What Lumenlytic collects (and never stores)

Most analytics policies are written to be legally safe rather than understood. This post is the opposite: a plain-English explanation of exactly what Lumenlytic collects when someone visits a site that uses it, why we collect it, and what we deliberately never touch. It is written to match how the product actually works, not how a marketing page would like it to sound. If you are evaluating Lumenlytic for a privacy-sensitive client or a regulated industry, this is the page to read alongside our privacy policy and data-processing agreement.

What we collect and why

Every event contains the minimum needed to answer the questions site owners actually ask. There is no hidden enrichment step and no data broker in the pipeline. For a standard pageview we record:

• The page path and title, so you can see which content people read.
• The referrer and any UTM campaign parameters, so you can see where traffic came from.
• Browser, operating system and device type, reduced to major versions.
• Screen and viewport size, so you can understand layout and mobile use.
• Browser language, for a rough sense of audience.
• Engagement signals such as scroll depth and time on page.
• Core Web Vitals (LCP, INP, CLS) so you can see real-world page speed.
• Custom events and properties you choose to send, such as Signup with a plan value.

All of this is statistical. It describes a visit, not a person, and the dashboard presents it in aggregate. None of these fields contain a name, an email address or anything else that identifies an individual visitor.

What we never collect

• Names, email addresses or other personal data about your visitors.
• Cookies of any kind, including first-party analytics cookies.
• Persistent identifiers that follow a visitor across days or across websites.
• Raw IP addresses stored in the database.
• Fingerprinting, session replay or cross-device identity.

How we count visitors without cookies

To count a visit at all, a tool needs some way to tell a new visitor from a repeat view. Lumenlytic does this with a short-lived, salted hash computed on the server, never stored in the browser. In outline it looks like this:

visitor_hash = HMAC-SHA256(
  key:   VISITOR_SALT,
  input: ip_address + user_agent + YYYY-MM-DD + website_id
).hex.slice(0, 32)

Three details matter. First, the date is part of the input, so the hash is stable within a day (which gives correct daily uniques) but does not match the next day, which prevents long-term tracking. Second, the website id is part of the input, so the same visitor hashes differently on different sites and per-site data cannot be joined. Third, the raw IP and user agent are used to compute the hash and then discarded; only the truncated hash is stored. A short-lived session token in sessionStorage, cleared when the tab closes, groups events into a visit for things like time on page.

Where your data lives

Our service is hosted on infrastructure in the European Union, and we only engage sub-processors that provide a comparable level of protection. Website owners act as the data controller for their visitors; Lumenlytic acts as a processor. The data-processing agreement covers this relationship and is available alongside our privacy policy. If you need the current sub-processor list for a procurement review, contact us and we will provide it.

How long we keep it

Raw events are kept only briefly so they can be processed into aggregates, then pruned. The history you see in the dashboard follows your plan: six months on the free plan and two years on paid plans. You can export your data at any time as CSV or JSON, and you can delete a site — including all of its data — from its settings. Deleting your account removes your personal information and analytics data on the same schedule.

Your controls

• Export analytics data as CSV or JSON whenever you want.
• Delete a single website and all of its data from settings.
• Delete your account and associated personal information.
• Sign a data-processing agreement for your own compliance file.
• Contact us for access, correction, export or deletion requests.

Is this GDPR, CCPA or PECR compliant?

Because Lumenlytic sets no cookies and does not build persistent profiles, the tracking itself generally does not require a consent banner in the EU, UK or under similar regimes. That is why teams choose it. This is a description of the design, not legal advice: whether your specific site needs a banner depends on your jurisdiction, your other tools and how you configure them. If you are unsure, get a short legal review. What we can do is make the technical position simple — no cookies, no personal profiles, no cross-site tracking — and give you a DPA that reflects it.

Why you do not have to take our word for it

The tracking script is a single small file, and our documentation describes the payload it sends, so you can inspect it rather than trusting a badge. The privacy policy and the DPA set out the same facts in legal terms. If something here does not match what you observe, tell us: a privacy claim is only worth anything if it can be checked. That is the standard we want to be held to, and it is why this post exists beside the legal pages rather than instead of them.

What about your account data?

Visitor analytics and your own account data are separate things, and it helps to keep them straight. When you create a Lumenlytic account we collect your name and email address, and — if you subscribe — billing details are handled by our payment processor rather than stored by us. We use that information to operate your account, send service notices, provide support and meet our legal obligations. We do not sell it or share it for anyone else's marketing. The privacy policy covers this side of the product in detail, while this post focuses on what happens to the anonymous traffic data your visitors generate. You can request a copy of your account data, or ask us to delete it, at any time.