Privacy policy

Plaintrace is a product of VALUNLABS LLC (“we”, “us”). We process two kinds of data, in two roles.

1. Analytics data on our customers’ websites

When a website uses Plaintrace, we process data about its visitors on behalf of that website’s owner, who decides what is measured. We are their processor; the DPA sets the terms.

What is collected: the page address (sanitised), the page title, the referring site, UTM parameters, the browser, operating system and device type (from the user agent), the language, the country, region and city, time on page and scroll depth, events the site defines, and — only if the site turns heatmaps on — which element was clicked and where inside it. If the site calls identify for signed-in users, a keyed hash of the user id it passes; if it connects Stripe, its payments (amounts, fees, refunds and the visit each is credited to, never card details).

What is never collected or stored: cookies or device identifiers, raw IP addresses, the text of what was clicked, the values of form fields, and anything that follows a visitor from one site to another. Anonymous visitors are not linked across days; a signed-in user is, only when the site calls identify.

Visitor counting: a visitor is a hash of the site, the IP address and the user agent with a secret salt that changes daily. The salt is deleted, so the hash cannot be reversed or linked across days.

Visitors’ choices: sites can honour Global Privacy Control and Do Not Track and can require consent; the browser then keeps only the visitor’s answer.

2. Data about our customers

Account: your email address, your name, and — if you sign in with GitHub or Google — the identifier they give us. Usage of the dashboard: sign-in times and API key use, to keep accounts secure. Payments: when paid plans open, billing is handled by Stripe; we do not store card numbers.

We use this data to provide the service, secure accounts and contact you about your account. We do not sell it and do not use it for advertising.

This website

plaintrace.dev sets no cookies. If it measures its visits, it does so with Plaintrace itself, under the rules above.

Location data

Country, region and city, and the network used for the datacenter bot check, are looked up on our own servers in a local copy of DB-IP’s free IP to City Lite and IP to ASN Lite databases (CC BY 4.0). No visitor address is sent to DB-IP or anyone else.

Where and how long

All data is processed and stored in the EU. Analytics data is kept while the site exists in your account; deleting a site deletes its data. Account data is deleted when you close your account, except what the law requires us to keep.

Your rights

You can ask for access to, correction or deletion of your personal data at hello@plaintrace.dev. Because visitor data carries no direct identifier, we generally cannot single out one visitor’s records; questions about a website’s analytics go to that website’s owner. You may also complain to your data protection authority.