Privacy Policy

1. Scope

This policy applies to Analytics Capture websites, hosted workspaces, public tools and integrations. Customers remain responsible for their own websites, notices, lawful bases, consent choices and the data they choose to send into Analytics Capture.

2. Information we process

Account and workspace information

We may process account identifiers supplied by our authentication provider, workspace and project settings, website URLs, configuration choices, billing or plan metadata, and support or administrative records needed to operate the service.

Measurement and website evidence

When you install the Analytics Capture collector or use an audit tool, the service can process privacy-filtered technical and behavioural evidence such as page paths, event names, component or form identifiers, timestamps, consent state, referral or campaign metadata, technology observations and delivery status. The product is designed to exclude raw passwords and sensitive form values and to minimise captured content before it becomes measurement evidence.

Technical information

We may process security, request and operational metadata such as IP-derived request information, user agent, timestamps, authentication events, rate-limit state and application logs where needed to secure, troubleshoot and operate the service.

3. Google user data

When you connect Google Analytics, Analytics Capture may access the Google Analytics accounts and properties your Google account is permitted to view, plus read-only reporting data requested through the Google Analytics Admin API and Data API. Current reporting features include property discovery and metrics such as sessions, active users and event counts for the reporting window you select.

Analytics Capture uses this Google user data only to provide user-facing reporting, comparison and analysis features you request inside the product. We do not use Google Analytics user data to build advertising profiles, sell it, or use it for unrelated purposes.

OAuth access and refresh tokens are kept server-side, encrypted within the selected Analytics Capture project, and are not returned to browser code. The current GA4 reporting flow returns report rows to the signed-in browser for visualisation and does not silently copy those rows into Analytics Capture storage.

Google user data is not sold. We do not transfer it to third parties except to service providers acting on our behalf where necessary to host, secure or operate the service, or where disclosure is required by law. Such use is limited to operating the functionality requested by the user.

Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

4. How we use information

• Provide, secure and maintain Analytics Capture.
• Store and present measurement evidence, mappings, reports and destination status.
• Operate integrations explicitly configured by a workspace user.
• Detect abuse, investigate faults and protect accounts and infrastructure.
• Meet legal, accounting and regulatory obligations where applicable.
• Improve the product using service-level feedback and operational information, subject to the restrictions above for Google user data.

5. Service providers and sharing

We may use infrastructure, authentication, billing, communications and security providers to run Analytics Capture. They may process limited information on our behalf under their service terms and contractual safeguards. We may also disclose information where required to comply with law, protect users or the service, or complete a corporate transaction subject to appropriate protections.

Destination integrations you enable may receive the approved measurement data you choose to send to them. Their own terms and privacy policies apply once data is transmitted to those services.

6. Retention, disconnect and deletion

We retain workspace information for as long as reasonably necessary to provide the service, maintain security and meet legal obligations. Retention can vary by data type and workspace configuration.

If you disconnect Google Analytics, Analytics Capture removes the locally stored Google OAuth access token, refresh token, token expiry metadata and selected property information for that project. Revoking Analytics Capture from your Google Account provides an additional way to withdraw Google access.

Workspace controls may allow project evidence or activity history to be removed. Where a deletion request cannot be completed directly in-product, use the support or account contact channel available through Analytics Capture.

7. Security

We use measures intended to protect information against unauthorised access, alteration and disclosure. Secrets and OAuth tokens are kept server-side; supported production deployments use encrypted credential storage, HTTPS and access controls. No online service can guarantee absolute security.

8. Cookies and local storage

Analytics Capture may use essential cookies or browser storage for authentication, workspace continuity, security and product operation. Optional analytics or consent-related behaviour is kept separate from core workspace access and may depend on your chosen configuration.

9. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of personal data, or to receive a portable copy. You can also disconnect integrations and revoke Google access at any time. Use the support or account contact channel published within Analytics Capture to make a privacy request.

10. Changes to this policy

We may update this policy as the product, integrations or legal requirements change. The effective date above will be updated when material changes are published.

11. Contact

For privacy questions or requests, contact Analytics Capture through the support or account contact channel available in the service or on the Analytics Capture website.