Privacy & Compliance

How Produl handles your visitors' data — and why you don't need a cookie banner.

First-party visitor ID

Produl does not set third-party cookies and does not build a browser fingerprint. The tracker generates a random pseudonymous visitor_id and stores it in a first-party _ma_vid cookie on your own domain, with a sessionStorage fallback for browsers that block cookie access.

The visitor ID is first-party to your site. It is sent only as an opaque string attached to events from your own site, and it is not shared across Produl customers or used to correlate the same person across different domains.

What's collected

For each pageview or event, Produl stores:

• The full page URL and path, including query string when present
• The referrer (if present)
• UTM parameters on the URL
• Screen dimensions and browser language
• Parsed browser / OS / device-type (from user-agent)
• Approximate geo (country, region, city) derived from IP — the IP itself is never stored
• Pseudonymous visitor ID and session key (see above)
• Event name and properties you submit via track()
• Core Web Vitals metrics (LCP, FCP, CLS, INP, TTFB)

What's not collected

• No third-party cookies
• No browser fingerprint generation or storage
• No raw IP addresses — geo is resolved server-side, then discarded
• No cross-site identifiers, shared IDs, or syndicated pixels
• No personal names, emails, phone numbers, addresses
• No payment, health, or other regulated-category data
• No page content (we store paths and titles, never the body)
• No Do-Not-Track-violating profiling

GDPR & consent-free use

Produl is designed for lawful processing under GDPR's legitimate interest basis without requiring explicit consent, because:

• No intentionally collected personal data under Article 4(1) is stored
• No cross-site profiling happens
• The visitor ID is random, pseudonymous, first-party, and not shared across sites

If your jurisdiction or risk posture requires consent anyway, the tracker can be initialized only after consent — delay loading the script until your consent manager returns analytics accepted.

Data residency

Enterprise+

Enterprise plans can select where data is physically stored and processed. Options:

• 🇺🇸 US — default, stored in North America
• 🇪🇺 EU — stored in the European Economic Area
• 🌏 APAC — stored in Asia-Pacific

Data never leaves the chosen region. Change the region per-site in Settings → Data region. See Data Regions.

Retention

Historical data is automatically deleted once it ages past your plan's retention window. See Plans & Limits for the exact window on each tier. Aggregates (monthly totals) are preserved indefinitely.

Data deletion

To delete all data for a site before retention takes over, open a support ticket from Account → Support. Deletions are processed within 30 days — this matches GDPR Article 17 (right to erasure) timeframes. Per-visitor deletion (right to erasure for a specific end user) is also available on request — include the pseudonymous visitor ID.

DPAs & subprocessors

A Data Processing Agreement (DPA) is available for Business and Enterprise plans on request — contact privacy@produl.tech.

Current subprocessors:

• Vercel — application hosting
• Neon — managed database
• Produl AI provider — powers AI features (insights, Ask Produl). Only aggregated stats or user-submitted prompts are sent, never raw event data.
• Stripe — billing (for paid plans)
• Resend / Twilio — email and SMS delivery for alerts (only when configured)