Privacy Policy

MetricTrail is a product analytics platform (SaaS) provided to businesses ("Customers") to instrument their own sites and apps. For Visitor Data, the Customer is the data controller and MetricTrail acts as processor, handling data on the Customer's behalf and instruction. For Account Data (the workspace administrator's name, email, billing details), MetricTrail acts as controller.

When a Customer installs our SDK or script tag on their site, we collect:

• Anonymous identifiers, and — only when the Customer calls identify() — a stable identifier the Customer chooses (e.g. a user ID or email).
• Product events: page views, clicks, Web Vitals, runtime errors, and custom events the Customer defines, including whatever properties the Customer chooses to attach.
• Technical context derived automatically: operating system, browser, device type, and screen resolution (from the User-Agent and properties the SDK reports), and approximate location (country/region/city) derived from the IP address via Cloudflare edge headers — we never store the raw IP address.
• Acquisition context: referrer and UTM parameters of the page where the event fired.

From the workspace administrator: name, email, password (stored hashed), timezone, and billing details processed by our payments partner (we do not store card numbers).

We process Visitor Data on the basis of the Customer's legitimate interest in understanding usage of their own product, and Account Data on the basis of performing our service contract. We do not sell data to third parties or use it for advertising.

Each Customer configures their project's event retention window (default 90 days, adjustable in Settings). Data past that window is deleted automatically. Account Data is kept for as long as the workspace exists.

The MetricTrail dashboard uses a strictly-necessary session cookie (__Host-) for authentication. The tracking SDK, when configured with storage: "local", uses localStorage on the Customer's site to persist the offline event queue and active session — this is optional and controlled by the Customer, not by MetricTrail.

• Cloudflare — CDN, edge network, and dashboard hosting.
• Our infrastructure provider — database and API hosting.
• Dodo Payments — subscription billing processing.
• Google Gemini — only for optional AI features (insights, copilot); aggregated, non-identifying telemetry is sent only when the Customer uses those features.

Data subjects in Brazil (LGPD) and the European Economic Area (GDPR) have the right to access, correct, port, and request deletion of their data. Workspace administrators can export or delete all data in their workspace at any time under Settings → Danger Zone. Visitors of a Customer's site should contact that Customer directly, as they are the data controller; you may also contact us and we will forward the request.

Data in transit is protected by TLS. Passwords are stored hashed. Project write keys are low-privilege (ingestion only) and can be rotated at any time.

Our infrastructure and sub-processors may operate outside the Customer's country. By using MetricTrail, the Customer acknowledges this transfer, carried out under our sub-processors' contractual safeguards.

MetricTrail is not directed at children and we do not knowingly collect data from anyone under 13.

We may update this policy from time to time. Material changes will be communicated by email to workspace administrators.

Privacy questions: contact@metrictrail.io