OptikAnalytics privacy policy

At OptikAnalytics LLC ("OptikAnalytics," "we," "us," or "our"), privacy isn't a feature, it's a principle. This privacy policy explains what data we collect, how we use it, and your rights in relation to that data.

This policy applies to the OptikAnalytics website (optikanalytics.com) and the OptikAnalytics web analytics service (collectively, the "Service").

1. Who we are

OptikAnalytics LLC is a company incorporated in the State of Illinois, United States. We're the developer and operator of OptikAnalytics, a privacy-focused web analytics platform.

Contact:

Email: hello@optikanalytics.com

Website: optikanalytics.com

For the purposes of the EU General Data Protection Regulation (GDPR), OptikAnalytics LLC is the data controller of personal data collected from Account Holders (Section 3) and a data processor on behalf of our customers for Analytics Data collected from End Users (Section 4).

2. Definitions

• "Account Holder" or "Customer" means an individual or organization that registers for an OptikAnalytics account.
• "End User" means a visitor to a website on which an Account Holder has installed the OptikAnalytics tracking script.
• "Analytics Data" means the website traffic and visitor behavior data collected by the Service on behalf of an Account Holder.
• "Lightweight Mode" means OptikAnalytics's cookie-free tracking script (under 1KB gzipped) that collects anonymized analytics data.
• "Advanced Mode" means OptikAnalytics's fuller tracking script that enables visitor and session tracking, session replays, heatmaps, and additional tracking features.

3. Data we collect from Account Holders

When you create and use an OptikAnalytics account, we collect:

• Name and email address (for account creation, authentication, and communication)
• Billing information (processed and stored by Paddle, our merchant of record)
• Country of origin (for tax and compliance purposes)
• Security and activity logs: IP address, approximate location (country and city), device type, and operating system, recorded when you sign in and take account actions such as changing your password. These logs are automatically deleted after 90 days.

We use this data to:

1. Operate and maintain your account
2. Process payments and manage subscriptions
3. Send transactional emails (account confirmations, billing receipts, security alerts, product updates)
4. Respond to support inquiries
5. Protect your account and detect fraud, abuse, and unauthorized access
6. Comply with legal obligations

Legal basis (GDPR): Performance of a contract (Article 6(1)(b)) and legitimate interest (Article 6(1)(f)) for account administration, security, and service communications.

4. Data we collect from End Users

OptikAnalytics collects data from End Users on behalf of our customers. The data collected depends on the tracking mode the customer selects.

4.1 Lightweight Mode

In Lightweight Mode, the Service collects:

• Pages viewed and entry pages
• Referrer URLs and UTM campaign parameters
• Continent, country, region, city, and timezone
• Device type, operating system, browser, and browser language
• Screen resolution and light/dark mode preference
• Visiting hours
• Goals and conversion events
• Outbound link clicks

What Lightweight Mode doesn't collect:

• No cookies are set or read
• No IP addresses are stored (IP addresses are processed in memory solely for geolocation and IP exclusion filtering, then immediately discarded)
• No personal data is collected
• No cross-session tracking occurs
• No cross-site tracking occurs
• No fingerprinting is performed
• No local storage or session storage is used

Because Lightweight Mode doesn't collect personal data or use cookies, it doesn't require a cookie consent banner under GDPR, PECR, or the ePrivacy Directive.

4.2 Advanced Mode

In Advanced Mode, the Service may collect all of the data listed in Lightweight Mode, plus:

• Random visitor and session identifiers, stored in the End User's browser local storage
• Exit pages, session duration, and visitor journeys
• Operating system and browser versions
• Click, scroll, window resize, and form submission events (form field values are never collected)
• Custom parameters set by the Account Holder (up to 20 per visitor)
• Session replay recordings (all form inputs are masked, and Account Holders can hide additional page text)
• Click and scroll heatmap data
• IP addresses, which are masked before storage by default (every digit is replaced, so the stored value can't identify anyone). Full IP addresses are only stored if the Account Holder turns on IP storage for that website.

Advanced Mode may constitute processing of personal data under GDPR and may require consent under PECR and the ePrivacy Directive. Account Holders are responsible for implementing appropriate consent mechanisms before enabling Advanced Mode. For guidance, refer to our Terms of Service.

Opting out: End Users can opt out of Advanced Mode tracking on a website by visiting any page on that site with ?pixel_optout=true added to the end of the URL. This clears OptikAnalytics identifiers from the browser and stops tracking on that site. Visiting with ?pixel_optout=false opts back in.

Legal basis (GDPR): Data processing on behalf of the Account Holder (data controller) under a Data Processing Agreement (Article 28).

5. Cookies and tracking technologies

5.1 The OptikAnalytics service

• Lightweight Mode: No cookies, no local storage, no session storage, no tracking pixels, no fingerprinting. Zero client-side storage of any kind.
• Advanced Mode: Doesn't use cookies. Stores random visitor and session identifiers, goal completion flags, and the End User's opt-out preference in first-party local storage to enable session replays, heatmaps, and visitor journey tracking. No third-party cookies or storage are ever used.

5.2 The OptikAnalytics website and dashboard

The optikanalytics.com website uses OptikAnalytics itself (in Lightweight Mode) for website analytics. No third-party analytics, advertising, or tracking scripts are used on our website. Our website is hosted on SwyftBuilder, built on Brizy Cloud. If you join our waitlist, we collect only your email address, and we use it only to tell you about early access and our launch (legal basis: consent, Article 6(1)(a) GDPR). The sign-up form stores your submission in our website platform and forwards it to our business inbox. We don't add waitlist emails to any marketing tool. We keep waitlist emails for as long as the waitlist runs, and you can ask us to remove yours at any time by emailing hello@optikanalytics.com.

When you sign in to the OptikAnalytics dashboard, we use strictly necessary first-party cookies to keep you signed in, remember your preferences (such as language, currency, and selected website), grant access to password-protected shared reports, and protect against brute-force attacks. These cookies aren't used for tracking or advertising.

6. How we use data

We use the data we collect to:

1. Provide the Service: Deliver analytics dashboards and reports to Account Holders
2. Operate the platform: Maintain infrastructure, monitor performance, and prevent abuse
3. Process payments: Via Paddle, our merchant of record
4. Send transactional emails: Via ZeptoMail by Zoho, for account and billing communications
5. Improve the Service: Using aggregated, non-personally-identifiable operational metrics (total number of accounts, general geographic distribution of customers, service usage patterns)
6. Comply with law: Respond to legal process and enforce our Terms of Service

We don't use data to:

• Sell or rent personal data to third parties
• Serve advertisements
• Build advertising profiles
• Track users across websites or services
• Engage in data brokering of any kind

7. Data sharing and sub-processors

We don't sell, rent, or share personal data or Analytics Data with third parties for their own purposes. We share data only with the following sub-processors, strictly as necessary to operate the Service:

• Cloudways / DigitalOcean: Application hosting and data storage (United States)
• Paddle (Paddle.com Market Limited): Payment processing, billing, invoicing, tax handling / merchant of record (United Kingdom / EU)
• ZeptoMail by Zoho: Transactional email delivery (see Zoho's data processing information)

IP geolocation is performed on our own servers using an offline database, so End User IP addresses are never sent to a third-party geolocation service.

We may update this list as the Service evolves. Material changes to our sub-processor list will be communicated to Account Holders via email or through the Service with reasonable advance notice.

We may also disclose data if required by law, legal process, or a valid governmental request, or to protect the rights, property, or safety of OptikAnalytics, our users, or the public.

8. Data storage and international transfers

All Analytics Data and account data is processed and stored on servers located in the United States, hosted by Cloudways (DigitalOcean infrastructure).

If you or your End Users are located outside the United States, including in the European Economic Area (EEA), United Kingdom, or Switzerland, the use of the Service involves the transfer of data to the United States.

We implement appropriate safeguards for international data transfers, including:

• Standard Contractual Clauses (SCCs) as approved by the European Commission, where required
• Data Processing Agreements with all sub-processors
• Technical and organizational security measures

9. Data retention and deletion

9.1 Analytics Data (End User Data)

• Active accounts: Retained for the retention period of the plan the data was collected under, then automatically and permanently deleted.
• After cancellation: The account moves to the free plan. Existing Analytics Data stays in the account until it reaches the end of its retention period, the Account Holder deletes it, or the account is deleted.
• Deletion: Account Holders can delete individual websites and their Analytics Data, or their entire account, at any time from their account settings. Deleted data is purged from backups within 60 days.

9.2 Account Holder data

• Account deletion requests: You can delete your account from your account settings, or send a verified request to hello@optikanalytics.com. Your account and all associated data will be deleted from active systems within 30 days. Backup purge follows within 60 days.
• Security and activity logs: Automatically deleted after 90 days.
• Inactive accounts: Free plan accounts with no activity for 24 consecutive months will receive a deletion notice. If you don't sign in within 30 days, the account and all associated data will be deleted.

9.3 Billing records

Billing and financial records (invoices, payment records, tax documents) are retained for a minimum of 7 years from the date of the transaction, as required by law. These records are maintained by Paddle and are used solely for tax, accounting, and legal compliance.

10. Your rights

10.1 Rights under GDPR (EEA, UK, Switzerland)

If you're located in the EEA, UK, or Switzerland, you have the following rights under the GDPR:

• Right of access (Article 15): Request a copy of the personal data we hold about you
• Right to rectification (Article 16): Request correction of inaccurate personal data
• Right to erasure (Article 17): Request deletion of your personal data
• Right to restrict processing (Article 18): Request restriction of processing in certain circumstances
• Right to data portability (Article 20): Receive your data in a structured, machine-readable format
• Right to object (Article 21): Object to processing based on legitimate interest
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at hello@optikanalytics.com. We'll respond within 30 days.

You also have the right to lodge a complaint with your local data protection supervisory authority.

For End Users: If you're an End User visiting a website that uses OptikAnalytics, the website owner (our customer) is the data controller for your data. Please contact the website owner directly to exercise your rights. In Lightweight Mode, no personal data is collected, so these rights generally aren't applicable. In Advanced Mode, you can also opt out as described in Section 4.2.

10.2 Rights under CCPA/CPRA (California)

If you're a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to know: Request disclosure of the categories and specific pieces of personal information we've collected
• Right to delete: Request deletion of your personal information
• Right to correct: Request correction of inaccurate personal information
• Right to opt-out of sale: We don't sell personal information. No opt-out is necessary.
• Right to non-discrimination: We won't discriminate against you for exercising your rights

To exercise these rights, contact us at hello@optikanalytics.com. We'll verify your identity and respond within 45 days.

Categories of personal information collected in the preceding 12 months: Identifiers (name, email, IP address in security logs), commercial information (billing records), internet activity (analytics data as described in Sections 3 and 4).

Categories sold: None. We don't sell personal information.

Categories shared for cross-context behavioral advertising: None.

11. Data security

We implement appropriate technical and organizational measures to protect data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encrypted data transmission (TLS/HTTPS)
• Secure server infrastructure
• Access controls, two-factor authentication, and sign-in lockouts after repeated failed attempts
• Regular security reviews

While we take reasonable steps to protect data, no method of transmission or storage is 100% secure. We can't guarantee absolute security.

12. Children's privacy

The Service isn't directed to children under the age of 16. We don't knowingly collect personal data from children. If we learn that we've collected personal data from a child under 16, we'll take steps to delete that data promptly. If you believe a child has provided us with personal data, contact us at hello@optikanalytics.com.

13. Changes to this privacy policy

We may update this privacy policy from time to time. When we make material changes, we'll notify Account Holders by email and/or through a prominent notice on the Service at least 30 days before the changes take effect.

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised policy.

The "Last updated" date at the top of this policy indicates when it was most recently revised.

14. Data Processing Agreement

Account Holders who require a Data Processing Agreement (DPA) in connection with GDPR or other data protection regulations can request one by contacting hello@optikanalytics.com. The DPA is incorporated into our Terms of Service by reference.

15. Contact

If you have questions, concerns, or requests regarding this privacy policy or our data practices, contact us at:

OptikAnalytics LLC

Email: hello@optikanalytics.com

Website: optikanalytics.com

For GDPR-related inquiries, you may also contact your local data protection supervisory authority.