Last updated: 2026-05-13
Plain-English summary: We collect what we need to run the service, store it securely, and never sell it. We share data only with the processors required to make A/B Test work (Stripe for billing, Cloudflare for hosting, transactional email providers). You can export or delete your data at any time.
To create your account: name, email, password (hashed with argon2id), country. To process billing: card details and address required by Stripe (held by Stripe, not us). To run the service: every site, experiment, goal, funnel, and configuration you create through A/B Test, plus the visitor data we collect on your behalf via the tracker.
Automatically collected: IP address, browser user agent, pages visited, timestamps. Used for security (rate limiting, fraud detection) and product analytics (which pages get used). Retained for 90 days unless tied to a specific audit-log event.
To run the service. To send you important account, security, and billing notifications. To offer support when you ask. To compute pooled-data benchmarks — in aggregate only, never identifying you to other users.
We do not: sell your data, use it to train AI models, share visitor data across customers, or run third-party ad networks on the dashboard.
We do not have advertising partners. We do not run trackers from Facebook, Google Ads, or LinkedIn on the dashboard.
Primary database: US-East (Virginia). Backups: encrypted at rest in a separate region. We're working on EU residency for European customers; contact privacy\.webanalyticsinc.com if this is required for your business.
Active account: as long as your account exists. Cancelled account: 90-day grace period for export, then purged. Transactional records (invoices, tax filings): 7 years per US tax law. Aggregated, anonymized analytics: indefinite (no longer tied to you).
You can: export all your data (Settings → Data export), delete your account and trigger purge, opt out of pooled-data analytics, request a copy of every audit-log entry tied to your account. EU/UK users have additional GDPR rights (access, rectification, erasure, portability, restriction, objection) — email privacy\.webanalyticsinc.com to exercise them.
Encryption in transit (TLS 1.3) and at rest (AES-256). Password hashing with argon2id. Optional 2FA (TOTP). Audit log on every admin action. Role-based access on team accounts. Regular penetration testing. SOC 2 Type II audit underway for 2026.
We use first-party session cookies to keep you signed in, remember your sidebar-collapsed preference, and prevent cross-site request forgery. We don't run third-party advertising cookies. The A/B Test tracker on your sites uses a small first-party cookie to attribute A/B-test bucketing per visitor — this is cleared when the test ends.
A/B Test is not for users under 16. If you believe a child has created an account, email privacy\.webanalyticsinc.com and we'll investigate within 7 days.
Privacy questions, data requests, GDPR requests: privacy\.webanalyticsinc.com. Security disclosures: security\.webanalyticsinc.com.
This Privacy Policy is a starting template. Before going live with paid customers (especially in the EU/UK), have it reviewed by a privacy attorney.