-side IP lookup. We do not create visitor profiles, track across sites, use analytics cookies, fingerprint browsers, or store raw visitor IPs in analytics tables. See our tracking explanation for exact fields, limitations, and retention.

Account and billing data

Account email, authentication records, website configuration, and billing-provider customer/subscription references support the service. Authentication uses essential session cookies for signed-in customers. These are separate from the cookie-free analytics script. Stripe handles payment details; Privacyside does not store card numbers.

We use account and support information to provide the service, communicate about your account, prevent abuse, and meet legal and accounting obligations. We do not sell analytics or account data or use it to build advertising profiles. Website owners determine why they collect analytics and are responsible for their notices and any required consent; we process their analytics under their service instructions. WebSuitable is responsible for its own account, billing, security and support processing.

When you create an account from a supported campaign link, we may keep its campaign label with your account to understand signups, trial use and subscriptions in aggregate. This uses no additional tracking cookies, fingerprints or ad-network click identifiers, and we do not send this account attribution to advertising networks. We retain the label while your account exists; it is included in your account export and removed when your account is deleted. Campaign labels do not affect your access or trial allowance.

Service providers and transfers

Vercel hosts the platform, tracker file and event collector. Requests reach its network, which may retain IP addresses and other connection metadata for security and operations under its privacy notice. This is separate from our minimized analytics database; we do not promise zero IP retention across hosting infrastructure.

Supabase provides authentication and PostgreSQL, Stripe handles subscriptions and payments, and Postmark delivers transactional mail and opted-in report summaries. They receive data needed for those functions. The database is in Canada Central; providers and their subprocessors may process information in other countries, including the United States, where local authorities may have lawful access. Ask us about processing agreements and applicable transfer safeguards before using the service for data requiring specific arrangements.

Your controls

Customers can configure collection allowlists and retention, export reports and account configuration, archive websites, or delete sites and accounts. Customers can opt in to per-website weekly summaries at their account email and disable them in Settings. Summaries include aggregate counts and top pages/sources and are processed by our email provider when delivery is enabled. Analytics visitors can enable DNT/GPC or use a site-level opt-out. Contact the website owner for questions about their collection choices.

Retention and security

Aggregates retain 30, 90, or 365 days; delivery receipts 48 hours; health counters 7 days; monthly usage 13 months; erasure audit 90 days. Cleanup runs daily. Site deletion erases related active-database analytics immediately; backups expire according to provider policies. Server authorization, RLS, request validation, least-privilege storage, and restricted secrets protect the service. No security certification or universal compliance guarantee is claimed.

Privacy requests and complaints

Email help@privacyside.app to ask what personal information we hold about you, request access or correction, request deletion, withdraw consent where processing depends on it, or raise a privacy concern. We may verify your identity and explain any legal exception or retention requirement. We respond to access requests within 30 calendar days, subject to extensions permitted by applicable law, and explain a permitted delay. You may complain to the Office of the Privacy Commissioner of Canada or your applicable privacy regulator.

For analytics collected by a website owner, contact that owner first; we assist with its requests as required. Aggregate reports do not contain visitor identities, so we cannot search them by a visitor’s name or IP. Cookie-free measurement does not automatically establish GDPR, ePrivacy, PIPEDA or consent-exemption compliance.

Changes to this policy

We publish changes here with an updated date and provide account notice of material changes before they take effect where required. Changes do not remove rights provided by applicable law.