Privacy policy

Who is responsible for your data

For our own website and customer accounts, the controller is the administrator of the visitordetector.com service. For visit data collected on customer websites, the customer who installed the snippet is the controller and we act as its processor or service provider.

You can reach us about any privacy question at [email protected].

Data we collect on our website and in accounts

When you visit visitordetector.com, try the demo or create an account, we collect the following data.

• Signup data: work email address and a password, which we store only as a password hash.
• The website you enter in the demo or in your account, and the plan you showed interest in.
• Campaign data such as UTM parameters and the referring page.
• Technical data: IP address, user agent, and the date and time of requests.
• Account and billing data: plan, subscription status, invoices and the billing details you provide at checkout. Card details are handled by the payment operator, not stored by us.
• Messages you send to [email protected].

Why we use this data and on what legal basis

• To create and run your account, deliver the service and send the signup code and service messages. Legal basis: performance of a contract.
• To bill your subscription and keep tax and accounting records. Legal basis: performance of a contract and legal obligation.
• To keep the service secure, prevent abuse and fix errors. Legal basis: legitimate interest.
• To understand which pages and campaigns bring signups, using cookieless measurement. Legal basis: legitimate interest.
• To answer your questions. Legal basis: legitimate interest or performance of a contract.

We do not sell your personal information and we do not use it for cross-context behavioral advertising.

How long we keep it

• Account data is kept while your account is active and deleted after the account is closed, except where we must keep records longer.
• Billing and invoice records are kept for the period required by tax and accounting law.
• Technical logs are kept for a short period needed for security, usually no longer than 90 days.
• Demo inputs without an account are kept no longer than 30 days.

Who receives the data

We share data only with service providers that help us run the service, described here by category.

• A hosting provider that stores and runs the service.
• A payment operator that processes subscription payments.
• An email delivery provider that sends signup codes and service emails.
• A B2B data provider used for company matching, which receives IP addresses for matching only.
• Authorities, when the law requires it.

Each provider may use the data only to provide its service to us.

International transfers

Some providers may process data outside your country, including in the United States. Where data from the EU or the UK is transferred, we rely on recognized safeguards such as standard contractual clauses or an adequacy decision.

Visit data we process for customers

Customers install the VisitorDetector snippet on their websites to see which companies visit them. For this data the customer decides the purpose and is the controller. We act as a processor under GDPR and as a service provider under CCPA and CPRA, and we process the data only to provide the service to that customer.

• What is processed: the IP address of the visit, page URL and title, time on page, referrer and UTM parameters, a first-party session identifier, and privacy signals such as Global Privacy Control.
• What we show: company-level data only, such as company name, website, industry, employee range and HQ country and region.
• What we never do: identify named people, collect visitor email addresses or build personal profiles. Residential, mobile carrier and known VPN traffic is not matched.
• IP addresses are used for matching and then truncated or kept according to the customer's setting.
• Visit data is kept according to the customer's retention setting, 13 months by default.
• Visitors can stop measurement on the opt out page. Customers can also respect Global Privacy Control and Do Not Track signals.

If you visited a customer's website and want to exercise your rights, you can contact that customer or write to us and we will help.

Your rights in the EU and the UK

If GDPR or UK GDPR applies, you have the right to access your data, correct it, delete it, restrict or object to processing, receive a copy in a portable format, and withdraw consent where processing is based on consent. You can also lodge a complaint with your local data protection authority.

Your rights in California and other US states

If you live in California, you have the right to know what personal information we collect, use and disclose, to request deletion and correction, to opt out of sale or sharing, and to not be discriminated against for using these rights. We do not sell or share personal information as those terms are defined in CCPA and CPRA. Residents of other US states with privacy laws have similar rights, and we honor them the same way. We treat a Global Privacy Control signal as an opt-out request.

How to use your rights

Email [email protected] with your request. We may ask you to confirm your identity before we act. We answer within the time the law requires, usually within 30 days for GDPR and 45 days for CCPA.

How we protect data

We use encryption in transit and at rest, role-based access and data minimization. Read more on security at VisitorDetector and in privacy-first visitor identification.

Cookies

Our own website uses only strictly necessary cookies. Details are in the cookie policy.

Changes to this policy

We may update this policy when the service or the law changes. The date at the top shows the latest version. For important changes we inform account holders by email.

Contact

Questions about this policy go to [email protected].