Data Anonymization and Obfuscation
To provide you with useful information and analytics, we collect data on your behalf. We take extra steps to assure that the data we collect is stripped of Personal Identifying Information.
Our approach assures that information collected is non-reversible and cannot be tracked back to any specific user.
In the Data and Privacy section, we provide you with an exhaustive list of information we collect about online traffic at your online property.
Of these data points, there are 4 that are of special interest in terms of privacy and compliance with various laws, such as GDPR.
Visitor IP Address
For every event that is recorded for Online Traffic Analysis, we capture the source IP Address. The system then annotates the address with a temporary and ephemeral random text. This guarantees, that the subsequent cryptographic hash that the service generates is impossible to guess without being in possession of both, the random text and the IP address itself.
We regenerate the aforementioned random text every 24 hours, and we never store the old, historical values.
By default, Wide Angle Analytics uses weak fingerprint. In this mode, the fingerprint is derived from the request that visitor's browsers issues to the tracking API.
When client-based fingerprint is enabled our script generates a unique browser ID, it creates a usable session identifier. This identifier is never logged on the server. Immediately upon arrival, it is irreversibly obfuscated in the context of the visited site. Even if a visitor uses the same browser to open different websites, both serviced by Wide Angle Analytics, there is no mechanism to cross identify the user.
If you opt for the server-side tracker ID, the browser generated fingerprint is discarded and replaced by the server ID in subsequent requests.
Subsequently, In an effort to guarantee users privacy, we annotate collected identifier with random, ephemeral text and securely hash it like in case of IP Address.
After 24 hours have lapsed, there is no way to reverse the cryptographic hash. Hence, we guarantee that there is no long-term record of visitor's unique identifier.
If you choose to configure your Site to leverage Browser Cookies, kindly note that the visitor identifier will be stored there and will remain the same/unchanged as long the cookie is valid.
Unless your visitors explicitly clears the cookies in the browser, the cookie will be purged 24 hours after the last visit to your site.
Each page view record that originates from a standard browser arrives with a User-Agent header. It contains information such as browser name and version, operating system and version and other bits about its compatibility.
The original, verbatim
User-Agent header is stored temporarily for no more than 1 day. It is subsequently processed and parsed. Long term we store only browser name with major version number and operating system name.
This data point, alone, is not Personal Identifiable Information.
Before Event Ingestion Engine obfuscates visitor's IP Address, it uses it to guess the geographical location where the visit originated from. We use an offline IP Address database to perform a lookup operation.
If we have sufficient confidence that the address points to a known geographical location, we store the location. This includes a Country, and potentially a Province. Country and Province alone is not Personally Identifiable Information.