We process, for the site owner: the page path viewed, campaign tags if present in the address (only utm_source, utm_medium and utm_campaign — the rest of the query string is discarded), the referring domain, a device class, a browser family, a same-day-only anonymous hash, and — where a site uses them — named custom events (e.g. "signup") with no content beyond the name, path and time. We do not store your IP address (it is hashed with a salt destroyed daily, then discarded), set no cookies, use no localStorage, and honour Do Not Track and Global Privacy Control by not recording you at all. We believe this processing involves no personal data as stored; to the extent the transient handling of your IP is processing under UK GDPR, the lawful basis is legitimate interests (privacy-minimising audience measurement), and the data is anonymised at the moment of storage. Full technical detail: docs.
We store: your email address, a password hash (bcrypt-class), your sites' labels and keys, and the analytics described above for your sites. We use your email only to operate your account (login, replies to your support messages, and legally required notices). No marketing without separate opt-in. One strictly-necessary session cookie (ea_session) keeps you logged in — it does no tracking.
UK GDPR rights (access, rectification, erasure, portability, objection) — email us and we act promptly. Removing a site deletes its analytics data immediately; account deletion removes everything. Raw analytics rows auto-purge within 90 days at most, on every plan (sooner on sites keeping less history — Free sites keep 60 days); before purging, each completed day is reduced to aggregate counts (totals per page, referrer, device, campaign and event) which contain no per-visitor data of any kind. How long those aggregates are kept is a per-site setting chosen by the site owner: 60 days on Free accounts, and on Pro accounts anywhere from 1 month to indefinite (default 3 years). Data is hosted on our server in the European Union, so both UK GDPR and EU GDPR standards apply, and transfers between the UK and EU are covered by the mutual adequacy decisions. We use no third-party processors for the analytics pipeline itself; hosting infrastructure is our EU hosting provider.
Data controller: MBX Ltd, trading as CAAC — registered in England and Wales, company no. 07985810. Registered office: 82 James Carter Road, Mildenhall, Suffolk, IP28 7DE. Contact: caac.mbx+support-ethical-analytics@gmail.com.