Company
GDPR compliance
This page describes the data practices a site owner can point to in a GDPR conversation. It is not a certificate, it is not a legal opinion, and using WebTrackNext does not by itself make a website compliant.
Who decides
The account holder chooses to add a domain and install the script. WebTrackNext stores the analytics for that account. A person who only browsed a tracked site does not get a login. There is no visitor portal. The site owner controls exclusions and can delete the website, which removes its analytics.
What a visit can include
Page path, page title, referrer origin, campaign source, medium, and name, device type, browser, operating system, country, and hashed visitor and session ids. The hash uses a salt that belongs to that site. A return visit can be recognized on that site only. The script may keep the visitor id and session id in the browser’s local storage. It does not set a tracking cookie, and it does not follow a person onto other companies’ sites.
What a visit does not include
The collect API does not save raw IP addresses. City is not collected. Search queries are not taken from referrers. The public script does not contain a private secret. This is not a claim of anonymous or cookie-free tracking: the visitor id is an identifier, and the dashboard sign-in uses a session cookie. The product is not described as EU-hosted. The same facts are on the privacy and cookie pages.
Account and billing data
Registration stores a name, email, and password hash, plus whether the email was confirmed and when the trial ends. A paid plan can also store the billing details entered at checkout. Razorpay processes the charge. We store the payment status and the Razorpay reference. We do not store the card number.
Settings that limit collection
Honor Do Not Track is on for a new website. When it stays on and the browser sends the signal, the event is ignored. A path or an IP address can be excluded from website settings. Excluded traffic is not written as a page view.
How long it is kept, and how to ask
Account and analytics rows stay while the account and the website exist. Deleting a website removes that site’s analytics. Deleting a user removes that user’s billing rows and, when the workspace belongs only to them, the sites and analytics in it. Public pages on this marketing site drop their own visit rows after 90 days. Use the contact form and choose Support to ask about the account data we hold, or to ask us to delete an account. You can also write to support@webtracknext.com.
Other companies involved
The app and its mail are hosted where this website is hosted. Payments go through Razorpay. Country is resolved with a local database derived from DB-IP country data, and the visitor address used for that lookup is not written to the analytics tables. The contact form uses Cloudflare Turnstile before a message is sent. More about the controls around accounts and the script is on the security page.