Privacy Policy

1. Controller (Verantwortlicher)

The controller responsible for the processing described here, within the meaning of Art. 4(7) GDPR, is:

Stefan Rosanitsch
Kriegerdankstr. 14
96450 Coburg
Germany
Email: stefanrows@gmail.com
Contact form: xpmetric.com/contact

Full provider details are in our Impressum.

Data protection officer: We have not appointed a data protection officer. XPmetric is operated by a single person and does not meet the thresholds of Art. 37(1) GDPR or § 38(1) BDSG. You can raise any data protection matter directly with the controller above.

2. Two different roles — please read this first

XPmetric processes personal data in two distinct roles, and your rights differ depending on which one applies to you.

• As controller, for visitors and customers of xpmetric.com — this website, your XPmetric account, billing, support and our own marketing. That is what this policy describes.
• As processor, for analytics data from our customers’ websites — when a site owner installs our tracking script, they decide why and how that data is processed. They are the controller; we act on their instructions under a data processing agreement (Art. 28 GDPR). If you visited a website that uses XPmetric and want to exercise your rights, please contact the operator of that website. We will support them in responding.

3. What we process, why, and on what legal basis

4. Analytics data from our customers’ websites

This is the data we process as a processor (see section 2). For each pageview we receive: the HTTP(S) page origin and pathname, the referrer origin, supported UTM source, medium and campaign values, device type, browser, operating system, country and city derived from the IP address, and any custom events or revenue the site owner configures. URL credentials, fragments and other query parameters are removed; sign-in, verification, callback and password-reset routes are excluded because their paths may contain authentication tokens.

A site owner can separately enable crawler reporting through the XPmetric WordPress plugin. For requests selected by its crawler filter, WordPress sends the site token, requested URL and path, referrer, crawler's user-agent string, and the page's HTTP response status to the endpoint configured by the site owner (by default, our crawler reporting API). We store the site origin and pathname, supported UTM source, medium and campaign values, referrer origin, response status, user-agent string, bot provider, agent and category, and country. Other query parameters, URL credentials and fragments are removed, and authentication paths are excluded. The country comes from the reporting request's network metadata; with the WordPress plugin, it may describe the WordPress server or its proxy rather than the crawler. The crawler-hit record does not store a raw IP address.

We do not store raw IP addresses in our analytics databases. In the default cookieless mode, visitor identity is a non-reversible hash computed on our servers from the visitor’s IP address, browser and the tracked site, salted with random bytes that rotate each UTC day and expire after up to 48 hours. The same person therefore gets a new identifier every UTC day. The hash is scoped per site, so visitors are never linked across websites. IP addresses are used transiently to compute that hash and to look up an approximate location using a local database, and are then discarded.

A site owner can separately enable optional email attribution. If they call the identity method on their website, your email is sent to us over TLS and converted to a site-scoped keyed hash. We do not store or log the raw address for this flow. The link to a visitor identifier is pseudonymous personal data, not anonymous data. It expires 30 days after the last capture and is deleted when the site owner disables the option or erases the site's analytics. The site owner controls this processing and must provide the applicable notice and basis. In cookieless mode the link can recover only the purchase day's attribution, even when a payment arrives later. It does not join visits across days or websites.

Our web server keeps a short access log for troubleshooting and security, separate from the analytics databases described above. It records the page requested, the response status, how long the request took, the browser’s user-agent string and the country supplied by our CDN. It does not record IP addresses. The client IP is removed before the line is written, as are the headers that carry it, session cookies, and any sign-in token in the address. The log is a small rolling buffer that overwrites itself roughly every 24 hours; there is no archive and no backup of it.

5. Public posts on X about a tracked website

This section is for people who are not XPmetric users: authors of public posts on X. Because we did not obtain this data from you, Art. 14 GDPR requires us to tell you the following.

What we do. When a customer on the Growth plan enables mention tracking for their website, we query X’s public search API for recent posts that name that website’s domain, and store the matches so they can appear as markers on that customer’s own traffic chart.

Categories of data (Art. 14(1)(d)). The author’s handle and display name, the post’s ID and time, its like count, and an excerpt of the text of at most 280 characters. That is all. We do not store profile pictures — we do not even ask X for them — and we do not open your profile, record your follower count or bio, enrich the post with data from anywhere else, or link posts to visitors of the website. There is no profiling and no automated decision-making.

Source (Art. 14(2)(f)). X’s public search API, operated by X Corp. Only posts that were publicly visible at the time we retrieved them are used; we never see protected accounts.

Purpose and legal basis. Art. 6(1)(f) GDPR. The legitimate interest is ours and the site owner’s: understanding which public posts sent people to a website. We consider this proportionate because the post was published by you, deliberately names that website, and is shown only to the owner of that website inside their own dashboard — the same post they would find by searching X themselves. We store the minimum needed to link back to your post, and no sensitive categories of data under Art. 9.

Recipients. The owner of the website your post named, and our hosting provider (Hetzner, Germany). Mention data is not sold, not shared with advertisers, and not used to train anything.

How long. 12 months from the date of the post, after which it is deleted automatically, or sooner if the site owner deletes their account or site.

Your rights — objection (Art. 21(1) GDPR). You can object at any time, and you do not have to give a reason that we get to judge. Email privacy@xpmetric.com from any address, naming your handle. We delete everything stored for that handle across all customers and add it to an internal block list, so it is not collected again on the next search — normally within 24 hours, and at the latest within the one month Art. 12(3) allows. You also have the rights in section 9 (access, rectification, erasure, restriction, and complaint to a supervisory authority).

If you delete your post on X, our stored excerpt does not disappear by itself — we do not receive deletion notifications. Tell us and we will remove it; otherwise it is deleted when the 12 months are up.

6. Cookies and local storage on xpmetric.com

The table below lists everything set on this website. Names shown without a prefix additionally carry the __Secure- or __Host- prefix when served over HTTPS.

Withdrawing your consent (Art. 7(3) GDPR): you can change or withdraw your choice at any time via Cookie settings in the footer of any page. Withdrawal takes effect immediately and is as easy as giving consent, but it does not affect the lawfulness of processing carried out before you withdrew.

7. Recipients and transfers to third countries

We do not sell, rent or trade personal data. We use the following service providers. Their contractual safeguards and processing terms are tracked in our compliance review:

The maintained Art. 28 sub-processor list (visitor analytics on behalf of customers) and the full recipient inventory are published at /subprocessors. The Data Processing Agreement covers processing of your visitors' analytics data.

Transfers to the USA carry the residual risk that public authorities there may access data under local law, and that the available legal remedies may not match those in the EU. Where a provider is certified under the EU-US Data Privacy Framework, the Commission's adequacy decision may apply; otherwise Standard Contractual Clauses may be needed. We are checking the applicable contract and transfer mechanism for each provider.

Our Hetzner servers holding account and analytics data are located in Germany; the exact datacenter remains to be confirmed. Other providers above may process data elsewhere. Data is encrypted in transit using TLS.

8. How long we keep data

9. Your rights

You have the right to:

• Access (Art. 15) — a copy of the data we hold about you
• Rectification (Art. 16) — correction of inaccurate data
• Erasure (Art. 17) — deletion of your data
• Restriction (Art. 18) — restriction of processing
• Portability (Art. 20) — your data in a structured, machine-readable format
• Withdrawal of consent (Art. 7(3)) — at any time, without affecting processing already carried out

Right to object (Art. 21 GDPR)

Where we rely on legitimate interests (Art. 6(1)(f)) — security, error logging, product emails and public X mentions — you have the right to object at any time on grounds relating to your particular situation. We will then stop that processing unless we can demonstrate compelling legitimate grounds that override your interests. If you are the author of a public X post, section 5 describes how we handle an objection and how quickly. Where data is processed for direct marketing, you can object at any time and we will stop unconditionally.

You can exercise several rights yourself from your Settings: “Export My Data” downloads your profile, sites, event summaries, achievements and usage history as JSON, and “Delete My Account” removes your data. For anything else, email us — we respond within one month (Art. 12(3) GDPR).

Right to lodge a complaint (Art. 77 GDPR): you may complain to a supervisory authority, in particular in the member state of your residence, place of work or of the alleged infringement. The authority competent for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 27, 91522 Ansbach, Germany
www.lda.bayern.de

10. Automated decision-making

We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR.

11. Is providing data required?

Providing an email address is necessary to create an account and use the service — without it we cannot enter into the contract. Everything else is optional. Consent-based processing is entirely voluntary and refusing it has no consequence beyond the specific feature not loading.

12. Do Not Track

Our tracking script honours the Do Not Track browser signal. When DNT is enabled, no analytics data is collected from that visitor.

13. Changes to this policy

We may update this policy as the service changes. If we make significant changes we will notify you by email or in the app, and where the change concerns consent we will ask for it again.

14. Contact

For privacy questions or to exercise your rights, email stefanrows@gmail.com or use the contact form.