Privacy Policy

We store behavior, not identity. LyticData does not collect or store your end-users' names or email addresses, and does not store raw IP addresses. Every end-user is identified only by a random, anonymous identifier.

• A random anonymous visitor ID (a UUID stored in their browser). Never a name.
• Page URLs and paths, referrer, and UTM campaign parameters.
• Device, browser, operating system, and screen size.
• Coarse location only — country and city. We never store precise GPS / lat-long.
• On-page behavior: time on page, scroll depth, and which elements were clicked (we never read text you typed into form fields).
• Error messages and stack traces from your site, to help you fix bugs.

• End-user names, email addresses, or profile photos.
• Raw IP addresses — an IP is used in transit only to derive a country, then discarded.
• Precise location.
• The contents of text inputs / form fields your visitors type into.

If you choose to pass a user reference so you can correlate behavior on your own side, send only an opaque token (e.g. a hashed ID) — your users' real identity stays with you and never enters our database.

Our tracking script is consent-aware. You can configure it to hold all tracking until your visitor has consented — nothing fires (no pageview, click, or error) until you callgrantConsent(). This makes LyticData usable under GDPR-style consent requirements.

Raw, event-level data is kept for a limited retention window (90 days by default). After that it is rolled up into anonymous aggregate statistics and the raw rows are deleted. Aggregates (counts and trends) may be kept longer; raw per-session rows are not kept forever.

As the customer, you can at any time:

• Erase a single end-user's data on request (right to erasure).
• Export all of a project's data.
• Disconnect a project, which permanently deletes all of its stored data.

Data is logically isolated per project and encrypted in transit and at rest. Database access is locked down with least-privilege credentials and no public network exposure. We use a small set of sub-processors (hosting, database, and the AI provider that phrases insights) — listed in our Data Processing Agreement.

For your end-users' data, you are the data controller / fiduciary and LyticData is the processor — we process data only to operate the service you configured. A DPA is available.

In the unlikely event of a data breach affecting your data, we will notify you without undue delay and within 72 hours of becoming aware of it.

Questions about privacy? Email privacy@lyticdata.com.