Privacy
Spreelytics processes your visitors’ data only for you, under a Data Processing Agreement that is part of our Terms. Here is what that covers, in plain words.
At a glance
The data
Only what the script sends and what you connect, processed for you as listed in the DPA.
Identifiers
A random visitor id, kept in a first-party cookie or, in cookieless mode, a hash that changes every day. A session id for each visit.
IP address
Used as each request arrives: for approximate location, to filter out data-centre traffic and, in cookieless mode, to make the daily hash. It isn’t stored with your analytics. Server logs and our records of bot visits keep it for up to 30 days.
Device
The browser’s user agent, and the browser, operating system and device type read from it.
Approximate location
Country, region, city, time zone and approximate coordinates, worked out from the IP address.
Activity
Pages viewed, referrer and campaign (UTM) tags, link clicks, scroll depth, time on page, visit length, and the custom events you send.
Session recordings
Only if you turn on session replay: the pages a visitor sees and what they do on them. By default, what they type into forms, and email addresses, are masked in their browser and never reach us. Kept for 30 days.
Identified visitors
Only once you identify someone: their email address, plus any details you send, such as a name, company or plan.
Payments
From a payment provider you connect, or revenue events you send: amount, currency, product, dates, and the payer’s name and email address.
Imports
Events you import, for example from a CSV file.
Ask AI
The questions your team asks the assistant, and the analytics it reads to answer them.
How it is covered
You decide what is collected and why. We keep it, protect it and delete it the way the DPA says.
For your visitors’ data you are the controller and we are your processor. We act only on your instructions, and the DPA covers everything Article 28 asks for.
Spreeflo Ltd, a UK company, runs Spreelytics on Amazon Web Services in Ohio. Data from the EEA reaches us under the EU’s adequacy decision for the UK.
By default the script sets one first-party cookie, so a returning visitor keeps one identity. Switch a project to cookieless and nothing is stored in the browser.
Free keeps 13 months of analytics and Growth keeps five years. Each month we delete what is older. Session recordings are kept for 30 days.
A person’s profile shows what Spreelytics holds about them, and the API returns it, so you can answer an access request yourself.
Ask AI sends a question, and the numbers it reads to answer it, to Fireworks.ai, which runs the model. Fireworks may not use your data to train or improve any model.
Security
The measures in the DPA’s security annex, and what happens if something goes wrong.
Data is encrypted in transit with TLS 1.2 or later, and at rest with AES-256.
Each team’s and each project’s data is kept apart where it is read and written. Production is separate from development.
We tell you without undue delay after we become aware of a breach affecting your data, with what we know and what we are doing about it.
The documents
Our Article 28 terms as your processor, with what we process, how we protect it, and who helps.
Read itWho processes your data for us, what for, and where.
Read itHow we handle our own customers’ details: your account, billing and support.
Read itEach cookie this website sets, and how long it lasts.
Read itFAQ
What legal and security teams ask before they sign off.
Yes. We process your visitors’ data only on your instructions, under a Data Processing Agreement that covers everything Article 28 of the GDPR asks for: confidentiality, security, sub-processors, help with requests and breaches, audits, and deletion.
You stay the controller. Whether your own use is lawful, for example whether your site needs consent for its cookie, is yours to decide, and this page and the DPA give you what you need to decide it.
No. The DPA is part of our Terms, so it binds us both once you accept them, and keeping it in electronic form meets Article 28(9). If your own procedures need a countersigned copy, email contact@spreelytics.com and we will send one.
On Amazon Web Services in Ohio, in the United States. We are Spreeflo Ltd, a UK company. Data from the EEA reaches us under the EU’s adequacy decision for the UK, and our transfers to sub-processors outside it rely on the EU–US Data Privacy Framework or the EU standard contractual clauses. The sub-processors page lists each one and where it is.
It depends on where you and your visitors are, and on what else your site collects, so ask whoever handles privacy for you. By default Spreelytics sets one first-party cookie. You can switch a project to cookieless, and then nothing is stored in the browser. The privacy guide in our docs says exactly what each mode stores.
Session replay is different. Regulators in the EU and UK treat recording a visit as needing consent, with or without cookies. Spreelytics records only visitors tracked with the cookie, so if you hold the cookie back until a visitor agrees, replay waits for that agreement too.
No. Ask AI runs on Fireworks.ai, which may not use your data to train or improve any model. If you connect your own AI app over MCP, it works under your agreement with its provider.
Find the person in the app: their profile shows what Spreelytics holds about them, and the API returns it. To have someone erased, email contact@spreelytics.com from an admin’s address with a link to their profile. We delete their events, visits and identifying details within 30 days and tell you when it is done.
If a person asks us directly, we point them to you.
Delete a project, a team or your account in the app, and its data goes from our live systems straight away. Export what you need through the API first. Until then, analytics follow your plan: 13 months on Free, five years on Growth.
We tell you without undue delay after we become aware of a breach affecting your data: what happened, who and what it concerns, the likely consequences and what we are doing about it. If we don’t know it all at once, we tell you in stages, and we help with your own notices to authorities and to the people affected.
Yes. Start by asking: we answer in writing and share the DPA, our security information and any audit reports we hold. If that is not enough, you can audit us once a year with 30 days’ notice, through an auditor bound by confidentiality, at your cost.
Free up to 100k events a month · no credit card
