Privacy Policy

Trakily is a revenue-first web analytics service. Website owners add a small script to their site and connect their payment provider, and Trakily shows which channels, campaigns and pages bring paying customers.

The service is operated by Trakily, based at A-266, Triveni Nagar, Jaipur, Rajasthan 302018, India. You can reach us about anything in this policy at [email protected], and our Grievance Officer handles complaints.

Trakily is an Indian business, so this policy is written first of all under Indian law: the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules made under it, and the Information Technology Act, 2000 with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”).

We also serve customers in the European Union, the United Kingdom and Switzerland. When the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection apply to you, you have the additional rights described in If you are in the EU, UK or Switzerland. If you live elsewhere, your local law may give you further rights, and we will honour them.

Trakily handles two very different kinds of personal data, and our responsibilities differ for each.

If you visited a website that uses Trakily and have a question about your data, the owner of that website is the right first contact: they decide whether Trakily runs on their site, how it is configured and how long data is kept. We will help them answer you, and we will forward any request we receive directly.

Information you give us

• Account details. Your name, email address and password. We store only a salted hash of your password, never the password itself.
• Profile picture. If you upload an avatar, we store the image in our database. If you sign in with Google, we may show your Google profile photo instead.
• Website settings. Domains, site names, time zones, currencies, goals, alerts, exclusion rules (which can include IP addresses you choose to exclude, such as your office), widget and sharing settings.
• Team members. When you invite someone, we store their email address and the role you give them, and send them an invitation email.
• Integration credentials. API keys for your payment provider and access tokens for services you connect. These are encrypted before they are stored (see Security).
• Imports. Files you upload to import history from another analytics tool, and the aggregated statistics we extract from them.
• Messages. What you write to us by email or through support, and our replies.

Information created when you use Trakily

• Sign-in sessions. When you sign in we create a session that records the IP address and browser user agent it was created from. Sessions last up to 30 days and end when you sign out or reset your password.
• Billing state. Your plan, billing interval, trial dates, subscription status and monthly event usage, and a billing record of what you were charged or refunded (amounts, currency, dates and Dodo Payments' payment, refund, invoice, subscription and customer ids). We receive this from our payment partner; we never see your full card number.
• Email delivery records. A log of the emails we send you (recipient, subject, content and delivery status), so we can troubleshoot delivery.
• Technical logs. Our servers record standard request logs (such as IP address, time, requested URL and user agent) for security and debugging.

Information from third parties

• Google sign-in. If you choose “Sign up with Google”, Google shares your name, email address and profile photo with us.
• Our payment partner. Dodo Payments, our Merchant of Record, tells us when a subscription starts, renews, fails, is refunded or ends, along with the customer and subscription identifiers we need to match it to your account.
• Services you connect. When you connect Google Search Console, Google Analytics 4, Meta Ads or a payment provider, we receive the data described in Integrations you connect, plus the email address or account name of the connected account so you can see which one is linked.

When a website runs the Trakily script, the visitor's browser sends us a small event for each page view and for certain interactions. We process this data on behalf of the website owner. Here is exactly what the script and our servers record.

What happens to the IP address

Every web request carries an IP address. Our servers use it only for the moment the event is processed: to look up the approximate location, to apply exclusion rules the site owner has set, to rate-limit traffic when flood protection is on, and, in cookieless mode, as one input to the daily visitor hash. It is then discarded and never written to the analytics database.

Cookieless mode

Site owners can use a cookieless version of the script. It sets no cookies. Instead, our server combines the IP address and user agent with a random salt that changes every day and turns them into a one-way hash. Each day's salt is deleted two days after that day ends, so the hash cannot be recomputed or linked across days. Details are in our Cookie Policy.

Revenue data

When a website owner connects their payment provider, we import payments, refunds and subscriptions from it: amounts, currencies, dates, plan names, status, and the customer's email address or customer id where the provider supplies one. We use this to attribute revenue to the visit that led to it. The website owner is responsible for having a lawful basis to share this with us.

Crawlers and AI bots

Site owners can install a server-side snippet that reports visits from known crawlers and AI bots. For these we store the bot's name and category, the path it requested, its user agent and country. These are automated agents, not people, and no IP address is stored.

To show website owners where their traffic comes from, Trakily can find public posts that link to their site on Reddit, Hacker News, Bluesky and X, and website owners can paste links to posts themselves. For each post we store its URL, text, publication date, engagement counts and the author's public handle, display name and profile picture link.

We only collect posts that their authors have made public, only for the website they link to, and only so the owner can understand that traffic. If you wrote a post and want it removed from Trakily, contact us at [email protected] with the link and we will remove it.

We use the personal data we hold as Data Fiduciary only for these purposes:

We do not use personal data for automated decisions that have legal or similarly significant effects on you, and we do not use your analytics data or your visitors' data to train models, target ads or build profiles for third parties. The legal bases we rely on under the GDPR are listed in If you are in the EU, UK or Switzerland.

For visitor data on customers' websites, the website owner chooses the purpose and the legal basis; we process it only to provide the analytics service to them.

Where we rely on your consent, we ask for it clearly and for a specific purpose: when you create an account and agree to this policy and our Terms, when you connect an integration, when you subscribe to a newsletter, and when you choose “Accept analytics” in our cookie banner.

You can withdraw consent as easily as you gave it: turn off an email report or alert in settings, disconnect an integration, unsubscribe from a newsletter with the link in every issue, change your choice with Cookie settings in the footer of trakily.com, or delete your account. Withdrawing consent does not affect processing that already took place. If you withdraw consent to the processing the service needs to work, we will stop providing the service to you, and will delete your data as described in How long we keep data.

You may also give, manage or withdraw consent through a consent manager registered with the Data Protection Board of India, once such consent managers are available.

We send email only when it relates to your account, a website you have access to, or something you signed up for:

• Account emails: welcome and email verification, password resets and password change confirmations, email change confirmations, team invitations, security notices (such as two-factor or passkey changes), and, if you delete your account, the deletion date with a restore link and a reminder 3 days before it is final.
• Billing emails: trial reminders, usage warnings when you approach or pass your monthly limit, and payment problems. Receipts and invoices come from Dodo Payments.
• Reports and alerts you control: weekly summaries, traffic spike notices, goal and payment alerts, Search Console health alerts, and download links for exports you request. Weekly summaries and traffic spike notices are on by default for everyone with access to a website; each report and alert can be turned off in your settings.
• Affiliate emails: only if you apply to the Trakily affiliate program.
• Newsletter: only if you subscribe. Every issue has an unsubscribe link.

Goal alerts can include details of the visit that triggered them, such as the visitor's country, city, device, browser, referrer, the goal's properties and any name or user id passed through identify(). Alerts can also be delivered to a Slack or Discord channel if you add a webhook; that content then becomes subject to Slack's or Discord's own terms.

Integrations are off until you connect them, and you can disconnect any of them at any time. When connected, we access only what each feature needs.

Google user data

Trakily's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, data from Google Analytics 4 and Google Search Console:

• is used only to provide the reports you see in Trakily for the property you picked, and for nothing else;
• is never sold, and never transferred to others except as needed to run Trakily, to comply with the law, or as part of a merger or acquisition with your notice;
• is never used for advertising, including retargeting or personalised ads;
• is never read by people, unless you ask us to (for example in a support request), it is needed for security or abuse investigations, or the law requires it;
• is never used to develop, improve or train artificial intelligence or machine learning models.

You can remove Trakily's access at any time: disconnect Search Console or the Google Analytics import in your website's settings, or remove Trakily at myaccount.google.com/permissions. Disconnecting inside Trakily also revokes our access token and deletes the data that connection brought in. See Data deletion.

Meta Ads data

When you connect Meta Ads we ask only for the read-only ads_read permission, and we read spend and performance only for the ad accounts you pick. We use it only to show ad spend and return on ad spend for your own websites inside Trakily. We never sell or share it, never use it for advertising or to build profiles, and never combine it with data from other customers. Disconnecting Meta Ads revokes our access and deletes the data it brought in; removing Trakily in your Facebook settings under Apps and Websites and asking for your data to be deleted does the same. See Data deletion.

We do not sell or rent personal data, and we do not share it for cross-context behavioural advertising. We share it only with:

• Data Processors (subprocessors) that host and run the service: DigitalOcean, which hosts our servers and database, and our email provider. They may use the data only to provide their service to us. The current list is on our Subprocessors page.
• Dodo Payments, our Merchant of Record, which sells Trakily subscriptions to you and handles payment, invoicing, tax and refunds. Dodo Payments processes your payment details as an independent fiduciary (controller) under its own privacy policy.
• Services you connect and destinations you configure, such as Slack or Discord webhooks.
• People you choose: team members you invite, and anyone who sees a public dashboard link or embedded widget you publish. Public links and widgets show aggregated statistics only.
• Authorities and advisers, when the law requires it (for example a lawful order under the IT Act or the DPDP Act), to protect rights and safety, or to our professional advisers under confidentiality.
• A buyer or successor, if Trakily is involved in a merger, acquisition or sale of assets. We will tell you before your data becomes subject to a different privacy policy.

The dashboard shows small website icons (favicons) for referrers, which your browser loads from DuckDuckGo's icon service. Those requests contain the referring domain and, like any web request, your IP address and browser details, but not your analytics data.

Trakily is operated from India, but our servers and database are hosted with DigitalOcean in the United States, close to most of our customers. This means personal data of users in India, including account data and the visitor data our customers collect, is transferred to and stored in the United States. Our team in India accesses it remotely to run and support the service.

The DPDP Act allows personal data to be transferred outside India, except to countries the Government of India restricts by notification. The United States is not restricted. We hold our hosting provider to written terms that protect the data, and we stay responsible for it as the Data Fiduciary.

Some other subprocessors are in other countries: our email provider is in the European Union, and Dodo Payments processes payments globally. Each is listed with its location on the Subprocessors page. For data protected by European, UK or Swiss law, see International transfers from the EU, UK and Switzerland.

We keep personal data only as long as it is needed for the purpose it was collected for, or as the law requires, and then delete it.

The full deletion process, including what we keep and why, is described on our Data deletion page.

We protect personal data with reasonable security practices and procedures, as the IT Act, the SPDI Rules and the DPDP Act require, including:

• Encryption in transit (HTTPS) for the dashboard, the tracking endpoint and our API.
• Payment provider keys, OAuth tokens and other integration secrets encrypted at the application level with AES-256-GCM before they reach the database.
• Passwords stored only as salted scrypt hashes; single-use, short-lived password reset links; all sessions ended when a password is reset; optional two-factor authentication and passkeys.
• Role-based access to each website (owner, member, viewer), so team members see only the sites they were invited to.
• Verification of signed webhooks from payment providers, and tamper-proof, expiring state for OAuth sign-ins.
• No IP addresses in the analytics database; bot filtering, hostname checks and, in flood protection mode, per-IP rate limits on the tracking endpoint.

A fuller description is on our Security page and in the DPA security annex.

No system is perfectly secure. If a personal data breach affects data we hold as Data Fiduciary, we will inform the Data Protection Board of India and each affected person without delay, as the DPDP Act requires, telling you what happened, the likely consequences, what we are doing about it and what you can do to protect yourself. Where they apply, we will also notify CERT-In and, for people in the EU, UK or Switzerland, the relevant supervisory authority. If the breach affects visitor data we process for a website owner, we will tell the website owner so they can meet their own duties.

Under the DPDP Act, as a Data Principal you have the right to:

• access information about your personal data: a summary of the data we hold and the processing we do, and who we have shared it with;
• correction and erasure: have inaccurate or misleading data corrected, incomplete data completed, outdated data updated, and data we no longer need erased;
• withdraw consent at any time, as described in Consent and withdrawing it;
• grievance redressal: complain to our Grievance Officer, and, if you are not satisfied, to the Data Protection Board of India;
• nominate another person to exercise these rights on your behalf if you die or become unable to do so. Email us with the nominee's name and contact details.

Most of this you can do yourself: edit your profile in account settings, download your data, and delete your account from the same page. An account deletion can be undone for 30 days, then it is final (see Data deletion). For anything else, email [email protected]. We will respond within 30 days, and may need to confirm your identity first.

The DPDP Act also asks Data Principals not to file false or frivolous complaints and not to impersonate others when making a request.

If you are a visitor to a website that uses Trakily, please contact that website's owner first, since they control that data. You can also block or clear cookies in your browser at any time.

Other countries

People in the EU, UK and Switzerland have the rights listed in the next section. Residents of California and other US states with privacy laws may also ask what categories of personal data we collect and share, and will not be treated differently for exercising their rights. We do not sell or share personal data for cross-context behavioural advertising.

Trakily is a business tool and is not meant for children. Under the DPDP Act a child is anyone under 18, and processing a child's personal data needs verifiable consent from a parent or lawful guardian. We do not offer accounts to anyone under 18, we do not knowingly collect personal data from children, and we do not track or behaviourally monitor children or target advertising at them. If you believe a child has given us personal data, contact us and we will delete it.

This section applies when the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, or the Swiss Federal Act on Data Protection (FADP) apply to our processing of your personal data. It adds to the rest of this policy. You can contact us directly about it at [email protected].

Controller and processor

Trakily, A-266, Triveni Nagar, Jaipur, Rajasthan 302018, India, is the controller for account data and for trakily.com. For visitor data on our customers' websites we are a processor for the website owner, under our Data Processing Agreement.

Legal bases

Your rights

You have the right to:

• access the personal data we hold about you and get a copy;
• have inaccurate data rectified and incomplete data completed;
• have your data erased;
• restrict processing;
• object to processing based on legitimate interests, and to direct marketing at any time;
• receive the data you gave us in a structured, machine-readable format and have it transmitted to another controller (portability);
• withdraw consent at any time, without affecting processing that took place before;
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects (we make no such decisions).

Email [email protected] to exercise them. We will respond within one month, which the law lets us extend by two further months for complex requests; we will tell you if we need to.

International transfers from the EU, UK and Switzerland

We are based in India and our servers are hosted with DigitalOcean in the United States. Neither country has a general adequacy decision from the European Commission or the UK. When we receive personal data protected by European, UK or Swiss law, we protect it with the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), with the UK International Data Transfer Addendum and the Swiss adjustments where relevant, as set out in our DPA. Our hosting provider is also certified under the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework. You can ask us for a copy of these safeguards at [email protected].

Complaints to a supervisory authority

You have the right to complain to a data protection supervisory authority, in particular in the EU country where you live, work or where the issue arose; in the UK, the Information Commissioner's Office (ICO); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC). We would appreciate the chance to sort things out with you first.

trakily.com uses cookies that are needed to sign you in, keep the service secure and remember your cookie choice, plus browser storage for preferences such as your theme. Our own analytics cookies are set only if you choose “Accept analytics” in the cookie banner, and you can change your choice at any time with Cookie settings in the footer. The Trakily script sets its own first-party cookies on our customers' websites unless they use cookieless mode. Everything is listed, with lifetimes, in our Cookie Policy.

We will update this policy when our practices or the law change. The date at the top always shows the latest version. If a change is significant, we will tell account holders by email or in the dashboard before it takes effect, and ask for fresh consent where the law requires it.

In accordance with the Information Technology Act, 2000 and its rules, and the Digital Personal Data Protection Act, 2023, our Grievance Officer is:

We acknowledge complaints within 24 hours and aim to resolve them within 15 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

Questions, requests or complaints about privacy: [email protected].

Post: Trakily, A-266, Triveni Nagar, Jaipur, Rajasthan 302018, India.

Related: Cookie Policy, Data Processing Agreement, Subprocessors. Script cookie names such as _trakily_vid are explained in the Cookie Policy.