Not legal advice
This page describes what the product does. It is written carefully and it is checkable, but your obligations depend on your jurisdiction, your sector and what else is on your site — and a vendor telling you that you are compliant is a vendor you should not believe. Take this to whoever advises you, rather than instead of them.
What is collected
For each pageview or event:
- the page URL, and the referrer if there was one
- UTM campaign parameters, when present in the URL
- a coarse location — country, and region or city where the signal supports it
- browser, operating system and device class
- screen size class
- the event name and any properties you chose to attach
- an amount and currency, where you attached them to a conversion
What is never collected or kept
- No cookies. Not a first-party cookie, not a third-party cookie, not a "strictly necessary" one. Nothing.
- No identity in browser storage. The only two things ever written are flags the visitor or the site owner set themselves — the opt-out and the self-exclusion flag. Neither identifies anybody and neither is ever transmitted.
- No IP address, anywhere. Not in a database, not in a log, not in an archive, not in a backup. It exists only as a local variable inside a single request and is gone before the response is sent.
- No fingerprint. No canvas, no font enumeration, no audio, no timezone probe, no hardware survey. The request the script makes is small enough to read in a network tab in one glance.
- No cross-site anything. A visitor cannot be recognised on another site running the same product, and there is nothing to sell to an ad network because there is nothing to join to.
How visitors are counted without an identifier
A returning visitor within one day has to be recognised somehow, or every page load would look like a new person. The property that matters is what that recognition cannot do, and there are three guarantees:
- It is one-way. What is stored is a hash. It cannot be turned back into the visitor, by us or by anyone who obtained the database.
- It does not survive the day. The token rotates daily, and yesterday's cannot be recomputed. A visitor who comes back tomorrow is a new visitor as far as the data is concerned. That is a deliberate loss of accuracy in exchange for a guarantee.
- It does not cross sites. The same person on two sites using this product produces two unrelated tokens. There is no joining key, so there is no profile to build.
We do not publish the construction of the hash, and that is a deliberate line rather than an oversight: the guarantees above are what you need in order to assess the product, and the recipe is what a competitor needs in order to copy it. Everything in this section is verifiable from the outside — you can watch the request, inspect your storage, and see that a visitor is not recognised across a midnight boundary.
How long things are kept
Aggregated statistics are kept for 3 years starter and growth · 5 years business. Session replay recordings, if you buy that add-on, are kept for a shorter, configurable window.
A locked account — one whose trial ended or whose subscription was cancelled — loses the ability to read its statistics. It does not lose them. Collection continues, history stays where it is, and paying again restores access to all of it. We are not going to hold a gap in your data over you as a retention tactic, and no page on this site will ever describe locking as deletion.
What is still your job
Not needing a consent banner is not the same as having nothing to do. Five things remain yours:
- Say what you measure. Your privacy notice should mention that you use analytics, what it collects, and that it sets no cookies. There is suggested wording on the opt-out page.
- Offer the objection. Build the opt-out control. It is about ten lines and it is the difference between a right that exists and a right a visitor can exercise.
- Keep personal data out of custom properties. This is the one way to break the whole guarantee from your own code. An email address, a username or an internal user id in an event property is personal data that you chose to send, and it puts your consent and erasure obligations straight back where they were. Send the plan, not the person.
- Handle the rest of your site. If you also run an advertising pixel, an embedded video player, a chat widget or a tag manager, those have their own cookies and their own consent requirements. Removing one analytics script does not remove a banner that four other scripts require.
- Keep your own records. If you maintain a record of processing activities, this belongs in it like any other processor.
Jurisdiction
Each account picks a storage jurisdiction when it is created, and every store for that account is created inside it. Backups stay inside it. The choice is made once and cannot be changed afterwards.
A signed data processing agreement naming your jurisdiction is part of an Enterprise arrangement rather than something sold as a self-serve extra.
Erasure and access requests
Three distinct requests, with three different answers:
- "Erase this individual's analytics data." There is nothing to erase, because there is nothing in the dataset attributable to an individual. This is the intended outcome of the design rather than a refusal — and it is the same answer you can give your own visitors with confidence.
- "Delete this site's data." Delete the site from your dashboard and its events are removed, including from backups on their next rotation.
- "Delete my account." Close it and everything goes, except the billing records tax law requires us to keep. Or write to hello@absolutelyanalytics.com and we will do it for you.
Do Not Track and Global Privacy Control
Neither signal is checked. That is a real gap against at least one competitor, who honours Do Not Track by default, and we would rather you read it here than find out later. What exists instead is a first-class opt-out that you expose through your own interface, where a visitor can see it and use it.
Related
Our own privacy policy covers what we do with your data as a customer, which is a different question from this page. If you are comparing the compliance story against another product, the Google Analytics migration guide sets out where the difference actually is.
Common questions
Do I need a cookie banner for this script?
No. The rule that produces cookie banners in the UK and the EU is about storing information on, or reading information from, a visitor's device. This script does neither: it sets no cookie, and the only thing it ever writes to browser storage is a flag the visitor themselves set to opt out — which is exempt, because it exists solely to carry out the visitor's own request.
Verify it rather than believing it. Open your browser's storage panel on a page carrying the script; there is nothing there.
Is this personal data under the GDPR?
Our position is that what is stored is not personal data: no IP address is retained, no cookie or device identifier is set, and the visitor token cannot be reversed, cannot be linked to a person, and cannot be joined to the same browser tomorrow or to any other website today.
The honest caveat is that "not personal data" is a conclusion a regulator draws, not one a vendor can grant. What we can tell you is exactly what is and is not kept, so that you or your advisers can reach the conclusion yourselves.
Who is the controller and who is the processor?
You are the controller for the statistics about your own site; we process them on your instructions. That is the ordinary shape, and it is the shape a data processing agreement assumes.
It also means the obligations that land on a controller — telling visitors what you measure, answering their requests, keeping your own records — remain yours. Nothing on this page moves them.
Can you delete one visitor's data on request?
No, and the reason is the point rather than an excuse: there is nothing in the data that identifies which rows would be theirs. Nobody can be singled out for erasure because nobody was ever singled out for collection — not by us, not by you, and not by anyone who obtained the database.
What we can do is delete a site, or an account, in full. See erasure.
Where is the data stored?
In the jurisdiction you choose when the account is created. Every store for that account is created inside it and backups do not leave it. The choice cannot be changed afterwards, which is deliberate — a stored region that can move is not a region, and a claim about residency that can be quietly revised is not a claim worth making to a procurement team.