GDPR

Supermetry is designed to collect less in the first place. This page explains how it handles personal data, which controls you have, and who is responsible for what.

Last updated 12 October 2026

Who is responsible

  • Self-hosted: you are the controller and run the processing yourself. Yupcha never receives your data; the software sends nothing back to us.
  • Supermetry Cloud: you are the controller of your visitors' data and Yupcha acts as your processor under a data processing agreement. Cloud data is hosted in the EU.

What the tracker collects by default

  • No cookies and nothing else stored on the visitor's device by the tracking script.
  • No raw IP addresses stored. The IP address is used in memory to derive the country and an anonymous visitor ID, then discarded.
  • Daily-rotating visitor IDs. The anonymous ID is a hash built with a random salt that changes every day and is deleted after about 48 hours, so a visitor cannot be followed from one day to the next.
  • Page, referrer, campaign tags, country, browser, operating system, device type and the events you define.

Features that process more, and are off until you turn them on

  • Profiles and identify: link events to a user ID you choose, enabled per site. Treat this as personal data and make sure you have a legal basis, such as consent or a contract.
  • Session replay: off by default and enabled per project, with its own sample rate and retention (30 days by default).
  • Heatmaps: aggregated clicks and scroll depth, enabled per site.

Respecting visitors' choices

  • Do Not Track and Global Privacy Control signals are respected by default.
  • A visitor can opt out on your site through supermetry.optOut().
  • Consent mode lets you hold tracking until your consent tool says yes, and beforeSend lets you drop or redact events before they leave the browser.

Answering data subject requests

  • Erasure: delete an identified profile from the dashboard or the API; the erasure is queued durably and you can check its status.
  • Access and portability: export any report as CSV, or pull raw sessions and events through the Stats API.
  • Retention: set how long raw data is kept for each site; expired data is removed in whole time partitions.
  • Exclusions: filter out traffic by IP range, path or country.

What this means for your site

Because the default setup sets no cookies and stores no raw IP addresses or long-lived identifiers, many teams run Supermetry without a consent banner for analytics. Whether that applies to you depends on your configuration (for example, profiles or replay), your country and your other tools, so confirm it with your data protection officer or lawyer.

Questions

Write to contact@yupcha.com. See also our privacy policy for this website, the DPA for Cloud, and the documentation for the configuration details.