GDPR: roles, tiers and safeguards

Who is responsible

When you use Pipetrace on your website, you are normally the controller of your visitors' data: you decide whether visits are measured, which privacy settings apply and what your privacy notice says. (If you run the site for a client, your client may be the controller and you its processor.) Pipetrace processes the data on your behalf and on your instructions, as your processor. GDPR Art. 28 requires a data processing agreement between you and Pipetrace; Pipetrace's agreement is not yet published.

Legal basis by tier

You choose the legal basis and document it. Pipetrace's settings let you apply it:

Consented analytics (tier 3) uses cookies and identifiers. With consent required everywhere, and for visitors in the consent regions, it starts only after the visitor accepts: consent under Art. 6(1)(a) where the GDPR applies.
With consent required in consent regions, visitors outside those regions get tier 3 without being asked. You are responsible for the legal basis for them, and for any consent your country's cookie law requires before information is stored in or read from their browser, or their browser is made to send it; the legitimate-interest template has a part for this case. Sites that have never saved privacy settings (legacy) do not ask either: Pipetrace does not enforce consent there.
Anonymous counts (tier 1) and Anonymous sessions (tier 2) are what the pre-consent setting records before the visitor chooses and after a refusal. If you rely on legitimate interest (Art. 6(1)(f)) for them, record your assessment, and check the jurisdiction guidance for your country's rules on measurement before consent.
Tier 2 is pseudonymous within a UTC day. Pseudonymous data is personal data under the GDPR (Recital 26).

See the legitimate-interest assessment template, the jurisdiction guidance and privacy tiers.

Safeguards in the software

At tiers 1 and 2, the tracker stores nothing in the visitor's browser. It reads one thing, and only before switching to tier 3: an opt-out saved in localStorage (_pt_consent) by the older optOut() call. If it finds one and the visitor has not accepted, it stays at tier 1.
Tier 1 has no visitor or session ID and keeps the time to the minute.
Tier 2 codes and the same-day recovery hash of tier 3 are keyed with a random secret per site and UTC day, kept until 01:00 UTC the next day and then deleted by a cleanup every 15 minutes.
Nothing recorded at tier 1 or tier 2 is linked to a tier 3 visitor. When a visitor accepts on the same page, that page's tier 1 or tier 2 page view is deleted and replaced by its tier 3 page view. Nothing is copied from it; for a tier 2 page view, the server only checks whether its session has other page views, to decide whether the tier 3 page view continues a visit.
The visitor's IP address:
- Anonymous counts: The IP address is used to look up the country and, briefly, to protect the service from abuse. Pipetrace does not store it: no event or other database record contains it, and the Pipetrace API leaves it out of its request logs for the tracking endpoints, the policy lookup and the tracker script.
- Anonymous sessions: The IP address is used to look up the country, to compute the daily visitor code and, briefly, to protect the service from abuse. Pipetrace does not store it (the visitor code is a keyed hash of it): no event or other database record contains it, and the Pipetrace API leaves it out of its request logs for the tracking endpoints, the policy lookup and the tracker script.
- Consented analytics: The IP address is used to look up the country, to compute the same-day recovery hash with that day's secret key and, briefly, to protect the service from abuse. Pipetrace does not store it (the recovery hash is a keyed hash of it): no event or other database record contains it, and the Pipetrace API leaves it out of its request logs for the tracking endpoints, the policy lookup and the tracker script.
Each site keeps its browser analytics for 1 to 25 months, as its owner sets; a job that runs every 6 hours deletes older events and hourly statistics.
Global Privacy Control stops all collection: nothing is stored from a request that carries it.
Do Not Track keeps the visitor at tier 1 at most, even after the visitor accepts. With Do Not Track and the pre-consent setting Off, nothing is stored before the visitor accepts if the visitor must be asked first (consent required everywhere, or a visitor in a consent region). A Do Not Track visitor who is not asked first (outside the consent regions in regional mode, or on a legacy site) is stored as Anonymous counts.
A refusal is honoured on the page where it is made: after pipetrace.consent("denied") the tracker deletes the identifiers it stored in the browser and records only what the pre-consent setting allows. Outside the consent regions, in regional mode, that is tier 1 whatever the setting. Legacy sites also record a refusal at tier 1. Pipetrace does not remember the visitor's choice. Your consent tool must store it and load the script with data-consent="denied" on every later page; otherwise, in regional mode, a visitor outside the consent regions who refused gets tier 3 again on the next page, and so does a visitor on a legacy site.

Visitors' rights

To object, visitors can turn on Global Privacy Control, refuse in your consent banner (which calls pipetrace.consent("denied")), or contact you.
A refusal or opt-out stops further collection above what the site's settings allow for refusals; it does not erase records already stored. Deleting a site deletes its analytics records from the live database.
Tier 1 records carry no identifier, so they cannot be looked up for one visitor. Tier 2 codes cannot be recomputed from the live database once their day's key is deleted.
Access and deletion requests for tier 3 data come to you. The authenticated API can show one visitor's profile and sessions by visitor ID (the visitor's browser holds it in the _pt_vid cookie). Pipetrace does not yet offer a way to delete one visitor's records: deleting the site deletes all of its analytics records, and otherwise records are deleted when the site's retention period ends.

What this page is not

This page describes what the software does. It does not decide whether your site needs consent, which legal basis applies to you, or whether your installation meets the law. See the data collection reference and privacy information.