Privacy policy

1. Who we are

Highseat is a web analytics service at highseat.com, run by:

• Legal name: Piotr Kulpiński
• Address: Al. Pokoju 83A/12, 31-564 Kraków, Poland
• Tax number (NIP): 8661673036 (EU VAT number PL8661673036)
• Registry entry: Central Register and Information on Economic Activity (CEIDG), REGON 260591531
• Email, for privacy and anything else: support@highseat.com

This policy covers two groups of people. For the visitors of a customer's site, the customer is the controller and we process their data on the customer's behalf, under our data processing agreement. For the people who sign in to Highseat, and for the visitors of our own website and dashboard, we are the controller.

2. Data from visitors to our customers' sites

Each page view on a site with the Highseat tracker sends one event. Custom events, such as a signup or a purchase, send one more each. We keep these fields:

• The page: its host and path, its title, and only the query parameters the site owner chose to keep. Every other query parameter and the URL fragment are dropped.
• Where the visit came from: the referring page without its query string, UTM tags and ad click ids (such as gclid or fbclid).
• The device, read from the user agent on arrival: browser, operating system, device type, brand and model, with their versions. Also the screen and window size and the browser language.
• The location, looked up from the IP address on arrival in a database on our own server: country, region, city and that city's approximate coordinates.
• A visitor id: a SHA-256 hash of the site, the IP address, the user agent and a random salt that changes every day. A session id built from it.
• How long the page stayed in view and how far it was scrolled.
• Custom events and the properties the site sends with them, and revenue: an amount, a currency and a hashed checkout id.
• A user id, only when the site calls identify(). It is stored exactly as the site sends it.

What we never store

• The IP address. It is read once to look up the location and to build the visitor id, then dropped.
• The user agent. It is read once to work out the device and to build the visitor id, then dropped.
• Cookies. The tracker sets none, and the request to collect events carries none.

How the visitor id works

The salt behind each visitor id is 32 random bytes, made on the first event of each day and stored only in our Postgres database. The same visitor gets a new id every day, so ids cannot be linked across days.

Each salt is deleted about three and a half days after its day begins, once no late event can still need it. A job checks every hour. After that, nobody, Highseat included, can work out which IP address an id came from. The daily database backups keep a deleted salt for up to 14 more days.

What stays in the browser

• A random id for the browser tab, in session storage under highseat_aid. It lets a sale made in that tab be credited to the visit. The browser deletes it when the tab closes, and the server stores only its hash.
• The user id from identify(), in local storage under highseat_uid, only on sites that call it. It is removed when the site calls identify(null), and after 13 months.

Global Privacy Control

When a browser sends the Global Privacy Control signal, the tracker turns itself off before it sends anything. No event is recorded for that visitor.

Identified users

A customer can call identify() with an id for a signed-in user. That id is personal data. It links the user's visits across days, and our documentation asks for an opaque id, never an email address. A customer can erase everything recorded for one user id at any time.

Bots

Traffic we identify as a bot is not stored as an event. We keep only a count of it per site, with the reason and the host name, and no visitor data.

3. Cookies and consent

The Highseat tracker sets no cookies and sends nothing from a browser that has Global Privacy Control turned on. Highseat never stores a visitor's IP address or user agent. That supports your GDPR, CCPA and PECR obligations, and most sites that use it for anonymous traffic statistics can drop the cookie banner. Whether your site still needs consent depends on the rules of the countries you serve and on how you use it. The tracker keeps a random per-tab id in the browser's session storage, and identify() keeps the user id you send in local storage. Some regulators treat any data stored on a device as needing consent, so check with your own adviser before you remove a banner.

The dashboard itself sets cookies only to keep a person signed in. They are strictly necessary for the service.

4. Data from account holders

When you sign up and use the dashboard, we keep:

• Your name, email address and a hash of your password. If you sign in with Google or GitHub instead, we keep the account id, name, email address and photo that provider sends.
• A profile photo, if you upload one.
• Your workspaces, your role in each, and the invitations you send, with the invitee's email address.
• Your sign-in sessions, each with the IP address and user agent it started from, so you can see and end them. A session expires after a period without use and is then deleted.
• Billing details for a paid plan: name, billing address and VAT number. Stripe holds the card details. We never see them.
• A record of the emails we sent you and when a mail server accepted them, so a deletion date can be proven.
• Whether you have already had a free trial, so one person gets one trial.
• Emails you send to support.

Why, and on what legal basis

• To run the service you signed up for: your account, workspaces, sign-in and billing. Basis: the contract (GDPR Art. 6(1)(b)).
• To issue invoices, and to keep them and the billing records behind them for 5 years from the end of the calendar year in which the tax payment deadline passed, also after the account is deleted. Basis: a legal obligation (Art. 6(1)(c)) under Article 112 of the Polish VAT Act, read with Articles 70 § 1 and 86 § 1 of the Tax Ordinance (Ordynacja podatkowa).
• To keep the service secure, prevent abuse and understand how the dashboard is used. Basis: our legitimate interest (Art. 6(1)(f)).

We send account emails, such as sign-in links, trial reminders and deletion notices, because the service needs them. We send no marketing email without your consent.

5. How we track our own sites

This website and the Highseat dashboard are tracked with Highseat, in the same way as any customer's site. The events are stored as described above. In the dashboard, we call identify() with your account id once you sign in, so we can see how the product is used across days. We remove the id from your browser when you sign out.

We use no other analytics, advertising or tracking tools on this website or in the dashboard. Images in the dashboard, such as country flags and favicons, are served from our own servers.

6. How long we keep data

Events are kept while the workspace runs, until the customer deletes them, deletes the site or the workspace, or the workspace lapses and its sites are deleted on day 60. Highseat sets no shorter period of its own.

When a workspace's trial or plan ends unpaid, its data follows this clock:

A workspace lapses when its trial ends without a plan, when a renewal still fails after Stripe's retries, or when a cancelled plan reaches the end of its paid period. Every cause follows the same clock.

Deletion never happens sooner than 7 days after a mail server accepted the deletion notice, so a notice that bounced pushes the date back. Choosing a plan before deletion restores everything, including the events collected during the first 14 days.

Account data is kept for as long as the account exists. Invoices and the billing records behind them are kept for 5 years from the end of the calendar year in which the tax payment deadline passed, also after the account is deleted, because Article 112 of the Polish VAT Act, read with Articles 70 § 1 and 86 § 1 of the Tax Ordinance (Ordynacja podatkowa) requires it.

Deleted events disappear from every report at once. They leave the database disk within hours, through a job that runs every hour. Daily backups keep events for up to 60 days and account data for up to 14 days, so a deletion is complete everywhere within 60 days.

7. Deleting data

• One identified user: on a site's Data settings, an owner or admin can erase every event recorded for one user id, with the rest of each of that user's visits.
• Imported history: an import can be deleted on its own, and the site's sessions are rebuilt without it.
• A site: deleting a site deletes every event and session it recorded. The delete runs a second time once no late event can still arrive.
• A workspace: deleting a workspace deletes its sites, their events and its subscription.
• An account: deleting an account deletes the person's profile, sign-in methods, sessions and memberships, and every workspace nobody else belongs to. An account that is the only owner of a shared workspace must hand that workspace over first.

8. Recipients and transfers

We share data about account holders and readers of this website only with these categories of recipients, each for the purpose named:

• Hosting and network: Hetzner runs our server in Finland, where all account data is stored. Cloudflare carries every request to the app and this website, hosts this website, and stores backups and profile photos.
• Payments: Stripe handles subscriptions and card payments, and sends payment receipts and failed-payment emails.
• Email and support providers: Resend sends the app's emails. Other providers host our support mailbox.
• Accounting and invoicing providers: they issue our invoices and keep our billing records.
• Monitoring: Better Stack receives request traces and error reports, with workspace or site ids and no IP address or user agent.
• Documentation hosting: Mintlify serves the documentation to its readers.

For the data our customers' sites collect, the services that process it for them, what each receives and where it runs, are listed on the sub-processors page.

Every event and all account data are stored on our server in Finland, in the EU. Some of the services above are companies in the United States. Cloudflare, Stripe, Resend and Better Stack are certified under the EU-U.S. Data Privacy Framework, and their data processing agreements add the European Commission's Standard Contractual Clauses (Decision 2021/914) as a second safeguard. Mintlify relies on the Standard Contractual Clauses.

9. Your rights

Under the GDPR you can ask us to show you the data we hold about you, correct it, delete it, limit how we use it, or send it to you in a portable format. You can also object to processing based on our legitimate interest.

Write to support@highseat.com. We answer within one month. You can also change or delete most of your data yourself, in the dashboard's account settings.

If you visited a site that uses us, the site's owner controls that data. Ask the owner first. We help them answer you, and we forward a request we receive to them.

You can complain to a data protection authority: the one where you live or work, or ours, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO) in Warsaw, Poland.

10. Changes to this policy

We change this policy when the product or the law changes. The date at the top shows the last change. We email account holders at least 30 days before a change that affects them takes effect.

11. Contact

Write to support@highseat.com about privacy or anything else.