Privacy
DataStated measures traffic for the people who own the websites it runs on. It is not an advertising network and it does not build profiles of people across the internet. This page says exactly what is collected and what is not.
Who this covers
DataStated is operated by KAMKR LLC. There are two groups of people in this document, and they are treated differently:
- Customers. People with a DataStated account who measure their own websites.
- Visitors. People who visit a website that has the DataStated tag installed. Visitors have no account and never interact with us directly.
For visitor data, the customer who owns the site is the controller and DataStated is the processor. We hold that data on their behalf and do not use it for our own purposes.
What the tag records about a visitor
The tag is one small JavaScript file served from our own domain. On each page view it sends:
- The hostname and path of the page
- The referring URL, when the browser supplies one
- Campaign tags on the link (
utm_source,utm_medium,utm_campaign) - An advertising click identifier when present (
fbclid,gclid,ttclid,msclkid) - Viewport width and the browser language setting
- A random visitor identifier from a first-party cookie (see below)
- For a completed order or a goal, the name, amount and currency the site chooses to send
What is never collected
- No names, emails, addresses or phone numbers. The tag has no way to send them. It reads the page URL and the referrer, never form fields or page content.
- No raw IP addresses. See below.
- No cross-site tracking. The cookie is first-party, so it exists separately on each site and cannot be read by any other site. There is no shared identifier that links a person between two DataStated customers.
- No keystrokes, no session recording, no heatmaps, no screen capture.
- No data sold, rented, or shared with advertisers. We do not sell personal information and we do not operate an ad network.
How IP addresses are handled
A visitor's IP address is used and discarded within the same request. It is never written to disk. What is stored is a one-way hash, salted with a secret that changes every day, so the same visitor produces a different value tomorrow than today. That means the stored value cannot be reversed into an address, and cannot be used to follow anyone across days.
If the salt is not configured, the server refuses to accept events rather than fall back to a weaker one. It fails closed on purpose.
A two-letter country code is recorded, taken from a header our hosting network adds. No city, no region, no coordinates, and no IP lookup database.
The cookie
One first-party cookie, _dsv. It holds a random value with no meaning outside the site that set it, generated in the browser and never derived from anything about the person. It lasts 13 months, is set with SameSite=Lax, and is marked Secure on HTTPS pages. Its only job is to tell a returning visit from a new one on that one site.
There are no other cookies, no local storage, no session storage, and no fingerprinting. Deleting the cookie makes the next visit count as a new visitor.
Customer accounts
For people who sign up, we store an email address, a password hash, and the sites they have access to. Passwords are hashed with scrypt and are never stored or logged in a readable form. Session tokens are stored as verifiers, so a copy of our database does not let anyone sign in as you.
When you connect an advertising or store account, we store the non-secret identifiers needed to call that platform, such as an ad account number. Access credentials are held as references to server configuration rather than written into the database, and secrets are never written to logs.
Who else sees the data
Our hosting and database providers process data on our behalf in order to run the service. When you connect a platform such as Google Ads, Meta, Shopify or Stripe, we read data from that platform at your instruction; we do not send your visitor data to them.
We disclose data otherwise only when the law requires it, and we do not sell it under any circumstances.
How long it is kept
Plainly: there is no automatic deletion yet. Data stays until it is deleted on request or the account is closed. An automatic retention limit is planned, and this page will say what it is when it exists rather than before.
Your choices
- Customers. Email us to get a copy of your data or to have your account and its data deleted.
- Visitors. Contact the site you visited, since they control their own data. Deleting the
_dsvcookie, or blocking the tag with any content blocker, stops the association with your previous visits. We honour Global Privacy Control and Do Not Track: when a visitor's browser sends either signal, the pixel does not set its cookie and records nothing.
Depending on where you live you may have rights to access, correct, delete, or port your data, and to object to its processing. Ask and we will act on it.
Children
DataStated is a business tool and is not directed at children. We do not knowingly collect data from anyone under 13.
Changes
If this policy changes in a way that affects what is collected, the date at the top changes and account holders are emailed. We do not make quiet changes to this page.
Contact
KAMKR LLC, by email at [email protected].