Privacy Policy

1. Who we are

nbsanalytics is run by [COMPANY LEGAL NAME], registered in England and Wales under number [COMPANY NUMBER], at [REGISTERED ADDRESS]. Contact us about privacy at [CONTACT EMAIL].

[If required: Our representative in the EU under Article 27 GDPR is [EU REPRESENTATIVE NAME AND ADDRESS].]

2. The two kinds of data we handle

Whose data	Our role	Covered by
Our customers and their team members (accounts, billing, support), and visitors to our own website	Controller	This policy
Visitors to our customers' websites and apps, measured with our script or API	Processor, acting for the customer	Our customer's own privacy notice, and our DPA with them. Section 9 explains what we process.

3. What we collect about customers

• Account details: your email address and a securely hashed password (or one-time login links), the teams you belong to and your role in them.
• Site settings: the domains you add and how you configure them. If you connect Stripe, the restricted read-only key you give us, stored encrypted.
• Billing: Paddle, our merchant of record, collects your payment details. We receive your name, email, country, VAT number if given, plan and subscription status. We never see your full card number.
• Support: what you send us when you email us.
• Service records: security and error logs needed to run the service. We don't put raw IP addresses in our logs.

4. Why we use it, and our lawful basis

Purpose	Lawful basis (UK GDPR / EU GDPR)
Providing your account and the service, and signing you in	Contract
Billing and keeping financial records	Contract; legal obligation
Service emails: login links, usage warnings, security and billing notices	Contract; legitimate interests
Keeping the service secure, preventing abuse, fixing problems	Legitimate interests
Product updates and occasional news (you can opt out any time)	Legitimate interests, or consent where the law requires it
Responding to legal requests and enforcing our terms	Legal obligation; legitimate interests

We don't use your data for advertising, and we don't make decisions about you by automated means that have legal or similarly significant effects.

5. Our own website

We measure our own marketing pages with nbsanalytics in cookieless mode: no cookies, nothing stored on your device, and no raw IP address kept. Signed-in pages use a session cookie to keep you logged in. See the cookies page.

6. Who we share it with

We never sell personal data. We share it only with the service providers listed on our subprocessors page (hosting, payments and email), who act on our instructions under written contracts, and where the law requires it. If our business is sold or merged, data would transfer to the new owner under this policy, and we'd tell you first.

7. Where it's stored

Service data is stored in the EU on Hetzner servers in Germany and Finland. We are a UK company; the UK and EU recognise each other's data protection as adequate. Where a provider processes data outside the UK or EU, we rely on adequacy decisions or on the UK International Data Transfer Agreement / Addendum and the EU Standard Contractual Clauses.

8. How long we keep it

• Account data: while your account is open, then deleted within 60 days of closure unless we need it for the reasons below.
• Billing records: six years after the end of the financial year they relate to, as UK tax law requires.
• Support emails: up to two years after the conversation ends.
• Security logs: up to 90 days.

9. If you visited a website that uses nbsanalytics

That website's owner decides what is collected and why; please contact them about your data. We process it for them as follows:

• Pages viewed (hostname, path and campaign tags), the referring site, browser, operating system, device type and screen width, and events the site chooses to send, such as a signup.
• Approximate location (country, region, city). We look this up from your IP address on our own servers using a downloaded database; the address isn't sent anywhere.
• We never store your raw IP address. It's used for the location lookup and, if the site uses cookieless mode, to create a visitor id by hashing it with the site, your browser's user agent and a random salt. The salt is replaced daily and the old one is deleted, so the id can't be traced back to you or linked across days.
• If the site uses cookie mode, our script sets two first-party cookies on that site's domain: nbs_vid (a random visitor id, 1 year) and nbs_sid (a random session id, 30 minutes from your last activity).
• If the site identifies signed-in users, it may link your visits to its own user id and name.

You can block our script with any content blocker. Data is kept for as long as the site's plan and settings allow, and deleted when the site owner deletes it. If you contact us directly, we'll pass your request to the site owner and help them answer it.

10. Your rights

You can ask us for a copy of your data, to correct or delete it, to restrict or object to how we use it, or to receive it in a portable format. Where we rely on consent, you can withdraw it at any time. Email [CONTACT EMAIL]; we'll reply within one month.

You can also complain to the UK Information Commissioner's Office (ico.org.uk) or, in the EU, to your local data protection authority. We'd appreciate the chance to help first.

11. Security

We encrypt data in transit, encrypt stored payment-provider keys, limit staff access to what's needed, keep backups and patch our systems promptly. The DPA lists our measures in more detail.

12. Children

The service is for businesses and isn't directed at children. We don't knowingly hold accounts for anyone under 18.

13. Changes

If we change this policy materially, we'll tell account holders by email before the change takes effect. The date at the top shows when it was last updated.