Privacy Policy

Data protection law distinguishes between deciding why data is collected (the controller) and handling it on someone else's instructions (the processor). We are both, depending on whose data it is:

• Your account data: we are the controller. If you sign up for SnowAnalytics, we decide what we need in order to run your account, and this policy governs it.
• Your website visitors' data: we are the processor. When you install the tracking script, you decide what to measure. We store and process it on your behalf. You are the controller for that data, which means telling your own visitors about it in your own privacy notice is your responsibility.

If you are a visitor to a website that uses SnowAnalytics and you want your data removed, contact that website's owner. They control it; we act on their instructions. You can also write to us at [email protected] and we will help route the request.

When someone visits a website running SnowAnalytics, the script records the following. Everything here describes a page view or an event. None of it identifies a person by name unless the site owner deliberately sends us that (see section 4).

We do not store IP addresses. The IP address is used only when the request arrives to look up an approximate location and compute the pseudonymous identifier described below. It is then discarded. It is not written to our analytics database, and there is no field in that database that could hold it.

Location lookup happens on our own servers using a local MaxMind GeoLite2 database file. Your visitors' IP addresses are not sent to MaxMind or to any other third party for this.

We run the same script, in cookieless mode, on our own website, docs and dashboard, so this is also what we record when you visit snowanalytics.app. It leaves out the tokens and email addresses that our password reset, email verification and invite pages carry in their addresses.

By default, SnowAnalytics sets no cookies and stores no device identifier. Instead, each visitor identifier is a keyed hash (HMAC) of the website, the IP address and the User-Agent, combined with a salt that rotates every day.

Two consequences follow, and they are the point of the design: the identifier cannot be reversed to recover an IP address, and it changes every 24 hours, so the same person visiting on Monday and Tuesday is not linkable across those days. This is what allows the default configuration to run without a consent banner in most jurisdictions.

Site owners can switch a site to Standard mode, which sets a first-party cookie and does allow recognition across days. That is off unless deliberately enabled, and it carries its own consent obligations. The Cookie Policy covers exactly what changes.

We are not lawyers and this is not legal advice. Whether you need a banner depends on your jurisdiction and your overall setup. Take your own advice on it.

Two optional features cause personal data to be stored, and both require the site owner to switch them on deliberately:

• The identify() call. A site owner can attach their own user ID, and optionally a name, email address and custom attributes, to a visitor. Nothing is sent unless the site owner writes that code. Whatever they send, we store.
• Payment provider connections. If a site owner connects Stripe, we sync payment and subscription records, including amounts, currency, status, billing reason, and the customer email address, so that revenue can be attributed back to the traffic that produced it.

We never receive or store card numbers, bank details or any other payment credentials. Those stay with the payment provider.

If you enable either feature, you are processing personal data about identifiable people, and you need a lawful basis and a privacy notice of your own that covers it.

To run your account we hold:

• Your name and email address, and a securely hashed password. We never store the password itself.
• Session records so you stay signed in, and basic security metadata such as sign-in timestamps.
• The sites you have added, your settings, and any API keys you create.
• Support correspondence, if you email us. That lives in our mailbox for as long as it is useful.

We use this to authenticate you, provide the service, and email you about your account. We do not send marketing email you did't ask for.

While you are signed in, our own analytics also links your visits to snowanalytics.app to your account, using your user ID, name, email address, profile image and plan, so we can see how the product is used.

We keep the list of third parties deliberately short. Each of these is bound by a contract to process data only on our instructions:

We do not sell personal data, we do not share it with data brokers, and we do not use it for advertising or to train machine-learning models. There is no advertising business here for your data to feed.

• Analytics data is kept for the retention period of your plan. Delete a site and its data is queued for permanent deletion.
• Account data is kept while your account is open. Close your account and we delete it, other than records we are required to keep (for example, invoices for tax purposes).
• Backups roll over on their own schedule, so deleted data can persist in a backup for a short period before ageing out.

Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, take it elsewhere, or object to how it is processed. To exercise any of these, email [email protected].

We will respond within 30 days. We do not charge for this, and we will not make your experience worse for having asked.

If you are unhappy with our response, you can complain to your local data protection authority.

Data is encrypted in transit. Credentials you give us for third-party services, such as payment provider keys, are encrypted at rest. Access to production systems is limited to the people who need it.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your data, we will tell you without undue delay.

Our providers may process data outside your country, including in the United States. Where required, those transfers rely on Standard Contractual Clauses or an equivalent safeguard.

If we change this policy in a way that materially affects you, we will email account holders before it takes effect rather than quietly editing the page. The effective date at the top always reflects the current version.

Kapybara LLC, 1309 Coffeen Avenue, Suite 1200, Sheridan, Wyoming 82801, United States. Data protection enquiries: [email protected].