Who we are
PlainAnalytics (“PlainAnalytics”, “we”, “us”) provides a web analytics service at https://plainwebanalytics.com. We are based in the United Kingdom. For the personal data of our customers described in this policy we are the data controller. You can contact us about anything in this policy at hello@plainwebanalytics.com.
Two kinds of data
This policy covers two different situations:
- Visitors to websites that use PlainAnalytics. When you visit a website that uses PlainAnalytics, we collect anonymous, aggregated statistics on behalf of that website's owner. We don't use cookies and we don't store your IP address. Our data policy describes exactly what is collected and how the daily-rotating hash means you can't be identified or tracked over time.
- Our customers and visitors to this website. When you create an account, pay for a subscription or contact us, we process some personal data about you. The rest of this policy is about that.
What we collect about customers
- Account details: your name, email address and a securely hashed password. If you enable two-factor authentication, an encrypted authenticator secret and hashed recovery codes.
- Sign-in sessions: a session cookie that keeps you logged in, and for each session the device/browser description and when it was last used, so you can review and end sessions in your settings.
- Your sites and settings: domains, goals, team members you invite, email report recipients and similar configuration.
- Correspondence: emails you send us and our replies.
Cookies on this website
Our marketing pages set no cookies. When you log in we set a strictly necessary session cookie and a security (CSRF) cookie, plus small preference cookies such as which team you last viewed. We don't use advertising or third-party tracking cookies. We measure this website with PlainAnalytics itself, which uses no cookies.
Why we use it and our legal basis
- To provide the service you signed up for, including sending service emails such as sign-in codes, reports you've requested and billing notices — performance of a contract.
- To keep the service secure, prevent abuse and fix problems — legitimate interests.
- To meet tax and accounting obligations — legal obligation.
We do not send marketing emails unless you've asked to receive them, and we never sell your personal data.
Who we share it with
We use a small number of service providers (processors) who act on our instructions:
- our hosting provider, which runs our servers in the United Kingdom;
- our email delivery provider, to send account and report emails;
- DuckDuckGo's favicon service, which our servers query for the icons of referring websites (no visitor or customer data is sent).
Some providers may process data outside the UK; where they do, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or adequacy regulations. We may disclose data if required by law.
How long we keep it
We keep your account data for as long as your account is open. When you delete your account, we delete your personal data and your sites' analytics data, except records we must keep for tax purposes (normally six years). Server logs are kept for a short period for security and troubleshooting.
Your rights
Under UK data protection law you have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent where we rely on it. You can change most details yourself in your account settings; for anything else, email hello@plainwebanalytics.com. If you're unhappy with how we've handled your data you can complain to the Information Commissioner's Office (ico.org.uk), though we'd appreciate the chance to put things right first.
Changes to this policy
If we make significant changes we'll update the date at the top of this page and, where appropriate, tell customers by email.