Privacy Policy

When a website you visit uses VeritaMetrics analytics, we collect the following information on behalf of our Customer (the website owner):

• Page Context: The specific URL visited and the Page Title.
• Traffic Source (Referrer): The URL of the page the user was on immediately before clicking a link to your site. We use this for attribution, but we do not have access to history prior to that link.
• Device Context: Browser type, Operating System, and Device type (e.g., Mobile vs Desktop).
• Approximate Location: Country, Region, and City derived from the IP address, which is not written to the row. Our geolocation cache keeps the address as a key for up to 24 hours.
• Ephemeral Visit ID: A salted SHA-256 hash that takes the UTC date as one of its inputs, so a different ID is issued each day. The salt is itself replaced daily and deleted 48 hours later. Nothing we store carries one day's ID into the next.

Our Pseudonymization Process

To protect End-User privacy while still providing valuable analytics, we employ sophisticated pseudonymization techniques:

• IP Address Handling: The address arrives with the request, derives the `visitId`, and feeds the approximate location lookup. It is never written to a pageview or event row. Before it enters the hash we cut it to its network block, the first three octets for IPv4 (a /24) and the first three groups for IPv6 (a /48), so the full address is never hashed. The location lookup still uses the full address.
• Where the Address Goes: The address stays in memory for the request and is not stored on any analytics row. It leaves the handler in two places: the network lookup sends it to our geolocation provider, and that result is cached under the address as a key for up to 24 hours. When the lookup fails, the address is also written to our server logs; removing that is planned.
• Daily Identifier Reset: The `visitId` is a SHA-256 hash whose inputs include the UTC date, so a new ID is issued at 00:00 UTC and nothing we store carries the previous day's ID forward. The secret salt mixed into the hash is replaced with 16 fresh random bytes at the same time each day.
• Salt Deletion: A retired salt is deleted once it is 48 hours old. We keep it that long, rather than discarding it at once, because a visit that starts before 00:00 UTC and continues after it is resolved against the previous salt so it counts as one visitor rather than two.
• One-Way Hashing: We create the `visitId` with SHA-256, which cannot be read back to recover the inputs. One limit, and the reason the salt is deleted: while a salt still exists, anyone holding it can test a guessed IP and User-Agent against a stored ID and see whether it matches. Once it is deleted, the IDs computed under it can no longer be reproduced from any guess.

Crucially, our architecture enforces privacy:

• Zero-Cookie Transmission: Our tracking script is sandboxed (`credentials: omit`). It is technically incapable of reading, transmitting, or storing cookies on the End-User's device.
• Never on a Stored Row: IP addresses are used during the request for geolocation and hashing. No IP address is written to a pageview or event row; the geolocation provider's answer is cached under the address for up to 24 hours.
• No Cross-Site Tracking: Because we do not use persistent IDs, we cannot track users across different websites or devices.

To provide our Services, we collect the following from our registered Customers:

• Account Information: Name, email address, company name (optional). Used for login, communication, and service administration.
• Website Information: Domain(s) of the website(s) where you install the VeritaMetrics tracking script.
• Billing Information: We use a third-party payment processor. We do not store full credit card details.
• Usage Data: Information about how you use the VeritaMetrics dashboard to improve our service.
• Configuration Preferences: Including privacy settings, data retention periods, and legal basis choices.

• To Provide & Improve Services: Operate the analytics platform, generate reports for Customers, administer accounts, improve features.
• To Communicate: Respond to inquiries, send service updates, billing information, and (with consent) marketing materials.
• For Billing & Account Management: Process payments and manage customer accounts.
• For Security & Compliance: Protect against fraud, abuse, and ensure adherence to legal obligations.

• End-User Analytics Data: Customers can configure custom data retention periods. After this period, data is automatically deleted.
• Customer Account Data: Retained as long as the account is active and for a reasonable period afterward for legal and operational requirements.
• Site Visitor Data (Forms): Retained as long as necessary to address the inquiry.

The architecture limits what can be collected in the first place. These are the controls that follow from it, and one that is not built yet:

• The 24-Hour Firewall: The visitor ID is a SHA-256 hash that takes the current UTC date and a secret salt as two of its inputs, so the same End-User is assigned a different ID once the date changes at 00:00 UTC. Nothing we store carries the previous day's ID forward. The website's own ID is another input to that hash, so the same End-User also gets a different ID on every other site we measure.
• Daily salt rotation: A scheduled job replaces the secret salt with 16 fresh random bytes every day at 00:00 UTC, then deletes every salt older than 48 hours, keeping only the current salt and the one it replaced. We hold the previous salt for those 48 hours so a visit that spans midnight is counted once rather than twice. Once a salt is deleted, the visitor IDs computed under it can no longer be recomputed, including by us, because the secret that produced them no longer exists. While a salt is still live, someone holding it could test a guessed IP address and User-Agent against a stored ID to see whether the two match, which is what the deletion ends.
• Browser privacy signals: Our script does not yet read Global Privacy Control or "Do Not Track". Support for both is in development. Until it ships, do not rely on either signal to stop collection on a site running VeritaMetrics.
• Opt-Out Support: Customers can implement a simple opt-out mechanism that suppresses the tracking script entirely for specific users.

Depending on your location, you may have rights regarding your personal data (Access, Rectification, Erasure, etc.).

End-Users: As we do not store identifiable personal data about End-Users, requests should be directed to the respective website owner (our Customer).

Customers & Site Visitors: To exercise your rights, please contact us at privacy@veritametrics.com.

If a Customer uses the VeritaMetrics self-hosting option, the Customer is solely responsible for the collection, processing, storage, security, and compliance of all data within their own environment.