Privacy Policy

In brief: We build privacy-first analytics. We do not use advertising cookies, we do not sell personal data, and we collect only what is needed to run the service.

1. Summary

No advertising cookies: We do not set advertising or cross-site tracking cookies on puremetrix.org or via our analytics script on customer sites.
Cookieless visitor analytics: Visitor measurement hashes IP-related signals with a daily rotating salt. Raw IPs are not stored.
EU storage for analytics: Visitor analytics are hosted in Germany (EU) on Hetzner.
Account data: Email (and optional Google sign-in); payments via Stripe.
Control: Export or delete sites and analytics data from the dashboard.

2. Data controller

Controller under the GDPR:

Name: Lydia Rebers (sole proprietorship / Einzelunternehmen)
Address: Destouchesstr. 3, 80803 Munich, Germany
Privacy: [email protected]
General: [email protected]
Imprint: https://puremetrix.org/imprint/

3. Roles

Accounts & puremetrix.org visitors: PureMetrix is controller.
Visitor analytics on customer sites: PureMetrix is processor for the customer. See the DPA.

4. What we process

A. Visitors to puremetrix.org

No third-party advertising pixels or remarketing cookies from us.
Page metrics via our own cookieless engine.
Whether a consent banner is required for your own site depends on your setup and applicable law — we do not claim a universal legal exemption.

B. Dashboard customers (app.puremetrix.org)

Account: email; auth tokens (magic link or optional Google sign-in).
Session cookie (px_session): first-party cookie to keep you signed in — not used to track site visitors.
Locale preference: may be stored locally (e.g. cookie or similar) to remember language.
Billing: card and billing data processed by Stripe; we do not store full card numbers.

C. Visitor data for customers (collect.puremetrix.org)

Page URLs, referrers, device type, approximate country, custom goals — cookieless and pseudonymised as described above and in the DPA.
Raw IP and User-Agent are combined with a daily salt, hashed, and discarded — not written to disk.

5. Legal bases (Art. 6 GDPR)

Contract (Art. 6 (1) (b)): account, subscription, dashboard, support.
Legitimate interests (Art. 6 (1) (f)): security, abuse prevention, service reliability.
Legal obligation (Art. 6 (1) (c)): tax and commercial record-keeping.

6. Subprocessors & transfers

Hetzner Online GmbH (Germany / EU): hosting, databases, EU backups.
Cloudflare, Inc. (USA / global): DNS, CDN for script delivery, DDoS protection. EU-U.S. Data Privacy Framework and/or SCCs as applicable.
Stripe Payments Europe, Ltd. / Stripe, Inc.: payments and invoicing. DPF and/or SCCs as applicable.
Amazon Web Services EMEA SARL (SES): transactional email (login links, billing alerts). Open/click tracking disabled.
Google LLC (optional): only if you use “Sign in with Google”. No analytics data shared with Google for that purpose.

7. Retention

Account: while active; deleted without undue delay after deletion, subject to legal retention (e.g. invoices).
Analytics: per site and plan (Free 1 month; Starter 12; Growth 18; Business 24; Enterprise custom, default 36).
Deleting a site removes its analytics records from ClickHouse.

8. Your rights (Art. 15–21 GDPR)

Access, rectification, erasure, restriction, portability, objection — as applicable.
Complaint to a supervisory authority (for us in Bavaria: Bayerisches Landesamt für Datenschutzaufsicht; or your local authority in the EU).
Contact: [email protected]

Last updated: September 2026