Privacy Policy

Visitorly (“we”, “us”) provides multi-site website analytics software. This policy covers visitors to our marketing pages, customers who create accounts, invited teammates, and end-users of sites that install the Visitorly tracker.

1. Who is responsible

The Visitorly platform operator who hosts this deployment is the controller for account and platform data. When you install our tracker on your website, you are typically the controller of your visitors’ analytics events; Visitorly processes that data on your behalf as a processor for the purpose of providing the product.

2. Data we collect

• Account data: name, email, phone (on plan or contact requests), company, password hash (if you set a password), Google/GitHub sign-in identifiers, optional authenticator secret (encrypted), optional WhatsApp number, agency brand fields, notification preferences, plan/subscription status, paid-through and grace dates.
• Team and access: site memberships, invite emails and roles, passworded share-link metadata (not the plaintext password).
• Site configuration: domains, site names, public tracker keys, optional first-party collect hostname, integration settings (Clarity project ID; Google and Meta OAuth tokens encrypted at rest).
• Tracker / analytics events: page path, referrer, UTM and click IDs, approximate device/browser, country (from edge headers when available), language/timezone signals, anonymous visitor and session identifiers. We do not intentionally collect form field contents or payment card numbers via the tracker.
• Exports and API: JSON event exports you download, hashed API keys, webhook URLs and delivery logs.
• Third-party metrics: if you connect Google Analytics, Search Console, Clarity, or Meta Ads, we store synced metrics, ad creative text you already published, and connection metadata you authorize.
• Operations: password-reset token hashes, admin audit log of plan approvals and related actions, technical logs (IP and request metadata) at hosting providers for security.

3. How we use data

• Provide dashboards, Real-Time, Audience, Acquisition, Ads, reports, and AI digests.
• Authenticate sessions (HTTP-only cookie), Google or GitHub sign-in, optional 2FA, and password resets.
• Enforce plan limits, billing windows, grace periods, and admin approvals.
• Send optional Monday briefs, pulse alerts, and tracker-down notices you opt into.
• Secure the service, prevent abuse, and debug outages.

4. Legal bases (where applicable)

Depending on your jurisdiction, we rely on contract performance (providing the SaaS you requested), legitimate interests (security, product integrity), and/or consent where you or your site’s policies require it for analytics cookies/identifiers.

5. Sharing

We do not sell personal data. We share data only with:

• Infrastructure providers (hosting, database, email, optional WhatsApp/Twilio).
• Google or GitHub, when you choose Continue with Google or Continue with GitHub — they confirm your identity; we store your name, verified email, and that provider’s user id.
• Whop or Stripe, when you pay online — they process the card. Visitorly stores plan status, period dates, and last four digits of a card when the processor sends them, never a full card number.
• Integration providers you choose to connect (Google, Clarity, OpenRouter for AI).
• People you invite to a site, and anyone you give a passworded share link.
• Authorities when required by law.

Customer analytics data is isolated per site. Invited seats see only sites they were granted. Platform administrators can access account and site metadata as needed to operate Visitorly, including an internal audit log of plan actions.

6. Cookies

Visitorly uses an authentication cookie for signed-in users and a short-lived cookie when someone unlocks a passworded share link. The Visitorly Tracker may set or read anonymous identifiers in the browser of your site’s visitors. See our Cookie Policy.

7. Retention

Account data is kept while your subscription is active and for a reasonable period afterward for disputes and legal compliance. First-party tracking events are deleted automatically by plan: about 90 days (Basic), 180 days (Growth), or 365 days (Pro). You can download a JSON copy from Sites (admin/owner) before rows age out. You may delete your account from Profile; that permanently removes your user, sites, and history subject to legal holds.

8. Your rights and data deletion

Depending on where you live, you may request access, correction, or deletion. In the product: Profile for account fields; Sites → Export Events (JSON) for first-party events on a site you administer; delete account on Profile. Contact the operator for anything the UI cannot fulfill.

8.1 Meta (Facebook) Data Deletion & Revocation Instructions

Visitorly does not store personal Facebook profile information beyond the encrypted OAuth access tokens and authorized ad account IDs required to display your ad performance metrics. If you wish to revoke access or remove your Meta integration data:

• From the Visitorly Dashboard: Navigate to Dashboard → Integrations, select your website, and click Disconnect Meta. This instantly and permanently purges all stored access tokens, connected ad accounts, and cached ad data.
• From Facebook Account Settings: Go to Facebook Settings & Privacy → Settings → Apps and Websites, find Visitorly, and click Remove.
• Full Account Deletion: Deleting your Visitorly account from the Profile settings permanently deletes your user profile, all associated websites, all integration credentials, and all tracking events.

9. Security

We use HTTPS, hashed passwords, encrypted integration and authenticator secrets where implemented, role-based site access, and access controls. No method of transmission or storage is 100% secure.

10. Your responsibilities

If you install Visitorly on a customer-facing website, you must provide an appropriate privacy notice and obtain any consents required in your region for analytics. You must not use Visitorly to collect sensitive personal data unlawfully. You are responsible for who you invite and which share links you create.

11. International transfers

Data may be processed in regions where our hosting and database providers operate. Where required, appropriate transfer safeguards should be applied by the platform operator.

12. Contact

For privacy requests, contact the Visitorly operator using the support email provided when your plan was approved, or Talk to Us.