satsuサツ

Privacy Policy

Privacy is at the core of Satsu — it’s what the product is about. This policy explains what data we process when you use our website or create an account, and what the Satsu analytics tool collects on our customers’ websites.

1. Controller

Yousif Paulus, Graf-Adolf-Straße 2, 51065 Köln, Germany. Email: hello@satsu.pro. See the Imprint for details.

2. The short version: no cookies, no tracking of individuals

The Satsu analytics tool sets no cookies, uses no persistent identifiers, and builds no cross-device or cross-person profile. That’s why running Satsu needs no consent banner. How this works technically is documented at “How it’s private” and “What we track”.

3. Visiting this website

When you access our website (satsu.pro), our hosting provider processes technically necessary access data (e.g. IP address, request time, requested resource, user-agent) to deliver the site and keep operation secure. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning service). This access data is not used for advertising or profiling.

4. Account and use of the service

When you create a Satsu account, we process:

  • your name, email address and a hashed password (argon2, never in plain text),
  • the timestamp of your acceptance of the Terms and this Privacy Policy,
  • your organizations, workspaces, sites and settings,
  • billing-related metadata (plan, usage) — payment data itself is held by Stripe, see below.

The legal basis is Art. 6(1)(b) GDPR (performance of the contract). We also send functional emails (e.g. email verification, password reset, invitations).

5. Analytics data on our customers’ websites

If you run a website with the Satsu tracker, it collects only anonymous usage signals. Collected or derived server-side, in particular:

  • pageviews (path, referrer, screen width; the query string is stripped),
  • custom events — without personal data in their properties,
  • country (derived from the IP, at country level only; the IP itself is not stored),
  • browser, operating system and device class (from the user-agent),
  • UTM parameters and the mere presence of an ad click-id parameter (only its name, never its value).

To group a visit within a single day, Satsu derives a daily-rotating, non-reversible fingerprint sha256(site · ip · user-agent · day · salt). The raw IP and user-agent are not stored; the value changes at midnight (UTC), so no cross-day or cross-site profile is created. In our view this means no personal data requiring consent is processed.

In data-protection terms, our customers are the controllers for the analysis of their own website; Satsu acts as a processor. We provide a Data Processing Agreement (DPA) on request.

6. What we deliberately don’t do

  • no cookies and no persistent identifiers,
  • no session recordings, mouse movement or individual heatmaps,
  • no cross-day fingerprints and no recognition across days,
  • no reverse-IP company lookup,
  • no sharing or selling of data to advertising networks.

7. Processors and hosting

  • Hosting: servers within the EU (Hetzner Online GmbH, Germany).
  • Payments: Stripe (as Merchant of Record). Payment data is processed by Stripe; we do not store full payment instruments.
  • Email: an SMTP provider for transactional email.

8. Retention

Account data is kept for the duration of use and beyond where statutory retention obligations apply. Analytics data is subject to the retention window of your plan. When you delete your account, associated data is removed or anonymized.

9. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). You can delete your account at any time in settings. For requests, contact us at hello@satsu.pro. You also have the right to lodge a complaint with a data protection authority.

10. Excluding yourself from tracking

On a website using Satsu, you can exclude yourself locally by setting localStorage.setItem("satsu_ignore", "true") in the browser console.

11. Changes

We update this policy when our processing or the legal situation changes. The version published here applies.