# DataStated

> DataStated is first-party web and revenue analytics for founders and small teams. Record visits, goals and orders; inspect buyer journeys; compare connected ad platforms' conversion claims with processor-confirmed orders attributed to their paid channels.

Touched, Started and Closed are observed journey counts, not modeled credit or causal lift. Platform claims appear separately. Stripe charge records and reconciled Shopify payments confirm payment; browser and custom API orders are self-reported. A confirmed payment can have no matching visit.

## Product

- [Documentation](https://datastated.com/docs/): domain proof, tag installation, Shopify, Stripe, ad connections, Search Console, goals, dashboard, imports, filters, funnels, email, public dashboards, crawlers, privacy controls and API access.
- [How it works](https://datastated.com/#how): verify the domain, install the tag with the consent controls your site needs, and connect payment and ad sources.
- [Pricing](https://datastated.com/#pricing): eight event-volume sizes, $9 to $299 a month; all features, unlimited team members, and a 14-day trial with no card.
- [Meta Ads](https://datastated.com/docs/meta-ads), [Google Ads](https://datastated.com/docs/google-ads), [TikTok Ads](https://datastated.com/docs/tiktok-ads): read-only reporting connections. Deployment credentials, provider permissions and a successful live pull are required. Meta is unpublished with ads_read testing pending; hosted TikTok access is unavailable. Their guides describe activation still required.
- [Sign up](https://app.datastated.com/start)
- [Sign in](https://app.datastated.com/login)

## Reporting scope

- Numeric analytics money includes USD only, with no foreign-exchange conversion. Order counts include all currencies. Other and unknown currencies are excluded from USD amounts and reported separately. Window totals carry money.reportingCurrency, conversion, excludedEventCount and per-currency totals. [Money scope](https://datastated.com/docs/dashboard#money).
- Known USD ad records support spend, claimed revenue, CPC and platform-reported ROAS. Revenue gaps and efficiency also require compatible USD processor-confirmed payments. Unknown, mixed or non-USD currency leaves combined dollar figures unavailable; raw currency groups stay separate, without FX. Re-sync older ad rows with unknown currency. Campaign, ad-group/ad-set and ad rows contain platform-reported results, not a campaign-to-payment reconciliation. [Comparison scope](https://datastated.com/docs/attribution#gap).
- Paid-channel attribution uses captured click parameters and paid UTMs. These client-supplied values do not independently prove an ad click. Bare fbclid or utm_source=meta without a paid medium is not Meta Ads; organic and ambiguous traffic stays outside paid-platform comparisons. gclsrc identifies Google Ads only when its value is aw.ds. [Attribution rules](https://datastated.com/docs/attribution).
- Imported daily visitor/pageview history is shared by unfiltered dashboard totals, charts, the window API and weekly summaries. Tracked visitor activity wins on overlapping days; ledger-only events do not displace an imported day. Imports add no revenue or identities. Their daily visitors cannot be deduplicated across the period, and imported days are not divided into invented hourly activity. [Import rules](https://datastated.com/docs/import).
- Funnels have two to eight ordered page, goal, order, shop-action or subscription-event steps. A step needs an event actually recorded for that visitor. The Shopify pixel supplies checkout start, not product views or cart additions. Funnel revenue is recorded USD order money, not proof of causation. [Funnels](https://datastated.com/docs/funnels).
- MRR uses the latest subscription observation available at the requested time, never a later price applied backwards. Missing coverage, unsupported pricing or positive non-USD recurring amounts make it unavailable. Visitor filters hide site-wide MRR. [Subscriptions](https://datastated.com/docs/stripe#subscriptions).

## Installation and payment records

- A browser-supplied tagId identifies an installation but never proves ownership. Publish the site's DNS TXT or HTML meta proof and request a server check. Old tag-only verification is revoked without deleting recorded data. [Domain verification](https://datastated.com/docs/#tag).
- The tag uses a first-party visitor cookie, optional linking between owner-listed domains, and daily-salted IP hashes rather than raw IP storage. It records outbound clicks and engagement and filters recognized automation. It does not guarantee observation of every visitor. [Tag reference](https://datastated.com/docs/tag-reference).
- Stripe uses a restricted key. Webhooks supply updates when enabled; the six-hour scheduled pull backfills and reconciles records. Large histories resume saved pages across passes. Charges already fully refunded when first imported still enter gross revenue, with successful refunds recorded as separate deductions from net revenue. Only succeeded refunds deduct money; pending, failed and canceled states do not. Orders retain gross revenue, with separate refund deductions. [Stripe](https://datastated.com/docs/stripe).
- Stripe Checkout success-page matching reports a session id to the server, which checks it with the site's Stripe key. The amount comes from Stripe, not the browser. Visitor matches are metadata, client_reference, session_param, email or none. Charge ids deduplicate repeated imports. [Payment matching](https://datastated.com/docs/stripe#attribute).
- Shopify payment reconciliation reads successful SALE/CAPTURE transactions and successful REFUND transactions. An unpaid checkout is activity, not collected revenue. Paid updates and refund notifications fetch current transaction evidence. Incomplete payment histories fail instead of guessing.
- Shopify backfill: POST /api/shopify/{site}/backfill with an owner key carrying settings:write. An empty JSON body defaults to the last 30 days; an explicit UTC from/to window can span at most 60 days. Responses page five orders at a time using data.after and data.hasNextPage. Repeat the same returned from/to with the cursor. Older orders require Shopify's read_all_orders grant. This backfill imports payment records, not historical visits. [Full instructions](https://datastated.com/docs/shopify#backfill).
- Search Console has a separate read-only connection and property selection. Search terms and landing pages show Google's clicks, impressions, CTR and position. Site-recorded orders appear beside pages, never as inferred revenue for a search term. [Search Console](https://datastated.com/docs/search-console).
- Crawlers that do not run JavaScript need server reporting through @datastated/crawl. The named crawler directory distinguishes published-range verification from user-agent recognition. Crawl hits have a separate allowance of 100,000 per site per month and do not count as billed events. [Crawler setup](https://datastated.com/docs/crawlers), [directory](https://datastated.com/docs/crawler-directory).

## For AI agents

- MCP: Streamable HTTP at https://app.datastated.com/api/mcp with an API key as a Bearer header. Catalogued tools use datastated_<resource>_<action>; datastated_help returns the current catalogue. Destructive tools dry-run unless confirm: true. [MCP guide](https://datastated.com/docs/mcp).
- REST: scoped API keys can be restricted to particular sites. Creating a child key cannot expand the caller's permissions or site access. Authenticated credentials share a PostgreSQL-backed rate limit across replicas using the same database. Anonymous requests and unrecognized credentials remain locally limited. Authentication or shared-limiter failure returns 503 instead of a local-only allowance; self-hosted instances need the limiter migration. Newer routes return { status: "ok", data, meta?, pagination? }; legacy routes return bare payloads. [API reference](https://datastated.com/docs/api), [OpenAPI](https://app.datastated.com/api/openapi.json).
- CLI: npx datastated <resource> [action] <site> after datastated login, or with DATASTATED_API_KEY set. Commands support --json; destructive writes ask unless --yes. [CLI guide](https://datastated.com/docs/cli).
- These interfaces expose the documented catalogue, not every dashboard feature with identical scope. The separate Shopify backfill route is not yet a CLI command or MCP tool.

## Consent, limits and retention

- data-require-consent waits without cookie/storage access, measurement requests or listeners. Initial waiting calls can queue. ds("consent", "granted") starts measurement. Denial or withdrawal stops sends, drops queued and later calls, and clears accessible visitor cookies and owned listeners. Re-grant does not replay denied-period activity. Sent requests cannot be recalled, other-origin cookies cannot be cleared, and stored history is not erased. A later identify call with the same user id can link a new cookie to old history. The consent manager must supply choices on every page/domain. GPC and DNT take precedence. [Consent setup](https://datastated.com/docs/consent).
- Going over the plan allowance does not lock the dashboard. Recording has a finite ceiling: 20 times the 10k and 100k allowances, 15 times 200k, 7 times 500k, 5 times 1m, 3 times 2m, twice 5m and 1.5 times 10m. Upgrading reveals retained held-back days; events dropped beyond the ceiling cannot be recovered.
- Hosted history is kept three years through the 200k plan and trial, five years from 500k up. After all owners' access ends, recording continues for 30 days and site analytics are removed after 90 days. Account records, settings, memberships and connections remain. [Retention scope](https://datastated.com/docs/gdpr#retention).
- Optional email summaries contain aggregate analytics. Order and goal alerts can include an amount or goal name, time, source and daily count, sent to the configured recipients. [Email](https://datastated.com/docs/email).
- Privacy controls do not by themselves determine a site's legal compliance. The site owner must configure consent and disclosures for its use.

## Legal and contact

- [Terms of Service](https://datastated.com/terms)
- [Privacy policy](https://datastated.com/privacy)
- [Data Processing Agreement](https://datastated.com/dpa)
- Email: hello@datastated.com