GDPR and privacy

DataStated measures traffic for the site owner. It is not an ad network and it does not build profiles across the internet. Here is what the tag collects, how consent controls it and what retention removes.

Privacy controls

One first-party cookie (_dsv, a random identifier, 13 months). No third-party cookies, ever.
No fingerprinting: no canvas, no font probing, no device signals beyond viewport width and browser language.
Raw IP addresses are never stored. Ingest keeps a salted hash whose salt rotates daily, which limits IP-based correlation. The visitor cookie and any identifiers supplied through identify can still link visits across days.
No shared identifier across customers: the cookie covers your domain and its subdomains. If you list your own other domains in data-allowed-hosts, the tag hands the id across links into those hosts and nowhere else.

What is collected

Per pageview: hostname and path, the referrer, campaign tags on the link, an ad click id when present, viewport width, browser language, and the cookie's random id. A click on a link to another domain adds the destination's host and path, and each page reports how long it was visible. Orders and goals add the name, amount and currency your site chooses to send, and a payment success page reports the Stripe Checkout session id in its URL so the payment can be verified with your own key. When your site sends a buyer's email to the events API, or a Stripe payment carries one, only a hash of it (sha256 of the lowercased, trimmed address) is stored, so a later payment by the same person can be matched to their visit. Your site can also call identify with your own user id, an email and up to ten properties; the id and properties are stored as sent, the email only as the same hash. The complete list is in the privacy policy.

What is never collected

Names, email addresses in the clear (only the hash above is kept), postal addresses, precise location, page content, keystrokes, session recordings. The Shopify app reads order totals and attribution fields. Goal and identify properties are supplied by the site, so validation cannot guarantee that they contain no personal data. Keep personal information out of those properties and out of URLs.

GPC and Do Not Track

A browser sending Global Privacy Control or Do Not Track is left entirely alone: no cookie is set and nothing is ever sent. There is no setting to override it.

Do not assume that a first-party cookie is exempt. DataStated includes individual visitor journeys and payment attribution; audience measurement exceptions have limits that depend on your jurisdiction and use. The consent guide links the current regulator guidance. Use a consent gate unless you have established another lawful setup. Your consent manager must pass on both acceptance and withdrawal; data-require-consent alone does not collect the visitor's choice.

How long data is kept

Hosted retention follows the plan: three years on the 10k, 100k and 200k plans and during the trial, five years from 500k up. The nightly sweep removes older visit, goal and order events, imported history, daily rollups, crawler hits, Search Console history, annotations, alert-send records and supporting payment history, including Stripe invoices, checkout claims and webhook receipts.

Identities needed by retained records or ongoing subscriptions remain. For each retained subscription, the latest MRR observation at or before the cutoff remains with its newer observations, so a window inside retention can use a known opening state. The crawler usage counter for the month containing the cutoff also remains to enforce that month's allowance. Active-site ad spend, financial ledgers and reports are not removed by the rolling history cutoff.

When every owner's access has ended, recording continues for 30 days, then stops. Sixty days after that, the nightly sweep deletes all of the site's analytics: event and visitor history, crawls, search, subscription and MRR records, other payment history, annotations, alert sends, ad spend, financial ledgers and reports. Account records, the site, its settings, memberships and connections remain. Renewing before deletion retains the history still within the plan's window. GET /api/sites returns retentionYears and dataDeletesAfter (API reference).

The paperwork

The privacy policy says what is collected in plain words. The Data Processing Agreement covers the processor relationship for your visitors' data, names the actual subprocessors, and applies automatically through the terms, so there is nothing to sign. Data is hosted in the United States. Questions: legal@datastated.com.

Questions? Email us at hello@datastated.com.