Privacy Policy
This policy covers Supersaas Analytics, the hosted web analytics service at this website ("the Service"), run by Company legal name, address ("we", "us"). It has two parts, because we handle two kinds of data:
- Your account data, about you and the Members of your Organization. For this we are the controller.
- Analytics data, about the visitors of the websites you track with the Service. For this you are the controller and we are your processor, acting only on your instructions.
Questions about privacy go to hafiz@supersaasanalytics.com.
Part 1: your account data
What we collect
- Account details: your name, email address and password (stored only as a hash), or the profile Google or GitHub shares when you sign in with them (name, email address and picture).
- Organization details: Organization and Site names, domains and timezones, your role, and the people you invite.
- Billing details: your Subscription or License status and the ids Polar gives your customer record and orders. We never see or store your card details; Polar handles payment.
- Settings you give us: Goals, Funnels, Share links, Digest preferences, and the access tokens and API keys of the integrations you connect. Search Console credentials are stored encrypted.
- Ask AI conversations: the questions you ask and the answers, so you can return to them.
- Technical data: session records with the IP address and browser of each sign-in, kept while the session is valid, and server logs kept for a short time to keep the Service running and secure.
Why, and on what basis
- To provide the Service you signed up for: your account, the dashboards, emails such as sign-in links, invitations, Quota alerts and the Digests you opt into (performance of a contract).
- To bill you through Polar (performance of a contract, and our legal duty to keep accounting records).
- To keep the Service secure and to fix problems (our legitimate interest in running a reliable service).
We do not sell your data, show you ads, or use your data or your Sites' analytics data to train AI models.
How long we keep it
Account data is kept while your account exists. When you delete an Organization, its Sites and their analytics data are deleted with it. Billing records are kept as long as tax law requires.
Part 2: analytics data about your Sites' visitors
What the tracking snippet collects
The snippet sets no cookies and stores nothing on the visitor's device. For each page view it sends the page's path
(without the query string, apart from the five utm_ campaign parameters), its title, and the referring website's
domain. It also sends clicks on links to other websites, contact links, form submits and the Events your website
reports.
On our servers we derive from each request the visitor's country, region and city, approximate coordinates, and their browser, operating system and device type. We then discard the IP address and the User-Agent: we never store them. Visitors are counted with an id computed from a random salt that changes every day and is then deleted, so the same person cannot be recognised from one day to the next. The Privacy model page explains this in detail.
If your website calls identify(), we store a keyed hash of the id you pass, never the id itself. If you connect a
payment provider, we store each payment's amount, currency, the provider's ids and the visitor id it was attributed to,
and fetch customer emails from the provider only when someone views them, without storing them.
Your responsibilities
As controller, you decide whether to use the Service on your website and you inform your visitors, for example in your
own privacy policy. If you use identify() or Revenue attribution, make sure you have a lawful basis for it.
How long we keep it
We keep analytics data so that reports can cover 3 years. It is deleted as soon as you delete the Site or the Organization.
Who else handles data
We use these sub-processors to run the Service:
| Provider | What for | Data |
|---|---|---|
| Cloudflare, Inc. | Hosting, database and file storage | All data held by the Service |
| Polar Software, Inc. | Payments, as merchant of record | Billing details |
| Resend, Inc. | Sending email | Recipients' email addresses and the email's content |
| Anthropic, PBC | Ask AI answers and Digest summaries | Your question and aggregated figures, such as totals, top pages, Sources and countries; never individual visitors |
| Google and Bing | Search Console data, when you connect it | The access you grant |
Some of them process data outside the European Economic Area, notably in the United States. Where they do, the transfer relies on the EU-U.S. Data Privacy Framework or on the European Commission's Standard Contractual Clauses.
Your rights
Under the GDPR and similar laws you can ask to access, correct, delete or export your personal data, object to or restrict how we use it, and complain to your data protection authority. Write to hafiz@supersaasanalytics.com, and we answer within one month.
Visitors of a website that uses the Service should contact that website's owner, who is the controller of their data. We help our customers answer such requests. Since we store no IP address, cookie or other identifier that lasts beyond one day, we usually cannot find a particular visitor's data.
Cookies on this website
This website and the dashboard use one essential cookie to keep you signed in, and Share links with a password set one to remember that you entered it. We use no analytics, advertising or tracking cookies.
Changes
We will post any change here and update the date above. If a change matters for how we handle your data, we will tell account Owners by email before it applies.