Privacy
DataStated measures traffic for the people who own the websites it runs on. It is not an advertising network and it does not build profiles of people across the internet. This page says exactly what is collected and what is not.
Who this covers
DataStated is operated by KAMKR LLC. There are two groups of people in this document, and they are treated differently:
- Customers. People with a DataStated account who measure their own websites.
- Visitors. People who visit a website that has the DataStated tag installed. Visitors have no account and never interact with us directly.
For visitor data, the customer who owns the site is the controller and DataStated is the processor. We hold that data on their behalf and do not use it for our own purposes. The full processor relationship is written out in our Data Processing Agreement.
What the tag records about a visitor
The tag is one small JavaScript file served from our own domain. On each page view it sends:
- The hostname and path of the page
- The referring URL, when the browser supplies one
- Campaign tags on the link (
utm_source,utm_medium,utm_campaign,utm_term,utm_content, and theref,viaandsourceshorthands) - An advertising click identifier when present (
fbclid,gclid,gbraid,wbraid,gclsrc,ttclid,msclkid,twclid,li_fat_id) - Viewport width and the browser language setting
- A random visitor identifier from a first-party cookie (see below)
- For a completed order or a goal, the name, amount and currency the site chooses to send
- How long each page was visible, reported when the page is hidden or left
- For a click on a link to another domain, the destination's host and path
- A goal when the visitor scrolls to an element the site marked with
data-ds-scroll - On a payment success page, the Stripe Checkout session id carried in the page URL, so the payment can be verified with the site's own key
- When the site calls
identify, its own user id for the visitor, up to ten properties stored as sent, and optionally an email address, which is stored only as a SHA-256 hash
Stores connected through the Shopify app
A customer who installs the DataStated Shopify app gives it two things: a small pixel that runs on their storefront and checkout (sending the same fields as the tag above, plus the checkout token and the order number so a purchase is counted once), and a copy of each new order from Shopify itself. From an order we keep the order number, the total, the currency, the time, the landing page and the referring page. We do not retain the buyer's name, email address, phone number or postal address from Shopify orders. Store access tokens and pending installation credentials are encrypted at rest. When we receive Shopify's uninstall notification, we disable the store connection and remove its stored access tokens. A merchant who wants the whole site removed can delete it from the dashboard or email us.
For Shopify privacy requests, we retain the store, request, customer and order identifiers needed to locate the requested records and track fulfillment. Site owners can download requested order and refund records for private delivery. Erasure removes identified Shopify records and retains hashed suppression identifiers to prevent replay. Older unmarked activity and shared identities may require manual review; a request remains open when that review is needed.
What is never collected
- No names, addresses or phone numbers. The tag reads the page URL and the referrer, never form fields or page content. An email reaches us only if the site calls
identifywith one, and only its SHA-256 hash is kept. Goal and identify properties hold whatever the site sends, so site owners should keep personal data out of them. - No raw IP addresses. See below.
- No cross-site tracking. The cookie is first-party and scoped to the site and its subdomains. The identifier is handed to another domain only when the site owner lists that domain in
data-allowed-hosts, and then only on links into it. There is no shared identifier that links a person between two DataStated customers. - No keystrokes, no session recording, no heatmaps, no screen capture.
- No data sold, rented, or shared with advertisers. We do not sell personal information and we do not operate an ad network.
How IP addresses are handled
A visitor's IP address is used and discarded within the same request. It is never written to disk. What is stored is a one-way hash, salted with a secret that changes every day, so the same visitor produces a different value tomorrow than today. The daily salt limits correlation using the stored IP hash. The visitor cookie and identifiers supplied through identify can still associate visits across days.
If the salt is not configured, the server refuses to accept events rather than fall back to a weaker one. It fails closed on purpose.
A two-letter country code is recorded, taken from a header our hosting network adds, and a region and city name where that network supplies them. No coordinates and no IP lookup database.
The cookie
The tag uses one first-party cookie, _dsv, to link
visits and the orders or goals associated with them. It holds a
random identifier generated in the browser, lasts 13
months, uses SameSite=Lax and is marked
Secure on HTTPS pages. It covers the site and its
subdomains. Cross-domain linking is optional and limited to the
hosts the site owner lists in data-allowed-hosts.
The tag sets no other cookies and does not fingerprint visitors.
It reads the optional localStorage key
datastated_ignore to exclude a browser. On a Stripe
Checkout success page it writes a sessionStorage marker,
_dscs_ followed by the session id, to avoid repeating
that page's checkout report. The browser clears this marker when
the tab closes; withdrawal also clears the active marker.
With data-require-consent, the tag reads or writes no
cookies or browser storage and sends no measurement requests until
the page grants consent. Initial waiting calls may queue in memory.
Denial or withdrawal discards that queue and drops later calls.
Withdrawal stops measurement, removes the tag's listeners and
clears accessible _dsv cookie scopes. It cannot recall
a request already sent, clear cookies on another origin or delete
records already received. A new grant starts with a fresh visitor
id and does not replay activity from the denied period. The site's
consent manager must apply the choice on each page and domain.
Cookies on our own sites
datastated.com, this site, sets no cookies, writes nothing to browser storage and loads no third-party scripts, fonts or images. Its fonts are served from the site itself.
app.datastated.com, the dashboard, sets the first-party cookies below and no others. All of them are HttpOnly, so scripts on the page cannot read them, and all are marked Secure over HTTPS. The dashboard sets no analytics or advertising cookies and does not run the DataStated tag on itself. Cloudflare, which sits in front of the dashboard, can set a short-lived security cookie of its own when it challenges a request; we do not read it.
| Cookie | Purpose | Lifetime |
|---|---|---|
ds_session | Keeps you signed in. | 30 days |
ds_google_oauth, ds_meta_oauth, ds_gsc_oauth, ds_tiktok_oauth, ds_shopify_oauth | Holds the state value that checks a platform's sign-in callback came from the connection you started. Each is scoped to that platform's connect path. | 10 minutes, or until the connection finishes |
ds_shopify_pending | Holds a random reference to your encrypted Shopify installation handoff while you sign in and confirm which account to connect. | 30 minutes, or until the connection is confirmed |
ds_shopify_browser | Binds Shopify authorization and the installation handoff to the browser where you started, so another browser cannot claim it. | Up to 40 minutes, or until the connection is confirmed |
This section is our cookie policy. Nothing in it applies to the tag on a customer's site, which is covered above.
Customer accounts
For people who sign up, we store an email address, a password hash, and the sites they have access to. Passwords are hashed with scrypt and are never stored or logged in a readable form. Session tokens are stored as verifiers, so a copy of our database does not let anyone sign in as you.
When you connect an advertising or store account, we store the non-secret identifiers needed to call that platform, such as an ad account number. Access credentials are stored encrypted, with a key that lives only in server configuration, and secrets are never written to logs.
Where the data lives
The service runs on infrastructure in the United States, and data is stored there. If you use DataStated from outside the United States, your data is transferred there to run the service. We do not currently offer regional hosting.
Who else sees the data
Our hosting and database providers process data on our behalf in order to run the service. When you connect a platform such as Google Ads, Meta, Shopify or Stripe, we read data from that platform at your instruction; we do not send your visitor data to them. The small number of people who operate DataStated can access data when running the service or helping you requires it, and for no other reason.
We disclose data otherwise only when the law requires it, and we do not sell it under any circumstances.
When a customer enables summary or alert emails, the email provider processes their contents and recipient addresses. Order and goal alerts can include an event's amount or goal name, time, source and daily count. Weekly summaries contain aggregate analytics.
How long it is kept
The plan's history window is three years through 200,000 events a month, including the trial, and five years from 500,000 events up. The nightly sweep removes older visit, goal and order events, imported history, daily rollups, crawler hits, Search Console history, annotations, alert-send records and supporting Stripe invoice, checkout-claim and webhook-receipt history.
Some records remain to support data still in use: visitor identities referenced by retained records or ongoing subscriptions, subscription identities still needed for matching or MRR, and the latest MRR observation at or before the cutoff for each retained subscription. Newer observations remain within the window. The crawler usage counter for the month containing the cutoff is also kept, so that month's allowance remains accurate. Ad-platform spend, financial ledgers and reports remain while the site has access.
When every owner's access has ended, recording stops after 30 days. After another 60 days, 90 days from the last access end, the nightly sweep removes all of the site's analytics, including crawler and search history, Stripe supporting records, subscriptions and MRR observations, annotations, alert-send records, ad spend, financial ledgers and reports. Account records, site settings, memberships and connection configuration remain; this is not account deletion. Contact us to request earlier deletion.
Your choices
- Customers. Delete your account yourself from the account page, or email us to get a copy of your data.
- Visitors. Contact the site you visited about access or deletion, since it controls the data. Deleting
_dsvresets that browser's cookie identifier but does not delete stored history. If the site later callsidentifywith the same user id, the new identifier can be joined to the earlier history. Blocking the tag stops requests only while the block is effective. The tag honours Global Privacy Control and Do Not Track: when either signal is present, it sets no visitor cookie and sends no measurement requests.
Depending on where you live you may have rights to access, correct, delete, or port your data, and to object to its processing. Ask and we will act on it.
Children
DataStated is a business tool and is not directed at children. We do not knowingly collect data from anyone under 13.
Changes
If this policy changes in a way that affects what is collected, the date at the top changes and account holders are emailed. We do not make quiet changes to this page.
Questions about this privacy policy? Email us at legal@datastated.com.