Privacy Policy

• Sectira is website analytics. This policy covers two groups of people: our customers, who sign up and use Sectira, and visitors to our customers' websites, whose visits Sectira measures.
• For customers, we collect what we need to run your account: your email address, your name if you give it, your billing status, and the websites and settings you add.
• For visitors, Sectira sets no cookies by default, stores nothing in the browser, and never stores IP addresses. Visitors are counted anonymously, in a way that does not let them be followed from one day to the next or from one website to another.
• We do not sell personal data, and we do not use it for advertising.
• For data about visitors, the website owner (our customer) decides what is collected and why. Sectira processes it on their behalf.

Sectira (“Sectira”, “we”, “us”) provides the website analytics service at sectira.com and app.sectira.com. You can contact us about privacy at any time at support@sectira.com.

For data about our own customers (account and billing data), Sectira is the controller. For analytics data collected on a customer's website, the customer is the controller and Sectira is the processor. More on that in Data about visitors to our customers' websites.

What we collect

• Account details: your email address, and your name and workspace name if you add them. If you sign in with Google or Microsoft, we receive your email address, name and an account identifier from that provider. We never receive your Google or Microsoft password.
• Password: if you set one, we store it only in a protected form using industry-standard hashing, never the password itself.
• Sessions: when you sign in we create a session and record when it was created and when it expires. Session details are stored only in a protected form, so a copy of our database could not be used to sign in as you.
• Websites and settings: the domains you add, conversion goals, privacy settings, team invitations and roles, and white-label branding if you use it.
• Setup information: when you add a domain, we check publicly available information about it and its homepage to help set it up. This uses public information only.
• Billing: your plan, trial dates and subscription status. Payments are handled by Stripe. Your card number goes directly to Stripe and is never sent to or stored by Sectira. We keep the Stripe customer and subscription identifiers so we can link your payments to your account.
• Ask AI: the questions you ask and the answers given, so you can see your history.
• Emails we send you: a record of which account and billing emails were sent and when, so they aren't sent twice.
• Messages to us: anything you send to support@sectira.com.

Access you grant to other providers

To set things up for you, Sectira can use access you grant from another provider you use for your website. That access is used for the one request you ask for and is never saved. We make only the changes needed for Sectira and never overwrite settings that already exist.

Why we use it

• To provide the service: run your account, show your reports and keep your account secure. The legal basis is our contract with you.
• To bill you and keep financial records. The legal basis is our contract with you and our legal obligations.
• To send emails you need, such as team invitations and messages about your account, trial or billing. We send product news only if you have agreed to receive it, and you can opt out at any time.
• To prevent abuse, fix problems and improve Sectira, based on our legitimate interest in running a reliable and secure service.

Cookies on sectira.com and in the app

The marketing website at sectira.com sets no cookies. The app at app.sectira.com uses one essential cookie to keep you signed in, and short-lived cookies while you sign in with Google or Microsoft or connect another provider to set up your website. The app also keeps a few display preferences in your browser's storage, such as a notice you dismissed. These are required for the app to work, so we do not ask for consent to them. We do not use advertising or third-party tracking cookies.

Our customers add the Sectira tag to their websites. When you visit one of those websites, the tag measures your visit so the website owner can see how their pages perform. The website owner is responsible for that use and for telling you about it in their own privacy notice. If you have questions about a particular website, contact its owner. We will pass on any request we receive to the right customer.

What the tag collects

• Pages viewed: the page path and title, the page you came from on the same site, and the referring website. Query strings are not stored, except campaign tags such as utm_source and the fact that an ad click identifier was present.
• How you read: active time on the page (only while the tab is visible), how far you scrolled, which sections of the page were on screen and for how long.
• Clicks: which links and buttons were clicked, their text and where they lead, and the section they were in. Form submissions are recorded as an event, but nothing you type into a form is ever collected.
• Device and location: device type, browser and operating system, worked out from your browser's user agent (the user agent itself is not stored); screen and window width; language and time zone; and country, region and city as provided by our hosting provider from your connection. Your IP address is not stored.
• Purchases and events: if the website sends them, the amount, currency, order number and product name of a purchase, and custom events the website chooses to record.

How visitors are counted without cookies

By default, Sectira sets no cookies and stores nothing in your browser. To tell visits apart, our server uses details of your connection and browser to create an anonymous identifier that cannot be turned back into those details. Your IP address is used only at that moment and is then discarded; it is never stored. The identifier does not let you be followed from one day to the next, or from one website to another.

Consent mode and persistent IDs

A website owner who collects consent can turn on persistent visitor IDs. Only then does the tag store a random identifier in your browser's local storage, so return visits can be recognised. If you withdraw consent on that website, the identifier is removed. If your browser sends a Global Privacy Control signal, the tag never stores a persistent identifier, whatever the website's setting.

What we do not do

• We do not record your screen or keystrokes. Visit replay rebuilds a visit from the page views, sections and clicks above.
• We do not build profiles of people across websites, and we do not sell or share visitor data for advertising.
• Automated browsers and known bots are not counted.

Sectira as a processor

For visitor data, Sectira acts only on our customers' instructions, which are set by the Sectira features and settings they use. We use the data only to provide the service to that customer, keep it separate from other customers' data, and delete it when the customer deletes the website or their account. Customers are responsible for having a lawful basis for their analytics and for any notices or consent their local law requires. If you are a customer and need a data processing agreement, email support@sectira.com.

Ask AI answers questions about one of your websites. When you ask a question, Sectira sends the question and a summary of that website's reports for the period you chose to Google's Gemini API, and returns the answer. The summary contains aggregated figures and page, section and source names, not individual visits or visitor identifiers. Questions outside your website's analytics are declined.

Google processes this content to produce the answer, under its terms for the Gemini API. Ask AI only runs when you or a teammate asks a question.

We use a small number of providers to run Sectira. Each one gets only the data it needs for its job and is bound by its own data protection terms.

• Vercel: hosts sectira.com and the Sectira app, receives the requests the tag sends, and provides approximate location from the connection.
• Database host: stores account data and analytics data.
• Stripe: processes payments and stores card details.
• Resend: delivers the emails Sectira sends, such as sign-up confirmations, password resets, team invitations, trial reminders, receipts and other billing notices.
• Google (Gemini API): answers Ask AI questions, as described above.
• Google and Microsoft: only if you choose to sign in with them.

If you let Sectira set things up in an account you hold with another provider, Sectira acts in that account under your agreement with them.

• Account data is kept while your account is open. When you delete your account, your account, websites, team and all of their analytics are deleted from our database.
• Analytics data is kept while the website is in your account, and your plan sets how much history your reports show. Deleting a website deletes its analytics.
• When a trial or subscription ends, reports pause but data is kept, so you can pick up where you left off if you choose a plan. You can delete your account at any time instead.
• Billing records may be kept for longer where tax or accounting law requires it.
• Sessions expire after 30 days, or straight away when you sign out.

Our providers may process data in the United States and other countries. Where data about people in the European Economic Area, the United Kingdom or Switzerland is transferred to countries without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

All traffic to Sectira is encrypted with HTTPS. Passwords are protected with industry-standard hashing, sign-in sessions are stored only in a protected form, and team access is controlled by roles. Read more on our security page.

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict how it is used, and to withdraw consent. Customers can update their details and delete their account at any time in the app's account settings. For anything else, email support@sectira.com and we will reply within 30 days.

If you are a visitor to a customer's website, please contact that website's owner first, since they control that data. Because Sectira does not store IP addresses or cookies by default, we usually cannot link analytics data to you.

If you are in the European Economic Area or the United Kingdom, the legal bases for each use are listed above, and you have the right to complain to your local data protection authority.

If you live in a US state with a consumer privacy law, such as California, you can use the rights above by emailing support@sectira.com, and we will not treat you differently for doing so. Sectira does not sell or share personal information as those terms are defined in those laws, and does not use it for targeted advertising.

Sectira is a business tool and is not meant for anyone under 16. We do not knowingly collect data from children through our own website or app.

If we make material changes, we will update the date at the top of this page and tell customers by email or in the app before the changes take effect.

Questions about privacy or this policy: support@sectira.com.