Privacy policy

Last updated: 2 May 2026 · Effective version: v1.2

Glinto (“we”, “us”) is a web analytics platform that does not collect personal data. This page explains exactly what happens when a visitor opens a website that uses Glinto, and why none of the data we store qualifies as personal data under Article 4(1) of the GDPR.

1. Who is this policy for?

This policy applies to two groups:

• Visitors to any website that has embedded the Glinto pixel.
• Customers who sign up at glinto.eu to analyse traffic to their own sites. A separate Data Processing Agreement applies when you sign up; this policy governs what we do with your data as a customer.

2. What we collect from visitors

When a visitor opens a page with the Glinto pixel, their browser sends us a single HTTP POST request containing:

• The path of the page (e.g. /pricing).
• The referrer URL, if the browser sends one.
• The viewport width (a number like 1920).
• The browser’s reported User-Agent string.
• An ephemeral visitor hash — see §4. This is computed at the edge and is not transmitted by the browser.

We do not collect names, emails, phone numbers, billing details, fingerprint hashes, device IDs, advertising IDs, or any form of cross-site identifier.

3. What we never store

• Raw IP addresses. They are seen once by the ingest Worker and hashed immediately; the raw value is never written to disk or logs.
• Cookies of any kind.
• LocalStorage entries.
• Personally identifiable information from form fields, query strings or URL fragments.

4. The visitor hash

To estimate unique visitors we compute a SHA-256 hash of(ip + user-agent + daily-rotating-salt). The salt rotates at 00:00 UTC every day and is never persisted. This means:

• The same visitor returning tomorrow produces a different hash.
• Cross-day stitching is physically impossible, even for us.
• The hash meets the GDPR Article 4(5) test for pseudonymisation, and the European Data Protection Board’s guidance on technical measures that render re-identification “means reasonably likely” to be not likely.

5. Where your data lives

Our D1 database is jurisdictionally locked to the European Union (WEUR). No personal data (IP addresses, cookies, device identifiers) is ever stored — visitor hashes are irreversible and rotate daily, making re-identification impossible.

Analytics Engine event data (page views, web vitals, click coordinates) is processed on Cloudflare’s global edge network. Because none of this data constitutes personal data under GDPR Article 4(1), no restricted transfer obligations apply. Event data is retained for 90 days and queried only by our dashboard Workers.

What we can guarantee: all data at rest (D1 database, configuration, account data) is stored exclusively in the EU. What we cannot guarantee without Cloudflare Enterprise: that the Worker processing an inbound request executes in an EU data centre — when a visitor connects from outside Europe, the nearest Cloudflare edge may be non-EU. In practice, for European websites with European visitors, the Worker runs in the EU in the vast majority of cases.

We use three sub-processors (Cloudflare, Stripe, and Brevo). The full list, including their roles, data residency, and links to their DPAs, is published at /subprocessors.

6. How long we keep data

• Per-event analytics: 90 days in Analytics Engine.
• Weekly AI summaries: 12 months in D1.
• Site configuration and your account: until you delete them.
• Backups: last 30 days, then shredded.

7. Your rights

Because visitor hashes cannot be reversed to identify a person, most GDPR rights (access, rectification, erasure, portability) do not apply to visitor data — there is no identifiable subject to apply them to. Customers can always export or delete their account data from the dashboard.

If you believe a Glinto customer is processing your personal data in violation of the GDPR, contact us at dpo@glinto.eu and we will investigate within 72 hours.

8. Security

• All traffic is TLS 1.3, enforced by Cloudflare.
• Admin and customer API tokens are stored as encrypted Cloudflare secrets.
• D1 is encrypted at rest by Cloudflare.
• We are committed to publishing a security.txt and a public SBOM on request.

9. Changes

If we materially change what we collect, we will publish a new version of this policy, bump the version number at the top, and notify customers by email at least 30 days before the change takes effect.

10. Contact

Questions? Email contact@glinto.eu. Data protection questions go to dpo@glinto.eu.