Privacy policy

Version 2026-11-09

This policy explains how Vinvu Software B.V. ("we") handles personal data in connection with Fast Web Tracking.

1. Two roles

• Account and billing data: we are the controller for data about our customers and their users, such as accounts, billing and support.
• Website visitor data: our customers add our script to their websites to count page views and other events. For the data we process about the visitors of those websites, the customer who owns the website is the controller and we act on their behalf as their processor. Section 3 describes what that data is. Questions about a website that uses Fast Web Tracking? Contact the website owner. We'll forward requests we receive to them.

2. What we process and why

• Account data: name, email address, password (stored as a one-way hash) and workspace membership. Used to provide the Service (performance of the contract).
• Billing data: name, company, address, country, VAT number, invoice email, payment status and a masked bank account reference. Used for payments and invoices (contract) and kept for 7 years for tax purposes (legal obligation). We never see or store full card or bank details; payments are handled by Mollie.
• Technical data of account users: IP addresses, browser information and logs of people who use the dashboard. Used for security, abuse prevention and fixing problems (legitimate interest). Logs are kept for a limited time.
• Email: service emails such as verification, password reset, invitations, invoices, usage and payment notices (contract). We don't send marketing emails without your consent.
• Website visitor data (as processor): see section 3.

3. Visitors of our customers' websites

When someone views a page on a website that uses Fast Web Tracking, the script on that page tells us that the page was viewed or that something happened on it. We process this for the customer who owns the website.

• Processed briefly, not stored: the IP address and the User-Agent string of the browser. We use them to answer the request, to limit the number of requests, to detect bots and to derive a coarse device category, browser family and operating system family. After that they are discarded.
• Stored: counters only, per site and per day or hour, for example "from /pricing to /contact: 84". They count page views, movements from one page to the next, entry pages, referring websites and campaign tags (UTM), the clicks, form submits and custom events the customer chose to count, outbound link clicks, scroll depth, engaged time, Core Web Vitals (LCP, INP, CLS), kinds of JavaScript errors and views of pages that don't exist. Page views are also totalled per device category, browser family, operating system family, browser language and, where available, country.
• Not collected: the script sets no cookies and stores nothing in the visitor's browser. There are no visitor or session identifiers and no fingerprinting. There are no records of individual page views or visits, so the statistics contain no unique-visitor numbers. Query strings are dropped from page addresses, and parts of an address that look like an id are replaced by ":id".

The stored statistics are designed to contain no personal data: a counter can't be traced back to a person. For the same reason we can't look up, correct or delete data about an individual visitor. Customers may not send personal data in page addresses, event names or campaign tags.

This section describes what is and isn't collected. Customers remain responsible for assessing their own legal obligations for their websites, such as informing their visitors and checking whether consent rules apply.

4. Cookies

In the dashboard we only use cookies that are necessary for the Service to work, such as the session cookie that keeps you logged in and a security token that protects the dashboard's own pages. We don't use tracking or advertising cookies. The script on our customers' websites sets no cookies.

5. Subprocessors and recipients

We share data only with service providers that help us run Fast Web Tracking, under data processing agreements:

• Railway Corporation: application hosting and database.
• Amazon Web Services EMEA SARL (region Ireland): sending email.
• Cloudflare, Inc.: DNS and network security.
• Mollie B.V. (the Netherlands): payment processing.
• Moneybird B.V. (the Netherlands): invoicing and accounting.

Some of these providers are based in, or may access data from, the United States. Such transfers are protected by the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.

6. Retention

• Account data is kept while your account exists.
• Statistics are kept for the history period of the customer's plan and are then deleted automatically.
• Deleted workspaces and accounts can be restored for 7 days and are then deleted permanently, together with their sites and statistics.
• Invoices and the billing data on them are kept for 7 years, as required by Dutch tax law.

7. Security

Data is encrypted in transit (HTTPS). Access to a workspace is limited to its members, every account can turn on two-factor authentication with an authenticator app, and our systems are protected and monitored. The dashboard loads no scripts, fonts or styles from other companies. No system is perfectly secure, but we work to protect your data and will notify you of breaches as required by law.

8. Your rights

You have the right to access, correct, delete or export your personal data, to restrict or object to processing, and to withdraw consent where processing is based on consent. On your profile page you can correct your details, download a copy of your personal data (a JSON file) and delete your account. For anything else, email us. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

9. Changes

We may update this policy. Material changes are announced by email or in the dashboard. The version date above shows when it last changed.

Contact

Vinvu Software B.V., De Kolk 6, 8255 PE Swifterbant, the Netherlands
Chamber of Commerce (KvK) 84836776 · VAT NL863402021B01
[email protected] · +31 (0)321 700 246