Privacy Policy

GDPRmetrics ("we", "us", "our") is a privacy-focused web analytics platform. We respect your privacy and are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

This Privacy Policy explains what personal data we collect, how we process it, the legal basis for processing, how long we retain it, and your rights as a data subject. It applies to all users of our website at gdprmetrics.com and our analytics services.

The data controller responsible for the processing of your personal data is:

We process your personal data under the following legal bases as defined in Article 6 of the GDPR:

• •Contract performance (Art. 6(1)(b)) — Processing your account and subscription data is necessary to provide the analytics service you have signed up for.
• •Legitimate interest (Art. 6(1)(f)) — We process technical data for service security, fraud prevention, and service improvement. Our analytics tracker operates under our customers' legitimate interest in understanding their website traffic without identifying individuals.
• •Legal obligation (Art. 6(1)(c)) — We retain certain billing and transaction records as required by applicable tax and accounting laws.
• •Consent (Art. 6(1)(a)) — Where applicable, such as for optional marketing communications. You may withdraw consent at any time.

We use the following third-party services to operate GDPRmetrics:

Analytics tracker: Our analytics tracking script does not use cookies, local storage, or any persistent identifiers. It collects only anonymous pageview data and does not track individual users across sessions or websites.

Dashboard authentication: When you log into the GDPRmetrics dashboard, we use a single essential cookie to maintain your authenticated session. This cookie is strictly necessary for the service to function and does not require consent under GDPR.

We do not use any third-party tracking cookies, advertising pixels, or behavioral profiling technologies.

• •Account data: Retained for the duration of your active account. Upon account deletion, your data is removed within 30 days.
• •Analytics data: Raw analytics data is retained for 90 days in Cloudflare Analytics Engine, after which it is automatically deleted. Aggregated daily summaries may be retained longer for billing purposes.
• •Billing records: Transaction and subscription records are retained as required by applicable tax and accounting laws (typically 5–7 years).
• •Authentication session: Session tokens expire and are invalidated upon logout.

Your data may be processed outside the European Economic Area (EEA) by our third-party service providers:

• •Cloudflare operates a global network with data centers worldwide, including within the EEA. Cloudflare participates in the EU-U.S. Data Privacy Framework.
• •Polar Software Inc. is incorporated in the United States (Delaware). Payment data transfers are protected by Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.
• •Google participates in the EU-U.S. Data Privacy Framework for authentication data transfers.

All transfers are conducted with appropriate safeguards to ensure your data receives a level of protection consistent with the GDPR.

Under the GDPR, you have the following rights regarding your personal data:

• •Right of access — obtain a copy of the personal data we hold about you.
• •Right to rectification — request correction of inaccurate or incomplete data.
• •Right to erasure — request deletion of your personal data ("right to be forgotten").
• •Right to restriction — request that we limit the processing of your data.
• •Right to data portability — receive your data in a structured, machine-readable format.
• •Right to object — object to processing based on legitimate interests.
• •Right to withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at contact@gdprmetrics.com. We will respond to your request within 30 days.

You also have the right to lodge a complaint with your local data protection supervisory authority. In Poland, this is the President of the Personal Data Protection Office (UODO).

We implement appropriate technical and organizational measures to protect your personal data, including:

• •All data transmitted between your browser and our servers is encrypted using TLS/HTTPS.
• •Authentication is handled via OAuth 2.0 with JWT tokens — we never store passwords.
• •Data is stored on Cloudflare's secure, ISO 27001 certified infrastructure.
• •Access to personal data is restricted to authorized personnel only.

For any questions or concerns about this Privacy Policy or the processing of your personal data, contact us at: