Privacy Policy

Last updated: November 2, 2026

At a glance

Stored in Germany Customer data, visitor data and backups never leave the EU. One first-party cookie Tracked sites get a single _cc_vid cookie, no third-party cookies. No IP addresses kept Used for the country lookup and a bot check, then deleted within 24 hours. Answers within 30 days Email info@corbata.nl to exercise your rights - see section 9.

CorbaCount is operated by Corbata, registered in the Netherlands. This document explains, in plain language, what data we collect, why we collect it, where it lives, and what rights you have over it under the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

1. Two kinds of users

CorbaCount has two groups of users whose data we handle differently:

Customers - people who sign up for an account to track their own websites.
Visitors of customer websites - the people whose pageviews CorbaCount counts on behalf of our customers.

For visitors of customer websites we act as a data processor on behalf of our customer (the data controller). For our own customers we are the data controller.

2. Customer data we collect

When you create an account and use CorbaCount, we store:

Your name and email address.
Your password, as a bcrypt hash - we never see or store the plaintext.
Your two-factor secret, backup codes and passkey credentials, if you enable them.
Your sites, goals, funnels, notification preferences and dashboard settings.
Hashes of the API tokens you create for the mobile apps or MCP, never the tokens themselves.
When you subscribe: your billing name, company name, address, VAT number and billing email, plus a record of each payment (amount, VAT and status). Card and bank details are entered at Mollie; we never see them.
When you connect Google Search Console: the access tokens Google gives us for that property.

We do not log your IP address or browser user agent when you sign up or log in.

When you join the waitlist or use the contact form, we store what you enter (email address, and for the contact form your name, subject and message) together with your IP address, browser user agent and the page you came from, to filter out spam and abuse.

3. Visitor data we collect for our customers

When you embed the CorbaCount tracker on your site, for each pageview we receive and store:

Page URL and page title.
Referrer URL.
UTM tags (source, medium, campaign, term, content), when present in the URL.
Browser and version, operating system and version, and device type, derived from the user-agent string. The user-agent string itself is not stored.
Screen resolution, preferred language and, for apps, the app version.
Country and network operator (ASN, for example the name of an internet provider), derived from the IP address.
A first-party visitor identifier (_cc_vid cookie) and a device hash: timezone, language, screen size, colour depth, platform and CPU core count, hashed together in the browser. The device hash recognises returning visitors when the cookie is missing.
Core Web Vitals (LCP, INP, CLS) for the page, where the browser reports them.
Goal conversions and file downloads, when the customer sets them up. If the customer passes their own reference with a goal (for example an order number), we store that reference to avoid counting the same conversion twice.

IP addresses are used while the pageview is processed, to look up the country and network in MaxMind databases on our own servers. They are not stored with the pageview - not even as a hash. For a visitor's first pageview in a session, the IP address is placed in a short queue for a reverse-DNS check that detects traffic from datacenters. Each entry is deleted right after that check, normally within minutes and never later than 24 hours. When the check shows datacenter traffic, the pageview is marked as a bot and the hostname is kept with that bot pageview (see section 8).

We do not collect: precise location, email addresses, names, mouse movements, scroll heatmaps, form contents or cross-site identifiers.

4. Why we use the data

Customer data: to provide the service - log you in, send important account emails, recover access if you forget your password.
Billing data: to take payments and issue invoices, which Dutch tax law requires us to keep.
Waitlist and contact data: to answer you, tell you when we launch, and keep spam out.
Visitor data: to compute the analytics dashboards our customers see (traffic counts, source attribution, country distribution, performance metrics, goals) and to keep bot traffic out of those numbers.
Aggregated metrics: we may use anonymous aggregate counters (e.g. "X million pageviews processed today") for our own operations and marketing.

5. Where your data lives

All data - customer data, visitor data, backups - is stored on servers physically located in Germany, inside the European Union. Germany applies both the GDPR and the German Federal Data Protection Act (BDSG), which together form one of the strictest data protection regimes in the world. Your data never leaves the EU.

6. Sub-processors

To operate the service we use the following sub-processors and data sources:

Sub-processor	What it does
MaxMindGeoLite2 databases, used locally	Translates IP addresses into a country and network operator. The databases are downloaded to our servers; no per-visitor lookup goes to MaxMind.
Pusherreal-time channels, EU cluster	Pushes live pageviews to logged-in customer dashboards: the internal visitor number, page URL and title, country, browser, OS, device type and referring domain. No IP address.
Molliepayments, the Netherlands	Handles subscription payments. You enter your card or bank details at Mollie; we receive the payment status and amount.
Total Invoiceinvoicing, the Netherlands	Creates and sends invoices for paid subscriptions, using your billing details.
Cloudflare Turnstilespam check on the contact form	Checks that a person, not a bot, sends the contact form. Your browser loads the check from Cloudflare, which receives your IP address and browser signals for that purpose.
DataForSEOSEO data provider	When a customer enables SEO features, we send only the customer's own domain name (no visitor data) to retrieve backlinks, anchors and ranked keywords.
OpenPageRank and RDAP registries	We send only the customer's domain name, to retrieve its PageRank and its registration and expiry dates.
Google Search Console	When a customer connects their Search Console property, Google sends us aggregated query stats for that property. Visitor data is never sent to Google.

Account emails (password resets, alerts, invoices and digests) are sent from Corbata's own mail server. We will update this list before adding any new sub-processor that has access to personal data.

7. Cookies and similar storage

On websites that embed the CorbaCount tracker, the tracker sets a single first-party cookie called _cc_vid. It contains a random UUID, expires after 365 days, is marked SameSite=Lax, and belongs to the customer's own domain. It is used solely to recognise returning visitors and stitch the same visitor's pageviews into one session.

On the CorbaCount website itself we use a session cookie to keep you logged in and, if you tick "remember me", a remember-me cookie that lasts 30 days. Your dark/light theme choice is kept in your browser's local storage. We do not use third-party advertising or tracking cookies anywhere.

8. How long we keep your data

Data	How long we keep it
Pageviews, sessions and visitor records	As long as the site is in the customer's account. Deleting the site or the account deletes them.
Pageviews and sessions recognised as bots	30 days. After that only the daily bot counts remain.
Visitor IP addresses	Only in the bot-check queue, deleted right after the check - normally within minutes and never later than 24 hours.
Live visitor list	5 minutes.
Aggregated stats (daily, hourly, per-page, per-country, per-browser etc.)	As long as the site is in the customer's account.
Customer account data	Until you delete your account. You can do that yourself on your profile page; the account, its sites and all their statistics are deleted immediately and permanently.
Invoices	7 years, as required by Dutch tax law. They stay after the account is deleted.
Waitlist sign-ups and contact messages	Until you ask us to remove them.

9. Your rights

Under the GDPR you have the right to:

Access the personal data we hold about you.
Have inaccurate data corrected.
Have your data deleted ("right to be forgotten").
Receive an export of your data in a portable format.
Restrict or object to processing.
Lodge a complaint with a supervisory authority - for example the Dutch Autoriteit Persoonsgegevens, or the German Bundesbeauftragte fur den Datenschutz und die Informationsfreiheit (BfDI) given where the data lives.

To exercise any of these rights, email info@corbata.nl. We will respond within 30 days.

10. Security

Customer passwords are stored as bcrypt hashes. The connection between your browser and CorbaCount is encrypted with TLS. We support two-factor authentication and passkeys. Backups are encrypted at rest. Access to production data is limited to a small set of operators who are bound by confidentiality.

11. Children

CorbaCount is not intended for use by children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy. The "Last updated" date at the top always reflects the most recent revision. Material changes are announced by email to active customers at least 14 days before they take effect.

13. Contact

For any privacy question, data request or complaint: info@corbata.nl.

Back to home