GDPR

1. Privacy-minded analytics, not a free pass

OpenRevenue avoids advertising cookies, cross-site advertising profiles, and session replay. That reduces many of the highest-risk tracking patterns—but the tracker still uses first-party cookies and browser storage, processes IP-derived geo, and may store IP addresses with events. Under the GDPR, those signals can be personal data.

Customers should not treat marketing slogans as a legal opinion. Use this page together with the Privacy Policy and DPA, and get counsel when you need it.

2. Roles

• Customer (controller): decides why analytics runs on their site, what events to send, which optional integrations to connect, and what notices/consent to show visitors.
• OpenRevenue (processor): processes visitor analytics for the customer under the DPA and product configuration.
• OpenRevenue (controller): for customer account, billing, security, and platform operations data described in the Privacy Policy.

3. Data minimization practices

• Focus on product analytics fields: pages, sources, devices, coarse geo, sessions, and performance.
• No advertising pixel network and no sale of visitor profiles.
• Customer controls for hostname allowlists, blocked IPs, and blocked/masked paths.
• Contractual prohibition on sending sensitive or directly identifying data in events.

4. Cookies, ePrivacy, and banners

EU/EEA/UK rules on storing or accessing information on a user's device (ePrivacy / national implementations) are separate from the GDPR's lawful-basis analysis. Because OpenRevenue sets a first-party visitor cookie and uses localStorage/sessionStorage, many customers will need a disclosure and, depending on advice and configuration, a consent mechanism.

Do Not Track is honored by the script. Global Privacy Control is honored in the browser and again at ingest when Sec-GPC: 1 is present. Customers who need stricter gating can still block the script until consent is obtained.

5. Lawful bases (typical patterns)

Account/billing data: contract and legitimate interests (security, fraud prevention), plus consent where required for optional emails.

Visitor analytics: chosen by the customer as controller—often legitimate interests for aggregate audience measurement and/or consent where required for device storage or particular features (for example persistent user identify or certain attribution setups). OpenRevenue does not decide your lawful basis for you.

6. Data subject rights

Customers should be ready to receive access, deletion, and objection requests from their visitors. OpenRevenue will assist as processor per the DPA. Because visitor identifiers are first-party or daily-rotating fallbacks and we do not build a cross-site identity graph, locating one natural person across events can be limited; that limitation should be explained honestly to requesters.

Customers can delete projects and manage account data in the dashboard. Additional requests: support@openrevenue.com.

7. International transfers

OpenRevenue is operated by a US company (Egger, Inc.) and uses both EU and non-EU infrastructure. Visitor analytics in ClickHouse is hosted on Hetzner in Falkenstein, Germany. Account hosting, app delivery, email, billing, and optional AI features use US and global subprocessors (see the Privacy Policy). Transfers of personal data out of the EEA/UK/Switzerland rely on SCCs and/or DPF certifications where applicable.

8. Security measures

TLS, authentication (including passkeys and 2FA), access controls, hashed secrets, monitoring, and least-privilege operations. Customers should limit team access, rotate keys, and avoid sensitive URL content.

9. Customer checklist

• Publish an accurate privacy notice covering analytics.
• Assess cookies/storage and consent needs for your jurisdictions.
• Avoid sending personal identifiers in events or paths.
• Review optional integrations (revenue, GA import, Slack, SSO) before enabling them.
• Execute/rely on the OpenRevenue DPA (automatically part of the Terms).
• Configure retention/deletion expectations with your own policies.

10. Contact

Egger, Inc., 2810 N Church St # 89471, Wilmington, DE 19802, United States. Privacy and GDPR questions: support@openrevenue.com. Supervisory authority complaints may be filed with your local DPA.