ezStats Privacy Policy

This Privacy Policy explains how Cavendo Corporation ("ezStats," "we," "us," or "our") collects, uses, and protects information in connection with the ezStats website, applications, APIs, tracking code, and related services (the "Service").

ezStats was built to be privacy-first. Our analytics operate without cookies, without cross-site tracking, and without collecting personal data about the visitors of the websites we measure.

1. Two Roles: Controller and Processor

We handle information in two distinct capacities:

1. Our customers (data controller). When you create an ezStats account, subscribe to a plan, or contact us, we act as the data controller for your account and billing information.

2. Visitors to our customers' websites (data processor / service provider). When our tracking code runs on a customer's website, we process analytics data on behalf of that customer. Our system is designed so that this data does not identify individual visitors. If you have questions about a specific website's data practices, contact the operator of that website.

2. Information We Collect from Customers

When you use the Service as a customer, we collect:

• Account information: name, email address, company name, and password (stored in hashed form)
• Billing information: plan, billing address, and payment details, which are processed by our payment processors. We do not store full payment card numbers.
• Configuration data: websites you add, goals, keywords, competitors, alerts, report settings, and team member invitations
• Communications: messages you send to support and responses to surveys
• Service usage data: log data such as login timestamps, dashboard activity, feature usage, IP address, and browser type, used for security, troubleshooting, and product improvement
• Integration data: if you connect a third-party service such as Google Search Console, we receive the data you authorize that service to share (for example, search queries, clicks, and impressions for your site)

3. Visitor Analytics Data We Process for Customers

Our tracking code is designed to measure website usage without identifying individual people:

• No cookies. We do not set cookies or use similar identifiers in browsers for analytics tracking.
• No personal data stored about visitors. We do not store names, email addresses, precise locations, or persistent identifiers of website visitors.
• IP addresses are not stored. Visitor IP addresses are used transiently at the time of collection (for example, to derive coarse geographic region, filter bots, and, where the company identification feature is enabled, to match a visit to a company or organization) and are then discarded. They are not written to our analytics database.
• What we do record: aggregated and event-level analytics such as pages viewed, referring source, UTM parameters, browser and device type, screen size, country or region, visit duration, click and scroll behavior for heatmaps, and goal completions. This data is not linked to an identified or identifiable individual.
• Company identification: for customers using this feature, we associate visits with companies or organizations (firmographic data such as company name, industry, and size). This feature identifies organizations, not individual people.
• Bot filtering: we analyze traffic patterns to exclude bots and automated traffic from reports.

4. How We Use Information

We use customer information to:

• Provide, operate, maintain, and secure the Service
• Process payments and manage subscriptions
• Send transactional communications, such as receipts, alerts, scheduled analytics reports, and service announcements
• Provide customer support
• Send product updates and marketing communications, which you can opt out of at any time
• Monitor, analyze, and improve the Service, including developing new features
• Detect, prevent, and investigate fraud, abuse, and security incidents
• Comply with legal obligations

We use visitor analytics data only to provide the Service to the customer whose website generated it, and to maintain the security and integrity of the Service.

AI features. Some features use artificial intelligence to generate insights and recommendations from your analytics data. Your data is not used to train generalized AI models for other customers.

No selling of data. We do not sell personal information or visitor analytics data, and we do not use analytics data for advertising or share it with ad networks or data brokers.

5. Legal Bases for Processing (GDPR/UK GDPR)

Where European data protection law applies, we rely on the following legal bases:

• Contract: to provide the Service you signed up for
• Legitimate interests: to secure and improve the Service, prevent abuse, and, for our cookieless visitor analytics, to measure aggregate website usage in a manner designed to minimize any privacy impact (Article 6(1)(f))
• Consent: for optional marketing communications, which you may withdraw at any time
• Legal obligation: to comply with accounting, tax, and other legal requirements

6. How We Share Information

We share information only with:

• Service providers that help us operate the Service, such as cloud hosting, payment processing, email delivery, and customer support tools, under contracts that restrict their use of the data
• Integration partners you choose to connect, such as Google Search Console, as directed by you
• Professional advisors such as auditors and lawyers, where necessary
• Authorities when required by law, subpoena, or legal process, or to protect the rights, safety, or property of ezStats, our customers, or others
• A successor entity in connection with a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy

Agency and white-label customers may share dashboards and reports with their own clients; that sharing is controlled by the customer, not by ezStats.

7. Data Residency and International Transfers

Customer analytics data is stored based on region: data for EU customers is stored on servers located in the EU, and data for US customers is stored on servers located in the US. Where personal data is transferred across borders, we use appropriate safeguards such as Standard Contractual Clauses where required.

8. Data Retention

• Analytics data: retained according to the retention period of your plan, or until you delete a website or your account
• Account and billing records: retained for the life of your account and afterward as required for legal, tax, and accounting purposes
• Support communications: retained as needed to provide support and improve the Service

When you close your account, we delete or anonymize your analytics data within a reasonable period, except where retention is required by law.

9. Security

We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit, access controls, and monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and regulators as required by applicable law.

10. Your Rights and Choices

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Delete your personal data
• Export your data in a portable format
• Object to or restrict certain processing
• Withdraw consent where processing is based on consent
• Opt out of marketing emails using the unsubscribe link or your account settings

To exercise these rights, email [email protected]. We will respond within the timeframe required by applicable law. We will not discriminate against you for exercising your rights. If you are in the EU, UK, or a similar jurisdiction, you also have the right to lodge a complaint with your local supervisory authority.

US state privacy laws. Residents of California, Virginia, Colorado, and other states with comprehensive privacy laws may exercise the rights above. We do not sell personal information or share it for cross-context behavioral advertising as defined by those laws.

Website visitors. Because our analytics do not store personal data about visitors, we generally cannot locate any record tied to an individual visitor. Requests concerning a specific website should be directed to that website's operator.

11. Cookies on ezStats Properties

Our analytics tracking code does not use cookies on customer websites. On our own website and application (ezstats.io), we use only essential cookies needed for functions such as login sessions and security. We use our own product, ezStats, to measure traffic on our website, which operates without cookies.

12. Children's Privacy

The Service is not directed to children under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us at [email protected] and we will delete it.

13. Data Processing Addendum

For customers that require a GDPR Article 28 data processing agreement, our Data Processing Addendum is available for eligible plans. Contact [email protected] to request one.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service before the changes take effect. The effective date at the top of this page indicates when the policy was last revised.

15. Contact Us

For privacy questions or requests: