Skip to main content

How Sealmetrics Protects User Privacy

Sealmetrics protects visitors by not collecting the data that would put them at risk in the first place. The protection is architectural rather than procedural: there is no personal data to secure, disclose, leak or hand over, because none is collected.

In practice that means four things:

  • Nothing is written to the visitor's device. No cookies, no localStorage, no sessionStorage, no fingerprinting. The session marker used to group hits within one visit is held in memory, expires with the visit, and cannot recognise a returning visitor.
  • No identifier is stored. No IP addresses in the analytics database (they are used in memory only for anti-abuse checks and site-configured exclusions), no user IDs, no device IDs, no cross-session or cross-device linking. The user agent is kept for anonymous device classification only — the raw string for 1 day, then only the derived browser/OS/device categories inside aggregates.
  • Data is minimised, then aged out. Event-level rows are purged after 1 day, hourly aggregates after 90 days, daily aggregates and conversions after 24 months. Retention is fixed for every plan and enforced by database TTLs.
  • Storage stays in the EU. All customer analytics data is stored and processed in Dublin, Ireland, encrypted in transit and at rest, under role-based access control.

Because visitor analytics data carries no identifier, a visitor access or deletion request cannot be matched to any record — there is nothing tied to an individual to produce or erase. Account data (your dashboard users: name, email, billing) is a different category and data subject rights apply to it in full; see Data Subject Rights (DSAR). A Data Processing Agreement is included and ready to sign at sealmetrics.com/dpa.

Sealmetrics holds no third-party security certification such as ISO 27001 or SOC 2, and no supervisory authority certifies analytics tools. What exists is our own compliance self-assessments against published criteria.