Transparency matters to us
Which data we process from the visitors to your website, which data comes from your own user account, which service providers are involved and how long we store everything.
Two kinds of data, two roles
When you use sitebrunch, two separate kinds of data arise. We deliberately keep them apart on this page, because different rules apply to them and because our role differs in each case.
We process data of the visitors to your website exclusively on your behalf. You decide what is collected and are the controller within the meaning of the GDPR. We are the processor and are bound by your instructions. The basis for this is our data processing agreement.
Data from your own user account, such as your login details and your billing information, we process for our own purposes. Here we are the controller ourselves. The details are set out in our privacy policy.
This page is an informative overview and not a contract. It replaces neither the data processing agreement nor our privacy policy. It is intended to make transparent what actually happens.
Data of the visitors to your website
We only collect data of your website visitors once you embed our tracking snippet on your website yourself. You only need the snippet for the User Experience features. It is not needed for accessibility checks, and these do not collect any data of your website visitors.
When a person visits a page of your website, our standard script sends the following information to our server in Germany. It does not set any cookies. From the device we read only one technical marker that our editor sets, so that your own visits do not appear in your statistics. Differences for Shopify shops and for our beta features are described further below.
Item | Description |
|---|---|
name, type, time | The kind of event, for example a page view, click or form submission, its time, and technical identifiers of your website and of our script |
url | The address that was called up. We remove query parameters and anchors before storage, except for the campaign parameters listed below |
utm_source, utm_medium, utm_campaign, utm_content, gclid, fbclid, mc_cid, _kx | Only if the address called up contains them: campaign parameters and click identifiers of advertising and newsletter platforms, so that a visit can be attributed to a campaign |
referrer | Only for visits coming from an external domain, and only that domain name, without the path |
previousUrl | The path of the previously visited page, exclusively within your own domain. Query parameters and anchors are not transmitted. This item is currently not stored |
device | Device type (mobile, tablet, desktop), derived from the user agent and the screen size |
scrollPosition | Scroll position in percent, rounded to steps of five |
pageViewId | Random identifier per page view, no conclusions about a person are possible. It only goes into a hash and is not stored in plain text. After two minutes without activity a new page view begins |
update, backgroundDuration, leave | Every two seconds a signal to measure time on page, as long as the tab is in the foreground and the mouse is moved or the page is scrolled, plus the time the tab spent in the background. When the page is left, a signal for the display of current visitors, which is not stored |
path, elementIdentifiers | Only for clicks and form submissions: for the clicked element and its parent elements the element type, classes, id, the data-sitebrunch-id and key attributes, the link target as the full address including parameters, the name attribute and the position among neighbouring elements, and for forms also their target address. In addition the visible text of the element. We cut it to 100 characters on our server and first replace email addresses and longer digit sequences with a placeholder. We do not read titles, alternative texts or the entries in form fields. If several clicks without effect follow each other quickly, we mark them as a rage click. Areas with the data-sitebrunch-ignore attribute are excluded from collection. Please note: the visible text of a clicked element can contain personal information if your page displays, for example, a name there |
IP address, user agent, client hints, language setting | Sent along by the browser for technical reasons. We use the IP address, user agent and client hints exclusively to form the hash, and the IP address also to determine the country. They are discarded afterwards. We do not evaluate the language setting |
What we store permanently
From the IP address, user agent, client hints, device type and domain we form a hash using the SHA-256 procedure, together with a random, website-specific value (salt). IP address, user agent and client hints are discarded in this step and never reach our analytics database. There is no column for IP address or user agent there.
Of the location we store only the country according to ISO-3166. City or region are not recorded.
In enhanced-privacy mode we additionally truncate the IP address before the hash is formed. With IPv4 the entire last octet is set to zero (/24 mask), with IPv6 only the first 24 bits are kept. We determine the country beforehand from the full address.
If a person has enabled Do Not Track in their browser, our standard script switches off automatic collection entirely. Page views, interactions and scrolling are then not sent to our server. Only events that the code of your website explicitly triggers through our interface are still sent (see below).
Only if you set it up yourself
Our script collects the following information only if you set this up yourself. Without that setup it does not send it.
Goals from the data layer: if you create a goal of the type data layer in the dashboard, we transmit for the events you selected their name and, where present, value, currency and transaction number. We do not read other content of the data layer, such as items or customer data.
Custom events: if the code of your website calls our function sitebrunch.event(), we store the name of the event and all properties your code passes, unchanged. You decide this content yourself. Please do not pass any information there that identifies a person, such as names or email addresses.
Shopify shops
The following applies only if you install our Shopify app in your shop or set up our Shopify pixel yourself. Without that setup we collect none of this in your shop.
Pixel in the checkout
The pixel runs in the sandboxed environment that Shopify provides for pixels. It records shopping events: page views, viewed products and product lists, searches, adding to the cart, the start of checkout, the entry of contact, shipping and payment details, and the purchase. For each event it transmits the page address, the domain name of the referring page, the device type, value and currency, and for items the product ID, title, vendor, variant, price, quantity and, where available, the SKU. On purchase it also transmits Shopify's checkout identifier. The pixel does not transmit names, email addresses, postal addresses, phone numbers or customer numbers of your buyers.
For recognition, the pixel of our app uses the identifier that Shopify assigns to the browser instead of the IP address. We form a hash from it with the salt described above, which is renewed every 14 days, and do not store the identifier itself.
Shopify only runs the pixel if the person has consented to analytics, insofar as your shop asks for such consent. Our script for heatmaps in your shop theme also waits for this consent by default. In the app you can set it to record all visitors right away. The pixel does not evaluate the browser setting Do Not Track.
Your account via Shopify
If you sign in through the app, Shopify gives us your name, your email address, whether it is verified, your language setting, the domain of your shop and an access key for your shop's interfaces. We create your sitebrunch user account from this. In this case Shopify bills your subscription, not Stripe. We only retrieve the status of your subscription from Shopify.
Data from your user account
This data concerns you as a customer, not the visitors to your website. For it we are the controller ourselves.
Type of data | Description |
|---|---|
Registration | Name, email address, phone number and password. We store the password exclusively as a hash, never in plain text |
Origin of your sign-up | At registration we record which page and which campaign parameters brought you to us, as well as the referring address. This helps us assess which of our content is useful |
Your websites and projects | Name and domain of the websites you create, as well as your projects, comments and screenshots |
Team | Email addresses of the people you invite, as well as the members of your team and their roles |
Uploaded documents | Files you upload for checking, such as PDF documents, and the results generated from them |
Sign-in and security | Your signed-in sessions, the data of your two-factor sign-in including recovery codes, your API keys and MCP access, and the access keys of services you connect, such as awork |
Activity log | Sign-ins, two-factor sign-in events and actions on your websites and projects, as well as the time of your last sign-in. This helps us detect misuse and help you with questions. We delete entries automatically after 24 months |
Consents and settings | When you agreed to our terms and conditions and the data processing agreement and, where applicable, the newsletter, and your language setting |
Courses | Your learning progress, your course purchases and your certificates, which bear your name |
Feedback | Your answers to our survey after registration, your ratings and, if you cancel, the reason you gave. After your account is deleted, we keep the cancellation reason without any link to you |
Billing | Billing name and billing address, your VAT identification number if you wish, and your payment details. We do not collect the payment details ourselves, they are processed directly by Stripe. If you use our Shopify app, Shopify bills your subscription instead |
IP address at registration | Used exclusively to limit the number of registrations per hour and to prevent misuse. We do not store it in your user account |
When you delete your account, we remove the data listed above. The following exceptions apply:
Your comments in projects remain visible to your team, but without your name. We remove mentions of you from other comments.
If you belong to a team with other active members, one of them takes over your websites and projects in that team. If there are no other active members, we delete the team.
We keep the reason for your cancellation without your name or email address.
We keep invoices and payment records because the law requires us to. This also applies to the records at Stripe or, if you use our Shopify app, at Shopify.
The email confirming the deletion remains in the log of sent emails for 30 days, like all emails.
We delete your contact at Brevo if, when deleting your account, you choose to stop receiving the newsletter. Otherwise your name, email address and the usage events we sent remain stored there until you ask us to delete them.
AI-assisted features
For some features we use language and image models from Scaleway in France (Paris). For this we transmit content of your publicly accessible pages and aggregated statistics, but no data of the visitors to your website. If your pages themselves contain personal information, such as names or photos of people, this can be part of the transmitted content. The transmitted content is not stored and not used to train AI models.
Page type detection: runs automatically after every crawl and daily for projects with an active subscription. For each group of similar pages we transmit the address pattern, the page title, the meta description and the beginning of the page text (at most 1,500 characters).
AI readability: disabled by default, you enable it in the project settings. With every accessibility check we transmit images of your pages in reduced size together with their alternative text and the surrounding text, in order to assess the alternative texts.
Management summary with AI: only if you enable the management summary. The AI analysis is preselected and can be deselected. We transmit aggregated statistics of your project, such as visit numbers, pages, sources, campaigns, goals, revenue from Shopify and accessibility scores, as well as the previous summary and the title and description of your project notes. The statistics are sums and averages across all visits, individual persons are not identifiable in them.
Audit workflows via MCP: only in workspaces enabled for this. We transmit the address of the checked page, the recorded findings and the answers of the auditing AI.
Beta features
We offer individual features as beta. They are disabled by default and have to be enabled by you explicitly. As long as you do not enable a beta feature, only the behaviour described above applies to your website.
Cookie-based recognition
Our standard script does not set any cookies. Only if you enable this feature and embed the script provided for it does it set a cookie with a randomly generated identifier on the devices of your website visitors. Recognition then takes place via this identifier and no longer via the hash described above. We store the identifier together with the events. The salt rotation, and the resulting limitation of recognition to 21 days, therefore do not apply to this feature. You set the lifetime of the cookie yourself, the default is 7 days. The feature requires consent under section 25 TDDDG. You may only use it if you have obtained valid consent from your website visitors beforehand. The browser setting Do Not Track is not evaluated in this beta.
Service providers we use
All processing of the data of your website visitors takes place within the EU. We operate our databases, queues and our error monitoring ourselves on our own infrastructure and do not pass this data on to third parties. Only the two following service providers are involved in the personal data of your website visitors.
For the data of your website visitors
Provider | Purpose | Registered office and place of processing |
|---|---|---|
Hetzner | Hosting, databases, queues and backups of the analytics database | Germany (Falkenstein, Nuremberg) |
bunny.net | Delivery of our analytics script. When the script is loaded, the browser of your website visitors connects to the CDN, and its IP address is visible in the process for technical reasons. Access logging is disabled | Slovenia, delivery via European locations |
For your user account and the operation of the application
Provider | Purpose | Registered office and place of processing |
|---|---|---|
Hetzner | Hosting and databases, storage for uploaded documents | Germany (Falkenstein, Nuremberg) |
bunny.net | Delivery of static files and of our analytics script, as well as object storage: crawl snapshots and stored page HTML, preview screenshots, result data of the accessibility checks, course certificates and the encrypted backups of our customer database | Slovenia, delivery and storage via European locations |
Scaleway (object storage) | Object storage for application files such as images for comments and screenshots from accessibility checks, and for exports | France (Paris) |
Scaleway (AI features) | Language and image models for page type detection, AI readability, the management summary and audit workflows via MCP. Transmitted are content and images of your publicly accessible pages, aggregated statistics and project notes, details in the section on AI-assisted features. The transmitted content is not stored and not used to train AI models. Personal data of your website visitors is not transmitted | France (Paris) |
Stripe | Payment processing for your sitebrunch subscription. No data of your website visitors | Ireland, group affiliation with the USA |
Brevo | Sending transactional and notification emails to your user accounts. We also keep your contact details there (name and email address) and transmit events of your product usage, such as registration, websites created, subscription and checks, in order to send you suitable emails. Brevo receives no data of the visitors to your website | France |
awork (your own account) | Not a subprocessor of ours: the contractual relationship with awork exists between you and awork, we merely transmit into your own account on your instruction. Optional integration, not active by default. If you connect your awork account, we create your comments as tasks in awork and transmit the comment text, the assigned people and the associated screenshot. Conversely, we retrieve your user profile there as well as your project, status and task lists and store them in your sitebrunch account. A transfer takes place only when you create or reply to a comment, not automatically in the background. Data of your website visitors is not transmitted | Germany (Hamburg) |
Shopify (your own account) | Not a subprocessor of ours: your contract is directly with Shopify. Only if you install our Shopify app. We receive your account details, the events of the pixel and the status of your subscription, which Shopify bills. Details in the section on Shopify shops | Ireland, group affiliation with Canada and the USA |
To determine the country of origin we use the GeoLite2 database from MaxMind. It is held as a local file on our servers. No query is made to MaxMind and no IP address is transmitted.
Retention periods for server and CDN logs
Type of data | Retention period |
|---|---|
CDN logs (bunny.net) | Access logging is disabled. No CDN logs are created |
Server logs | No fixed period. The logs remain on the respective server in Germany, are rotated by size (at most five files of ten megabytes each per service) and are deleted at the latest when the service is next replaced. There is no central collection and no disclosure to third parties |
Error logs of the monitoring | 14 days, then automatic deletion. Operated on our own servers in Germany |
Salt used to form the hash | 14 days. It is then irretrievably overwritten |
Backups of the customer database | 7 days. The backups are encrypted on our server and leave it only in that form. The storage provider cannot read the contents |
Backups of the analytics database | The five most recent backups are kept, older ones are deleted automatically. Stored in Germany (Nuremberg). These backups contain exclusively pseudonymised analytics events, no salt and no IP addresses |
Raw data in the queue | Deleted after processing, at the latest after 14 days |
Analytics events (pseudonymised) | No fixed deletion period, so that analyses over longer periods remain possible. The personal reference ceases when the salt is overwritten |
Results of website crawls | Remain stored until you delete the website. Both the crawls and the page content recorded in them are removed |
Public accessibility checks | 90 days. We store the checked address or the uploaded PDF, screenshots, the results and the IP address of the person requesting the check |
Logs of sent emails | 30 days. Concerns the emails to your user accounts, not your website visitors |
The salt is part of the hash. Once it has been overwritten after 14 days and removed from the last backup after a further 7 days at most, a stored hash can no longer be traced back to an IP address, not even by us. From that point on, the stored analytics events are permanently anonymised. Recognition of the same person is thereby limited to 21 days at most.
Transfers outside the EEA
The data of your website visitors is processed exclusively within the European Union. For this data there is no transfer to a third country.
We embed neither Google Fonts nor Google Analytics or reCAPTCHA in our application. We operate our error monitoring on our own servers in Germany, and no error data is transmitted to an external service. Before an error log for a tracking request is stored, we remove the IP address, user agent, client hints and the transmitted content. If an error occurs in our application while you are signed in, we store the email address of your user account in the error log, and in the dashboard also a recording of your actions shortly before the error. It contains no data of your website visitors. The logs are deleted automatically after 14 days.
A third-country element exists only in the following cases, which do not concern your website visitors:
Payment processing via Stripe. The contracting party is Stripe Payments Europe, established in Ireland. A transfer within the Stripe group to the USA takes place on the basis of the standard contractual clauses of the EU Commission. This concerns only your billing data, not the data of your website visitors.
If you install our Shopify app, we receive data from Shopify and Shopify bills your subscription. The contracting party for merchants in Europe is Shopify International Limited, established in Ireland. Shopify transfers data within its group to Canada and the USA, among others. This concerns your Shopify account and your subscription, we do not transmit any data of your website visitors to Shopify.
Internal operational notifications to Microsoft Teams, for example on changes to subscriptions. The data of our Microsoft 365 tenant is stored in Germany, so in that respect there is no transfer to a third country. No data of your website visitors is transmitted.
In the dashboard, individual help videos may be embedded via YouTube, Vimeo or Tella. We embed YouTube in the mode without cookies. If you open a page with an embedded video, a connection to the respective provider is established. This concerns only your own user accounts, not the data of your website visitors.
Last updated: 26 October 2026. We will notify you in advance of changes to the list of service providers we use.