Privacy notice.

Who we are

The service is operated by FRIODA Tech. For traffic data collected on a customer's site, the customer is the controller and FRIODA Tech is the processor. The vendor's legal name, registration number and address, and the role wording for each install path including the server-side feed, are completed in the order. [TO BE COMPLETED BY COUNSEL]

What the tracker sends

A pageview or an event produces one request. It carries the path, the referrer, the event payload and the technical fields the server needs to classify the hit: browser and version, operating system, screen class, language, and country derived from the request.

The tracker writes no cookie and creates no IndexedDB database. It keeps the visitor id, the attribution cache and the pending event queue in the browser's local and session storage, so a reload does not split a visit. Those entries carry a random id and technical values; they hold no name, email or other contact detail. The full field list is published in the docs. The categories disclosed in this notice, and the labels attached to them, are confirmed by counsel. [TO BE COMPLETED BY COUNSEL]

What is stored server-side

The engine assigns a per-site visitor identifier and fingerprints the request so a session stays coherent across pages and reloads. That identifier is keyed on the request, not on a cookie file. It is scoped to one site and is not joined across projects.

Session replay stores a DOM stream of the visit, with pointer, scroll and input events. Input fields are masked by default, and masked values are excluded from the stored stream rather than hidden later in the player. The selector list for a given site, and the resulting categories of data, are set in the order. [TO BE COMPLETED BY COUNSEL]

What is not collected

We do not collect the customer's name, email address or billing identity. An account is a key, not a profile. Payment is in crypto: BTC, ETH, USDT or XMR.

This section is a statement about the product's configuration at the date of publication. The scope of the statement is checked against the final data map. [TO BE COMPLETED BY COUNSEL]

Retention

Traffic data is kept for the retention window of the plan named in the order and printed in the plan table. Replay streams follow a separate window. When a window ends, the rows leave the queryable store.

Deletion timelines, backup handling and the treatment of data restored from a backup are specified by counsel. [TO BE COMPLETED BY COUNSEL]

Sub-processors and hosting

Sub-processors: the hosting provider (to be named) and support tooling (to be named). Infrastructure is hosted outside the EU and the US. The service is not self-hosted, and there is no in-region deployment.

The sub-processor list, the notice period and the objection right are completed in the DPA. [TO BE COMPLETED BY COUNSEL]

The transfer mechanism, the required notices and the treatment of support access from other locations are completed by counsel. [TO BE COMPLETED BY COUNSEL]

Your rights

Requests arrive through the contact form with the project key. Where a request concerns traffic data on a customer's site, it is routed to that customer as controller and we assist as processor.

The applicable rights, the response windows and the verification applied to a requester are stated by counsel. [TO BE COMPLETED BY COUNSEL]

The split of duties between controller and processor, including assistance with impact assessments and prior consultation, is set in the DPA. [TO BE COMPLETED BY COUNSEL]

Changes and contact

Changes to this notice are posted on this page. Notice of a material change is given through the channel named in the order. The effective date, the notice period and the contact point for this notice are completed by counsel. [TO BE COMPLETED BY COUNSEL]