Visitor Privacy Notice
This notice applies to you if you visited a website that uses the Altias analytics snippet. It explains what data is collected about your visit, by whom, and why.
Last updated
Who is responsible for your data
The website owner (the operator of the site you visited) is the data controller — they decide to use Altias and are responsible for disclosing this in their own privacy policy.
Altias acts as the data processor. We process analytics data on behalf of the website owner and are bound by a Data Processing Agreement that restricts how we may use it.
If you have questions about how a specific website uses your data, contact that website's owner directly. If you have questions about Altias's role as a processor, contact us at privacy@altias.app.
What is recorded about your visit
When you load a page on a site using the Altias snippet, our server receives and stores the following:
Page URL
The path of the page you visited (e.g. /blog/article). Never includes query strings that might contain personal data.
Referrer
The website you came from, if your browser sent one (e.g. google.com). This is a standard browser header.
Country
Your approximate country, derived from your IP address in memory at request time. Your IP address itself is never stored.
Anonymised visitor ID
A one-way hash computed from your IP + browser user-agent + the current date + the site's ID. It resets every midnight and cannot be reversed to identify you.
Anonymised session ID
A one-way hash computed from your IP + browser user-agent + the site's ID. Used to count unique visitors. Cannot be reversed.
Timestamp
The UTC time of the pageview, accurate to the second.
What we never collect
The following data is never collected, stored, or processed by Altias under any circumstances:
Legal basis for processing
Because Altias does not collect personal data as defined under GDPR, the strict requirements of GDPR do not apply to the tracking script itself. No consent is required.
To the extent any data processing falls within scope (e.g. the temporary processing of IP addresses in memory), the legal basis is legitimate interest (GDPR Art. 6(1)(f)) — specifically, providing the website owner with aggregate, anonymised traffic analytics. This interest is balanced against your rights and does not override them, given the privacy-by-design approach taken.
Because Altias sets no cookies and collects no personal data, website owners using Altias do not need to display a cookie consent banner under GDPR, ePrivacy, CCPA, or PECR.
Retention & deletion
Pageview records are retained as long as the website owner keeps their site registered with Altias. Records contain no personal identifiers — they are aggregate traffic data linked to a site ID.
When a website owner deletes their site from Altias, all associated pageview records are permanently and immediately deleted. There is no way to link a specific person to a stored record, and therefore no mechanism to delete records for an individual visitor (there is nothing to link them to).
Infrastructure & sub-processors
Altias runs on the following infrastructure providers. Each has its own privacy and security certifications.
Vercel
vercel.com/legal/privacy-policyHosting & edge network. Handles incoming tracking requests. May retain server access logs briefly per their data retention policy.
Supabase
supabase.com/privacyDatabase storage. Stores the anonymised pageview records described in section 02. Hosted on AWS.
Questions & contact
For questions about this notice or Altias's role as a data processor, contact us directly. For questions about how a specific website uses analytics data, contact that website's operator.
Altias privacy team
privacy@altias.app