This policy explains what personal data we collect when you use Ometra as a customer, why we collect it, and the choices you have. Separately, our Data Policy covers the analytics data our script collects from the visitors of sites that use Ometra.
Who we are
Ometra is a privacy-first, cookieless web analytics service operated by Ometra Analytics Inc. (“Ometra”, “we”, “us”), based in Ottawa, Ontario, Canada. For any privacy question you can reach us at [email protected].
Privacy Officer
Our Privacy Officer is accountable for our compliance with this policy and with Canadian privacy law, including PIPEDA and Quebec's Law 25, and is the person in charge of the protection of personal information. Contact: Privacy Officer, Ometra Analytics Inc., Ottawa, Ontario, Canada — [email protected].
Our approach
We built Ometra so that measuring a website doesn't require surveilling its visitors. We don't use tracking cookies, we don't build advertising profiles, and we never sell personal data. That principle applies to how we treat you, our customer, too.
Personal data we collect about you
Account data
When you create an account we collect your name, email address, and a securely hashed password, along with your workspace name and the team members you invite. We never store passwords in plain text.
Billing data
Payments are processed by Stripe, our reseller and merchant of record. Stripe handles your card details directly — we never see or store your full payment information. We retain billing metadata such as your subscription status and plan.
Using our app
When you are signed in to the Ometra dashboard we set a single essential cookie to keep you logged in. This is a security/session cookie, not a tracking cookie, and it is required for the app to work. Our marketing website sets no cookies at all; it only remembers your light/dark theme choice in your browser's local storage. We measure our own website with Ometra, under the same rules as our Data Policy.
Forms you send us
When you join the waitlist, contact us, or apply to the partner program, we collect what you enter — such as your name, email address, company, website, and message — and use it only to respond to that request. If you sign up with a referral code, we record which partner referred you so we can pay their commission.
Integrations and settings
If you connect integrations or use developer features, we store what they need to work: for example, a Webflow site API token, deploy secrets, API keys, and the release details you send us (commit, label, environment). We use them only to provide those features, and you can disconnect or rotate them at any time.
Communications and support
If you email us or contact support, we keep that correspondence so we can help you and improve the service.
Server logs
Like any web service, our servers process technical information (such as IP addresses) transiently to route requests and protect against abuse.
Website-visitor data
The analytics data we collect from visitors of sites that use Ometra is governed by our Data Policy. For that data, our customer is the controller and we are the processor — see our Data Processing Agreement.
How we use your data
- To provide, maintain, and secure the service
- To process billing and manage your subscription
- To respond to support requests and send essential service notices
- To send emails about your own sites and usage — weekly reports, usage-limit alerts, and the insight emails you choose
- To pay partner commissions on referred accounts
- To prevent fraud and abuse, and to comply with legal obligations
We don't use your personal data for advertising, we don't sell or “share” it as those terms are defined under California privacy law, and we don't make automated decisions about you that have legal or similarly significant effects.
Emails
We send service emails you need — account, security, and billing notices, weekly reports, and usage alerts — as part of providing the service. Insight emails can be turned off per site. We send commercial or promotional emails only where Canada's Anti-Spam Legislation and other applicable laws allow, and every such email includes a way to unsubscribe.
Legal bases (GDPR)
Where the GDPR applies, we rely on: performance of our contract with you (to provide the service and billing); our legitimate interests (to secure and improve the service); your consent (for optional communications, which you can withdraw); and legal obligation.
Service providers we rely on
We share the minimum data necessary with a small set of sub-processors:
- DigitalOcean — cloud hosting, database, and object storage (Canadian region)
- Stripe — payments, subscription billing, and tax (United States)
- Resend — sending transactional and report emails (United States)
- ScreenshotOne — capturing screenshots of your public pages for heatmap backdrops, only when you enable that feature
- Anthropic — writing the plain-English AI insights summary, only when you enable AI insights (Agency plan). Only aggregate, non-personal findings are sent — never visitor-level data — and Anthropic does not use API inputs to train its models
A current list is maintained in our DPA. We do not sell your data or share it with advertising networks.
Data retention
We keep your account data for as long as your account is active. When you delete your workspace, it is removed immediately, and backups roll off on their normal schedule. If you only cancel a paid plan, your account continues on the free plan until you delete it. Billing and tax records are kept as long as tax law requires (generally six years in Canada), and form submissions are kept only as long as needed to handle your request. Analytics data is retained according to your plan (12, 24, or 36 months, or a custom period on Enterprise), after which older raw data is automatically pruned.
International transfers
Your analytics data is stored in Canada, which the European Commission recognizes as providing an adequate level of data protection for commercial organizations. Some of the service providers listed above are located in the United States; where personal data reaches them, we rely on appropriate safeguards such as Standard Contractual Clauses.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent.
Two of these are self-serve from your account: workspace owners can export all of their data as a JSON file and permanently delete their workspace (and their account) at any time under Settings → Account. For anything else — or if you can't access your account — email [email protected]. You also have the right to complain to your local data protection authority (in Canada, the Office of the Privacy Commissioner).
If something goes wrong
If a breach of security safeguards involving your personal information creates a real risk of significant harm, we will notify you and the relevant regulators as required by law, and keep a record of the incident.
Security
We protect data with encryption in transit (HTTPS), encryption at rest on our managed infrastructure, hashed passwords, and role-based access controls that limit who can see what. No system is perfectly secure, but we work to protect your data and to minimize how much of it exists in the first place.
Children
Ometra is a business service and is not intended for anyone under 18. We do not knowingly collect personal data from children.
Changes to this policy
We may update this policy from time to time. We'll post the new version here and update the date above; material changes will be communicated to account holders.
Contact
Questions about this policy? Email [email protected].