Privacy policy

Draft of 3 October 2026.

This policy explains how [legal entity name] ("UsherStats", "we") handles personal data. There are two kinds, and our role differs for each.

• Visitor data: what UsherStats records about visits to our customers' websites. Our customers decide to collect it; we process it on their behalf, as their processor, under our data processing agreement.
• Account data: what we hold about our customers and their team members, and about visitors to usherstats.com and its documentation. For this we are the controller.

Visitor data (we are the processor)

What is recorded

For each page a browser loads on a customer's site, the snippet sends: the page's path; the campaign tags in its address (utm_source, utm_medium, utm_campaign) and no other part of the query string; the referring site's host name, not its full address; the window's width; the browser's language and time zone; how far the page was scrolled and how long it was open; whether the reader interacted; and a page counter for the browser tab. Customers may also record named events (for example, a signup or a download) and the paths readers take between pages.

When a customer uses the server SDK or proxy mode, each request their server receives is also recorded: path, status, the kind of client (a browser or a named crawler), and where the request came from.

From the request we derive the visitor's country, their network (the operator of the IP address range, such as an internet provider or a hosting company), a device class and a summary of the connection's encryption settings. We use the IP address and the full browser identification string while the request is handled, to classify it and to keep out abuse, and do not store either with the analytics.

What is not recorded

• No cookies are used for analytics on our customers' sites, and no identifier follows a visitor from one site to another or from one day to the next.
• The snippet keeps two small values in the browser's session storage, a page counter and the time the tab first reported, so pages in one tab can be counted as one visit. Session storage belongs to that tab and is cleared when it closes.
• Browsers that send Global Privacy Control are not recorded at all.
• No names, email addresses, account identifiers or form contents.

A customer's own team can mark their browsers so their visits are counted as internal rather than as readers. That uses a cookie on the customer's own domain, on those team members' browsers only, at their choice.

Bot protection

Where a customer turns on bot protection, we evaluate each request to decide whether to let it through, offer a challenge or refuse it. We may keep short-lived state about a visitor, keyed by a one-way hash, holding only the verdicts derived from it. A visitor who completes a challenge receives a first-party cookie, us_pass, on the customer's domain, so they are not asked again for a day; no other visitor receives a cookie from bot protection. The challenge page is served from challenge.usherstats.com and uses Cloudflare Turnstile.

Purpose and retention

Visitor data is processed only to give the customer their analytics and bot protection. It is kept indefinitely, for as long as the customer's account exists, unless the customer deletes it or sets a shorter retention for their site. When a customer closes their account, their sites' data is deleted [deletion period after account closure, e.g. within 30 days].

Visitors' rights

Because we store no identifier for a visitor, we generally cannot single out one visitor's records. Requests about a website's analytics are best sent to that website's owner, who controls the data; we help our customers answer them. You can also write to privacy@usherstats.com.

Account data (we are the controller)

What we collect

• Your email address, a hash of your password, your two-factor settings, and the workspaces and roles you belong to.
• Your sites, settings, API tokens (stored hashed) and an audit log of changes made in your account.
• Billing details, handled by Stripe: we store your plan, invoices and the last four digits of your card, never the full card number.
• Search Console and Bing credentials you choose to connect, stored encrypted and used only to fetch your data.
• Messages you send us.
• Visits to usherstats.com and docs.usherstats.com, measured with UsherStats itself, as described above.

Why, and on what basis

• To provide the service you signed up for (performance of a contract).
• To bill you and keep records the law requires (legal obligation).
• To keep the service secure and prevent abuse (legitimate interests).
• To send service emails: verification, password resets, invitations, usage notices and digests you can switch off.

We do not sell personal data, and we do not use it for advertising.

How long

For as long as your account exists; after you close it, we delete account data [deletion period, e.g. within 30 days], except billing records we must keep for [statutory period for tax records].

Export and deletion

Customers can export all of their sites' data at any time, from the dashboard or the API, and can delete a site's data or set a retention period for it. Account holders can delete their account from its settings, or by writing to privacy@usherstats.com.

Who else processes data

We use a small number of subprocessors, listed on our subprocessors page. Data is stored and processed on Cloudflare's network, which may include countries outside the European Economic Area; such transfers are covered by the Standard Contractual Clauses.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict its processing, and to complain to a data protection authority. Write to privacy@usherstats.com and we will answer within one month.

Contact

[legal entity name], [registered address]. Privacy questions: privacy@usherstats.com. [EU/UK representative, if required]

For customers: what to put in your own privacy policy

If you use UsherStats on your site, you can describe it in your own privacy policy along these lines: "We use UsherStats to measure how our site is used. It sets no cookies for analytics, stores no personal data and no IP addresses, and does not follow you across sites or days. It records the page you visited, the site that referred you, campaign tags, your browser's language, time zone and window size, your country and network, and how long you stayed. Browsers that send Global Privacy Control are not recorded. UsherStats processes this data on our behalf; see usherstats.com/privacy." If you use bot protection, add that requests are checked for automated traffic and some visitors may be asked to complete a challenge, which sets a cookie for a day. Whether you need consent for analytics depends on your jurisdiction and your use; this is not legal advice.