Security and GDPR

European by design.

Tracya is built and hosted in the European Union. Here is exactly what we do with data, and what we never do.

100%
EU hosting
0
IP addresses stored for widget events
72h
breach notification
14d
notice before any sub-processor change

Where your data lives

All Tracya infrastructure (API, database, dashboard, widget delivery) runs on Hetzner in Germany. End-user event data never leaves the European Economic Area. There is no US cloud in the serving path.

What the widget collects, and what it never collects

Collected

Flow events (step started, step viewed, step completed, flow completed, flow abandoned) with timestamps, linked to your project ID and to a pseudonymous visitor identifier: a randomly generated UUID, stable per visitor and per project, stored in the end user's browser, not linked to any identity. Flow display markers stay in the browser and are never sent to our servers.

Never collected

No names, no email addresses, no IP addresses stored for widget events, no device fingerprinting, no session recording. The browser extension reads no content from your pages and communicates exclusively with api.tracya.io.

For this data, you are the controller and we are your processor. Our Data Processing Agreement (GDPR Art. 28) governs it, is included on every plan, and is accepted at signup. A signable PDF is available on request.

Sub-processors

Hetzner Online GmbHGermany (EU)
Role: Hosting and infrastructure
Safeguards: No transfer outside the EU
OVH SASFrance (EU)
Role: Transactional email
Safeguards: No transfer outside the EU
Stripe Payments Europe, LimitedIreland (EU)
Role: Payments and subscriptions (your billing data only)
Safeguards: Any transfer to the United States is covered by the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses

We give 14 days' email notice before adding or replacing a sub-processor, with a right to object.

Security measures

  • HTTPS/TLS with HSTS everywhere.
  • Passwords hashed with bcrypt (cost factor 12).
  • Short-lived JWT access tokens (15 minutes), rotating refresh tokens stored hashed.
  • Optional two-factor authentication (TOTP).
  • Content Security Policy, DOMPurify input sanitisation, ORM-only queries.
  • Global IP-based rate limiting, security event logging.
  • Security patches within 30 days, automated dependency audits in CI.

Your data, your exit

Cancel any time. You then have 30 days to export everything (JSON) or request early deletion, followed by permanent deletion with a written certificate on request. Your flows and content remain yours.

FAQ

Where is Tracya's data hosted?
On Hetzner in Germany, inside the EU. End-user event data never leaves the EEA.
Does Tracya collect personal data from my end users?
Never names, emails, IPs or fingerprints. Flow events are linked to a pseudonymous, randomly generated identifier not linked to any identity. The DPA governs this processing.
Do I need user consent to run Tracya?
The flow display markers are strictly necessary. The pseudonymous analytics identifier persists across sessions; whether it requires consent under ePrivacy rules depends on the guidance applicable to your situation. Review with your DPO; the DPA sets out roles.
Is a DPA included?
Yes, on every plan, accepted at signup, signable PDF on request.
What happens if I cancel?
30 days to export or request early deletion, then permanent deletion, certificate available.
Security incidents?
Notification without undue delay and, where feasible, within 72 hours, per the DPA.

The paperwork, in full

This page is a summary. The binding documents are the Privacy Policy, the Data Processing Agreement and the Terms of Sale. In the event of any discrepancy, the documents prevail, and their French versions are authoritative.