Privacy Policy

Last updated: September 12, 2026

This Privacy Policy explains how VisitVerity (“VisitVerity”, “we”, “us”), operated from India, handles personal data. VisitVerity is a privacy-first website analytics platform. Because of how the service works, we handle data in two distinct roles, described below.

1. Our two roles: controller and processor

• As a data controller — for the personal data of our own customers (the people who register for a VisitVerity account), we decide how and why that data is used, and this policy governs it.
• As a data processor — for the visitor and behavioral data collected through a customer’s tracked website, the customer is the data controller and VisitVerity acts only as a processor, following the customer’s instructions. If you are a visitor to a website that uses VisitVerity, that website operator is the controller of your data; please refer to their privacy policy and see “Your rights” below.

2. Data we collect about account holders (controller)

• Account data: your name, email address, and a securely hashed password.
• Workspace configuration: your organization, projects, tracked domains, and privacy settings.
• Billing data: your selected plan, subscription identifier and status, billing-period dates, and payment or refund references. Razorpay processes your payment method; VisitVerity does not receive or store your full card number or CVV.
• Acquisition data: how you found us (referrer or UTM parameters), recorded at sign-up.
• Communications: emails you send us and our transactional emails to you (e.g. email verification, password reset).

3. Data we process on behalf of customers (processor)

When a customer installs our tracker on their website, we process anonymous behavioral data on their behalf, which may include: page views, clicks, scroll depth, referrers and UTM/click-ID attribution, custom events and conversions, device and browser characteristics, approximate location (see GeoIP below), and — where the customer enables it — masked session recordings. We assign first-party, anonymous visitor and session identifiers. This data is used solely to provide analytics to the customer who owns the project, and every query is scoped to that customer’s organization and project.

4. What we deliberately do not collect

• No raw IP addresses. IP addresses are converted into keyed, irreversible network hashes and the raw address is discarded. We use them only to approximate network and location and to detect automated traffic.
• Masked session replay. Where replay is enabled, all form inputs and typed text — including passwords, email, telephone, card, and one-time-code fields — are masked in the browser before anything is transmitted. We never receive their contents.
• No sensitive form values, credentials, payment details, or authorization tokens. Form analytics record only metadata (which fields were focused or filled), never the values entered.
• No third-party tracking cookies and no cross-site tracking. We do not follow visitors across unrelated websites.
• We never sell personal data.

5. Cookies and local storage

The VisitVerity tracker does not set third-party tracking cookies. When you sign in to the VisitVerity dashboard, we use a single first-party, strictly-necessary session cookie to keep you logged in. Customers configure their own consent behavior for their visitors (off, opt-in, or opt-out).

6. GeoIP

Approximate country, city, and network are derived using a locally-hosted MaxMind GeoLite2 database. Visitor IP addresses are not transmitted to MaxMind or any third party for this lookup.

7. Legal bases (GDPR/UK GDPR)

Where applicable law requires a legal basis, we and our customers rely on: your consent (email communications, and visitor consent where the customer configures it), our legitimate interests in operating and securing the service, and performance of our agreement with you. Customers are responsible for establishing the appropriate legal basis and consent for the visitor data they collect.

8. Sub-processors

We use a small set of vetted providers to run the service:

• DigitalOcean, LLC — cloud hosting and databases where platform data is stored (New York, United States).
• Cloudflare, Inc. — object storage (R2) for masked session recordings.
• Brevo (Sendinblue SAS) — delivery of transactional emails (receives account-holder email addresses only).
• Razorpay — checkout, recurring subscription billing, payment authentication, and refunds for paid plans. Razorpay processes the billing and payment information you provide at checkout under its own privacy terms.
• MaxMind, Inc. — GeoIP database licensed and queried locally; no visitor data is sent to MaxMind.

A Data Processing Agreement (DPA) is available to customers on request at info@visitverity.com.

9. International transfers

Platform data is stored on infrastructure located in New York, United States. Where data is transferred internationally, we rely on our providers’ safeguards (such as Standard Contractual Clauses) as applicable.

10. Retention

Analytics events, session aggregates, and masked recordings are retained according to each project’s configured retention window and are automatically deleted afterward, across both our databases and object storage. Account data is retained while your account is active and deleted when you delete your account.

11. Your rights

Subject to applicable law, you may request access to, correction of, deletion of, or a portable copy of your personal data, and may object to or restrict certain processing or withdraw consent.

• Account holders can export their account data and permanently delete their account (and all associated analytics and recordings) from the Account page, or by contacting us.
• Website visitors should contact the operator of the website they visited; that operator can permanently remove a visitor’s data — including any recordings — using our visitor-deletion tools.

12. Security

We protect data with encryption in transit (TLS), hashed passwords, irreversible IP hashing, in-browser masking of session recordings, strict per-organization data scoping, and regular encrypted backups.

13. Children

VisitVerity is a business tool and is not directed to children. We do not knowingly collect personal data from children under 16.

14. Changes to this policy

We may update this policy and will revise the “Last updated” date above. Material changes will be communicated where appropriate.

15. Contact

For any privacy question or to exercise your rights, contact us at info@visitverity.com. If you are a website visitor, you may also contact the operator of the site that referred you.