Privacy Policy

Who we are

Ometra is a privacy-first, cookieless web analytics service operated by Ometra Analytics (“Ometra”, “we”, “us”), based in Ontario, Canada. For any privacy question you can reach us at [email protected].

Our approach

We built Ometra so that measuring a website doesn't require surveilling its visitors. We don't use tracking cookies, we don't build advertising profiles, and we never sell personal data. That principle applies to how we treat you, our customer, too.

Personal data we collect about you

Account data

When you create an account we collect your name, email address, and a securely hashed password, along with your workspace name and the team members you invite. We never store passwords in plain text.

Billing data

Payments are processed by our Merchant of Record, Lemon Squeezy. They handle your card details directly — we never see or store your full payment information. We retain billing metadata such as your subscription status and plan.

Using our app

When you are signed in to the Ometra dashboard we set a single essential cookie to keep you logged in. This is a security/session cookie, not a tracking cookie, and it is required for the app to work. Our marketing website sets no cookies at all.

Communications and support

If you email us or contact support, we keep that correspondence so we can help you and improve the service.

Server logs

Like any web service, our servers process technical information (such as IP addresses) transiently to route requests and protect against abuse.

Website-visitor data

The analytics data we collect from visitors of sites that use Ometra is governed by our Data Policy. For that data, our customer is the controller and we are the processor — see our Data Processing Agreement.

How we use your data

• To provide, maintain, and secure the service
• To process billing and manage your subscription
• To respond to support requests and send essential service notices
• To send product or usage emails you've opted into (e.g. weekly reports and limit alerts)
• To comply with legal obligations

Legal bases (GDPR)

Where the GDPR applies, we rely on: performance of our contract with you (to provide the service and billing); our legitimate interests (to secure and improve the service); your consent (for optional communications, which you can withdraw); and legal obligation.

Service providers we rely on

We share the minimum data necessary with a small set of sub-processors:

• DigitalOcean — cloud hosting, database, and object storage (Canadian region)
• Lemon Squeezy — payments and subscription billing (Merchant of Record)
• Resend — sending transactional and report emails
• ScreenshotOne — capturing screenshots of your public pages for heatmap backdrops, only when you enable that feature

A current list is maintained in our DPA. We do not sell your data or share it with advertising networks.

Data retention

We keep your account data for as long as your account is active. If you cancel, we retain it for a short period to allow reactivation and to meet legal and accounting requirements, then delete it. Analytics data is retained according to your plan (12, 24, or 36 months, or a custom period on Enterprise), after which older raw data is automatically pruned.

International transfers

Your analytics data is stored in Canada, which the European Commission recognizes as providing an adequate level of data protection for commercial organizations. Some of the service providers listed above are located in the United States; where personal data reaches them, we rely on appropriate safeguards such as Standard Contractual Clauses.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent.

Two of these are self-serve from your account: workspace owners can export all of their data as a JSON file and permanently delete their workspace (and their account) at any time under Settings → Account. For anything else — or if you can't access your account — email [email protected]. You also have the right to complain to your local data protection authority (in Canada, the Office of the Privacy Commissioner).

Security

We protect data with encryption in transit (HTTPS), encryption at rest on our managed infrastructure, hashed passwords, and role-based access controls that limit who can see what. No system is perfectly secure, but we work to protect your data and to minimize how much of it exists in the first place.

Children

Ometra is not directed to children and is not intended for anyone under 16. We do not knowingly collect personal data from children.

Changes to this policy

We may update this policy from time to time. We'll post the new version here and update the date above; material changes will be communicated to account holders.

Contact

Questions about this policy? Email [email protected].