If you are evaluating us as a vendor, this page answers the questions your DPO will ask. No certifications we do not hold, no vague promises - just what we do, where the data sits, and who can touch it.
Per pageview we keep the page URL and title, the referrer, UTM tags, the derived country and network (ASN), browser, OS and device type, screen resolution, preferred language and Core Web Vitals. No IP address, not even a hash of it. That is it - the full list is in our privacy policy.
Used, then deleted
Set on the customer's own domain
_cc_vid cookie containing a random UUID, expiring after 365 daysMore on what that means for consent on our cookie banner page.
Everything - customer data, visitor data, backups - lives on servers physically located in Germany, inside the European Union. Germany applies both the GDPR and the German Federal Data Protection Act (BDSG), one of the strictest data protection regimes in the world. There is no US cloud region, no "EU-ish" CDN edge node, no exception.
Yes. For visitors of your website you are the data controller and CorbaCount acts as your data processor - that split is spelled out in the privacy policy. A data processing agreement covering this relationship, including the sub-processor list below, is available on request: ask via the contact page and we will send it over.
Every connection - from the tracking beacon on your site to the dashboard in your browser - is encrypted with TLS 1.3. Plain HTTP is not served.
Passwords are stored as salted bcrypt hashes - we never see the plaintext. Two-factor authentication and passkeys are supported on every account.
Backups are encrypted at rest and stored in Germany alongside the primary data, under the same EU-only rule.
Access to production data is limited to a small set of operators bound by confidentiality. CorbaCount is run by a small team - meet us on the about page - which means a short, auditable list of people who can touch your data.
This list is updated before any new sub-processor with access to personal data is added.
| Sub-processor | What for | What they receive |
|---|---|---|
| MaxMind | GeoLite2 database, used locally to translate IPs into country codes | Nothing per visitor - the database is downloaded to our servers |
| Pusher | Channels service that pushes real-time visitor events to logged-in customer dashboards | The anonymised visitor identifier and minimal pageview metadata |
| DataForSEO | SEO data: backlinks, anchors and ranked keywords | Only the customer's own domain name - no visitor data |
| Google Search Console | Search queries for a property the customer connects | Nothing - Google sends us aggregated stats; visitor data is never sent to Google |
| Mollie | Payment processing for subscriptions | Customer billing details - no visitor data |
| Total Invoice | Creating and sending invoices | Customer name, email and billing details - no visitor data |
Raw pageviews are rolled into pre-aggregated daily and hourly counts that the dashboard reads from. Retention per type of data:
| Data | Kept for |
|---|---|
| Real-time "who is online" entries | 5 minutes |
| Raw IPs waiting for the datacenter check | At most 24 hours |
| Raw pageviews and sessions flagged as bots | 30 days, after that only daily bot counts remain |
| Raw pageviews and aggregated stats | As long as the site is in your account - deleting a site deletes its data |
| Customer account data | Deleted immediately when you delete your account (invoices stay 7 years, as Dutch tax law requires) |
No, and we will not pretend otherwise. CorbaCount is a small pre-launch product, and a certification audit at this stage would be theatre. What we offer instead is radical transparency: this page, the privacy policy and the small amount of data we collect are all verifiable from the outside. If your procurement process strictly requires a certification, we are honestly not the right vendor yet.
If you believe you have found a vulnerability in CorbaCount, please tell us before telling anyone else. Send the details through the contact page - a real human reads it, and we will acknowledge your report within one business day.
Send them over - security and privacy questions get the same one business day reply as everything else.