Privacy Policy

What this policy covers

Clickbase is an analytics service. Site owners install our script on websites they control, and we record the resulting activity so they can understand their traffic and connect it to revenue.

That means we handle two very different kinds of data, under two different roles, and this policy is split accordingly. Part one covers information about you as a Clickbase customer, where we decide what happens to it. Part two covers information about visitors to our customers websites, where the customer decides and we only act on their instructions.

This policy also covers this website itself.

Part one: information about you, our customer

When you create an account we store your name, email address, and a hashed password. If you sign in with Google or GitHub we store the provider account identifier instead of a password. We also store your workspace, the sites you add, your team memberships and invitations, and any API tokens you create.

If you arrived from a campaign, we store the marketing parameters that came with your signup link, such as the campaign source and the advertising click identifier. This tells us which channels bring customers.

We keep a record of your active sessions, which includes the IP address and browser user agent used to sign in. This is how you stay logged in and how we detect suspicious access.

Billing is handled by Stripe. We store your subscription state, plan and invoices. We never see or store your full card number.

We use this information to run your account, take payment, provide support, send service messages such as scheduled reports and invitations, and to understand which marketing works. We do not sell it.

Part two: information we process for our customers

When you visit a website that uses Clickbase, that site owner is the data controller. We are their processor and act on their instructions. If you want your data removed or want to know why it was collected, contact the site you visited. We will assist them, but we cannot act on their data without their instruction.

For each recorded event we store the page address, title and referrer, the marketing parameters on the link, the traffic source and channel we derive from them, the browser, operating system and device type, the screen width, the browser language, and an approximate location down to city level. We also store a pseudonymous visitor identifier and session identifier, and, depending on what the site owner has enabled, custom event names and properties, scroll depth, engagement time and page performance timings.

We do not store the visitor IP address. There is no IP column on any analytics table. The IP is used in the moment, to derive the approximate location and to compute the visitor identifier, and is then discarded. Location is resolved from a database held on our own servers, so the IP is never sent to a geolocation provider.

Two exceptions are worth stating plainly rather than burying. Our bot filtering stores a hashed fingerprint derived from the IP and user agent, so that repeat automated traffic can be recognised. And if a background job fails, the error record it leaves behind can contain the request data that caused it, including the IP, until that record is cleared.

How visitors are identified

Every site chooses one of two tracking modes. Sites are created in cookie mode.

In cookie mode we store an identifier in the visitor browser so the same person is recognised across visits over time. It is a first-party cookie and is not shared with anyone.

In cookieless mode we store nothing in the browser. The visitor identifier is a hash of the site key, the IP address and the user agent, combined with a secret that is regenerated every calendar day. Because that secret changes daily, the same person visiting on two different days produces two unrelated identifiers with no way to link them back together. It also means returning visitors are counted as new.

Neither identifier can recognise the same person across different customers websites. The site identity is part of the derivation, so identifiers are scoped to a single site.

Whether tracking on a given site requires your consent is a decision for that site owner, based on their tracking mode and their jurisdiction. It is not a decision we make on their behalf.

Session recording

Site owners can enable session recording, which captures a reconstruction of what happened on the page so they can watch it back.

We mask the values typed into form fields before anything is transmitted, and we scrub common sensitive patterns such as email addresses and long tokens from captured text. This is a best-effort filter, not a guarantee. Text that does not match those patterns, including names and addresses, and element attributes such as link targets and accessibility labels, are recorded as they appear.

Recordings are stored privately and are visible to members of the workspace that owns the site. If a site owner turns on public sharing for a site, its recordings become visible to anyone with the link.

If you do not want your session on a particular site recorded, that is a matter for the site owner, who controls whether the feature is on and which pages it covers.

Identified users and revenue data

Site owners can send us an identifier and descriptive traits for a logged-in user through our identify endpoint, so their analytics show a person rather than an anonymous visitor. We store whatever they send. What is sent, and whether it is appropriate to send it, is the site owner responsibility under their agreement with us.

Site owners can also connect their Stripe account. We then read their charges, subscriptions and invoices so revenue can be attributed to the traffic that produced it. This includes the buyer email address and name as recorded in Stripe, which is what allows a payment to be matched to a visitor. Card numbers are never transmitted to us.

The result is that our analytics store can contain identifying information where a customer has chosen to send it. We treat that as their data.

This website

We use Clickbase on this site. That means we are our own customer here, and everything described in part two applies to your visit: the pages you view, where you came from, your browser and device, and an approximate location down to city level. As set out there, we do not store your IP address.

Separately, when you land here with campaign parameters in the address, such as a source, a campaign name or an advertising click identifier, we store them in your browser local storage and add them to the sign-up link if you go on to create an account. That is how we know which campaign brought you.

You can clear both at any time by clearing site data for this domain in your browser.

Who we share data with

We do not sell personal data and we do not share it for advertising. We use a small number of providers to run the service, and each only receives what it needs.

• Amazon Web Services hosts our application and the analytics database that holds recorded events.
• Cloudflare sits in front of the service and processes every request in transit, and its object storage holds session recordings and uploaded files in a private bucket.
• Stripe processes payments and holds the billing records for your subscription.
• Sendkit delivers our transactional email, such as invitations, password resets and scheduled reports. It receives the recipient address and the message.
• Google receives nothing unless you connect Search Console or sign in with Google, in which case it receives only what that connection requires.
• If you connect an AI assistant through our MCP servers, that assistant reads the data you grant it access to, which can include session recordings and revenue records. That assistant is operated by its own provider under its own terms.

Where data is stored

Our application and analytics database run on Amazon Web Services infrastructure in Frankfurt, Germany, which we operate ourselves. The database is not exposed to the public internet. Session recordings and uploaded files are held in Cloudflare object storage, and billing data is held by Stripe.

We operate from Brazil, so we are subject to the Brazilian General Data Protection Law. Because the infrastructure is in Germany, personal data we hold is processed inside the European Union and the General Data Protection Regulation applies to it as well.

For visitors in the European Union and the United Kingdom this means their data does not leave the region for our own processing. For customers and visitors in Brazil it means the reverse: their data is transferred to the European Union, a jurisdiction the Brazilian authority and the European Commission both recognise as providing an adequate level of protection.

How long we keep data

While a customer subscription is active we retain their analytics events for the life of the account. We do not delete events by age and we do not sample.

When a customer closes their account we delete the analytics events for their sites. Some records outlive closure: billing and invoice records held by Stripe, which we are required to keep for tax and accounting purposes, and security records such as the hashed bot fingerprints described above.

Session recordings are subject to a per-plan storage allowance, and older recordings are removed as that allowance is reached.

Account session records, including the IP and user agent noted earlier, expire on their own as sessions age out.

Security

Data is encrypted in transit. Passwords are hashed and never stored in a readable form. The analytics database is not reachable from the public internet. Access to production systems is limited to those who need it.

When you set or change a password we check it against a public database of passwords known to have appeared in breaches, using a method that never sends us or them your actual password.

No service is immune to compromise. If a breach affects your personal data we will notify you and the relevant authority as the law requires.

Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, object to or restrict how we use it, and receive a copy in a portable form. You can also withdraw consent where we relied on it, and complain to your data protection authority. In Brazil that is the Autoridade Nacional de Proteção de Dados; in the European Union it is the supervisory authority for your country.

If you are a Clickbase customer, most of this is available directly in your account settings, and you can export everything through our API. Write to us for anything you cannot do yourself.

If you are a visitor to a website that uses Clickbase, the site owner holds your data and decides what happens to it, so contact them. If you contact us instead we will pass the request on where we can identify the site, but we cannot act on it ourselves.

Children

Clickbase is a business product and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will remove it.

Changes to this policy

We update this policy when the product or the law changes. When a change is material we will tell account holders before it takes effect. The date at the top shows when it was last revised.

Contact

For anything in this policy, including a request about your own data, write to [email protected].