Privacy

What we collect, what we never collect, where it lives, and what we will not claim.

What is collected

Field	How it is derived	Stored
ip_address	Used in memory for country lookup and the daily hash	never stored
user_agent	Parsed to browser, version and OS, then discarded	never stored
visitor_id	HMAC of a per-project salt that is destroyed every 24 hours	stored
path	URL path, with identifier-shaped segments masked to :id	stored
query string	Dropped except an allowlist of utm_* and ref	never stored
referrer	Host and masked path; internal referrers dropped entirely	stored
country	MaxMind lookup against a local file, no external call	stored
click ids	Which ad network sent the click; the identifier itself is discarded	never stored
properties	Exactly what you choose to send with an event	stored

Where it lives

Visitor browser (anywhere)
   │  HTTPS
   ▼
ingest.metricward.eu. Sweden
   │  IP used in RAM only → country + daily salted hash → discarded
   ▼
ClickHouse (Sweden) ── replica (Sweden) ── backups (Sweden, encrypted)
Postgres   (Sweden) ── replica (Sweden) ── WAL archive (Sweden, encrypted)

Outbound, only when you enable it:
  Stripe    billing only, your company details, never visitor data
  Mailjet   report delivery to recipients you choose

What we will not claim

We will not tell you that you are GDPR compliant.

We are a processor. Compliance is a property of your organisation, your legal basis and your notices, not of a tool you installed.

We will not tell you that cookieless means no consent banner.

ePrivacy Article 5(3) covers storing or accessing information on a device, not only cookies. Whether your configuration needs consent depends on your setup and your national regulator. Several competitors state otherwise; it is the most common piece of misinformation in this category.

We will not claim deletions are instant in backups.

Deleted data disappears from backups as the 30-day rolling window ages out. Our DPA says exactly that, because no system honestly does otherwise.

We will not pretend modelled numbers are measured ones.

Everything in the product is labelled observed, calculated, modelled or generated, and anything modelled shows its confidence and its inputs.

Your controls

· Retention from 3 to 36 months per project, enforced by a job, with the real deletion date shown in-app.
· Subject access and erasure from the Privacy screen, each producing a receipt with verified row counts.
· Global Privacy Control and Do Not Track honoured, nothing at all is collected from a visitor who sends either.
· Query-parameter allowlist and path masking, so identifiers in URLs never reach storage.
· A kill switch: disable collection for a project and the SDK stops within 60 seconds.

Nothing on this page is legal advice. If it matters to your organisation, it should be checked by someone whose job that is.