Security & data
What we keep, where, and who can see it.
A tracking script sits on your site and handles your visitors’ data, so you should know how it works. This is the short version. The binding one is in Annex 2 of the DPA.
-
Where data is stored
- Data is stored in the EU. The database runs on Supabase in AWS eu-west-1 (Ireland).
- The event log, the retry buffer and counts live in Cloudflare Durable Objects with EU jurisdiction.
- A visitor’s request is handled at the Cloudflare location nearest to them, which can be outside the EEA. Aggregate counters in Cloudflare Analytics Engine are not limited to the EU.
-
What happens to visitor data
- Email and phone are hashed with SHA-256 in the visitor’s browser, separately for each platform, before they leave the page. Purchases from Stripe arrive in clear from Stripe and are hashed on our servers, in memory.
- The event log holds no contact details and no IP addresses, only the names of the matching fields sent, the page path, and custom data with emails and phone numbers masked.
- IP addresses and user agents are passed to the platforms and not stored, with two exceptions: the retry buffer, for at most 12 hours, and a visitor leaving for Stripe with consent, for up to 7 days.
- Without consent, nothing that was declined goes out. Our servers enforce the EEA, UK and Swiss rule again by country.
-
Your access tokens
- Access tokens, API keys and Stripe signing secrets are encrypted with AES-256-GCM, on top of the encryption at rest our providers apply. The key is kept only in the server’s secrets.
- They sit in separate tables that browsers have no rights on. The API never returns a token, only whether one is present.
- Tokens go to the platforms only over HTTPS, and our code does not write them to logs or error messages.
-
Who can reach what
- You sign in with Google or an email code. Every request checks that the site belongs to your account or that you were invited to it, with row-level security on the database.
- Team roles: Owner, Editor and Viewer. Personal tokens for AI assistants act with your role, are stored only as a hash and can be revoked at any time.
- One person holds administrator access to our providers, with two-factor authentication.
-
Your data stays yours
- You can delete a site or your account yourself, in the dashboard, and download your data as a file.
- The event log keeps 30 days, or 90 on the 10-site plan.
- Our Data Processing Agreement covers the visitor data we process for you, and the list of sub-processors is public.
-
What we do not have
- We have no SOC 2 or ISO 27001 certificate of our own.
- There is no SLA.
- If your company needs a vendor with those papers, ask us before you buy.
Found something?
Write to hello@pixelary.app. Reports are read by the person who can fix the problem.
Stop losing conversions you already paid for.
Free browser pixel today. Try server-side free for 14 days when you are ready.