Privacy Policy

This Privacy Policy explains how Rafa Marco ("we", "us"), operator of byanalytics (https://byanalytics.co), processes personal data. It covers two different roles:

1. Customers and website visitors of https://byanalytics.co — we are the controller.
2. Visitors of our customers' websites measured with our tracker — our customer is the controller and we are the processor (see the Data Processing Agreement).

Controller#

• Name: Rafa Marco
• Tax ID: 334******
• Address: Calderón de la Barca, 42 · 03201 Elche (Alicante), Spain
• Email: our contact form

Data we process about customers#

Data	Purpose	Legal basis	Retention
Name, email, password hash, language, time zone	Create and operate your account	Contract (Art. 6(1)(b) GDPR)	While the account exists, then 30 days
Two-factor secrets, login devices (browser/OS label), security audit log	Account security and fraud prevention	Legitimate interest (Art. 6(1)(f))	Up to 12 months
Billing details, invoices (handled by Stripe)	Payments and tax obligations	Contract and legal obligation (Art. 6(1)(c))	As required by tax law (typically 6 years)
Messages you send us	Answer requests	Legitimate interest / pre-contractual steps	Up to 24 months
Tokens for third-party services you connect (Google, Bing, Cloudflare)	Import your data	Contract	Until you disconnect the service

We do not use your data for advertising and we do not sell it.

Visitors of https://byanalytics.co#

Our own website is measured with byanalytics itself: no cookies are set and no personal data is stored. Technical server logs (IP address, user agent, requested URL) are kept for up to 14 days for security purposes on the basis of our legitimate interest.

Data processed on behalf of customers#

The tracker processes the page URL, referrer, screen width, browser language, user agent and IP address. The IP address and user agent are used only in memory to derive country, device and a daily-rotating anonymous hash, and are then discarded. No cookies or device storage are used. Details are in our documentation.

Recipients and processors#

We use carefully selected providers bound by data processing agreements:

• Hosting: Banahosting, Europe.
• Payments: Stripe Payments Europe, Ltd. (Ireland).
• Email delivery: Banahosting, Europe.
• Protection of forms against bots: Google Ireland Ltd. (reCAPTCHA), on the sign-in, sign-up, password recovery and contact forms. Google receives your IP address and browser and device data to assess whether the request is automated; the legal basis is our legitimate interest in keeping accounts secure.
• Google, Microsoft (Bing) and Cloudflare only when you connect those services, to retrieve your own data.

Where a provider processes data outside the EEA, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses.

Your rights#

You can download a copy of your data and delete your account yourself, at any time, from your profile. You can also request access, rectification, erasure, restriction, portability and object to processing by writing to our contact form. You may also lodge a complaint with your supervisory authority (in Spain, the Agencia Española de Protección de Datos, www.aepd.es).

Security#

Passwords are hashed, third-party credentials are encrypted at rest, connections use TLS and access is limited by role. Deleting a site, a workspace or an account removes its data from the live systems immediately; backup copies are overwritten within 14 days. See our security practices in the documentation.

Changes#

We will notify customers by email of material changes to this policy at least 30 days in advance.