Privacypolicy

anltcs ("we", "us") provides a web analytics service with a built-in AI analyst, available at the domain this policy is published on (the "Service"). This policy explains what personal data we process, why, and what rights you have in relation to it.

We act in two different roles. For the data we collect about you as a visitor of our website or as a customer, we are the data controller. For the data your websites send to the Service about your visitors, you are the controller and we act as your processor, following your instructions and the terms of our Terms of Service.

When you create an account and use the Service we process the following categories of data:

• Account data: name, email address, password (stored as a one-way hash), language and timezone preferences.
• Billing data: plan, invoices and payment status. Card details are handled by our payment provider and never touch our servers.
• Website data: the domains you add to the Service and their settings.
• Usage data: log entries generated when you use the dashboard, the API or the AI analyst, such as timestamps, IP address and browser type, kept for security and debugging.
• Support data: messages you send us and the details needed to answer them.
• Integration data: if you connect Stripe, Google Ads, Meta Ads, Search Console, Shopify or a similar source, we store the access token you grant us and the reports we fetch with it. Access is read-only and can be revoked at any time.

The tracking script you install collects, for each page view: the page URL, referrer, UTM campaign parameters, browser, operating system, device type, screen resolution, language, and the visitor's country and city derived from the IP address. Custom events you define with anltcs.track() are collected as well.

By default the script is cookieless: it does not set cookies, does not read local storage and does not build a persistent identifier. Unique visitors are counted with a short-lived, salted hash that cannot be reversed into an IP address and is not shared between websites. The IP address itself is used only to derive the location and is not stored with the page view.

You are responsible for making sure that collecting this data on your websites is lawful in your jurisdiction and, where required, for informing your visitors.

The AI analyst answers questions about your analytics by generating and running queries against your own data. It is powered by Anltcs-1, a fine-tuned open-weight model that runs on infrastructure we operate. Your prompts, the queries generated for them and the results are not sent to OpenAI, Google, Anthropic or any other third-party AI provider.

Conversations with the analyst are stored so you can revisit them and so the analyst can keep context within a session. They are not used to train models, and you can delete them from the dashboard.

Telegram alerts, if you enable them, send summaries of anomalies to the chat you connect. Only aggregated metrics and their likely causes are sent; raw visitor data never leaves the Service.

• To provide the Service: collecting and displaying analytics, running the AI analyst, delivering reports and alerts. Legal basis: performance of a contract.
• To bill you: issuing invoices and keeping the records the law requires. Legal basis: contract and legal obligation.
• To keep the Service secure: detecting abuse, rate limiting, investigating incidents. Legal basis: legitimate interest.
• To support you: answering your questions and notifying you about important changes. Legal basis: contract and legitimate interest.
• To improve the product: understanding which features are used, in aggregate. Legal basis: legitimate interest.

We do not use personal data for advertising, we do not profile our customers and we do not make automated decisions with legal effects about you.

We share personal data only with providers that help us run the Service, under contracts that bind them to protect it:

• Hosting: the servers that run the Service and store its databases.
• Payments: our payment provider, which processes your card details on its own systems.
• Email delivery: the provider that delivers transactional emails such as password resets and reports.
• Messaging: Telegram, if you enable alerts, which receives the messages you asked us to send.

We may also disclose data when the law requires it or to protect the rights and safety of our users. We never sell personal data.

• Visitor data is kept for as long as your account is active, subject to the retention limits of your plan. When you delete a website, its data is deleted with it.
• Account data is kept until you delete your account, after which it is removed within 30 days.
• Billing records are kept for as long as tax and accounting law requires.
• Server logs are rotated automatically and kept for no longer than 90 days.

All traffic to and from the Service is encrypted with TLS. Passwords are hashed, API keys can be rotated at any time, and access to production systems is restricted to the people who need it. Backups are encrypted and stored separately from the primary database.

No system is perfectly secure. If we become aware of a breach that affects your data we will notify you without undue delay and, where required, the relevant supervisory authority.

Depending on where you live, you may have the right to access, correct, export, restrict or delete the personal data we hold about you, to object to certain processing, and to lodge a complaint with a supervisory authority. Most of this you can do yourself from the dashboard: export your data, change your details or delete your account and all its websites.

For everything else, contact us and we will respond within 30 days. If you are a visitor of a website that uses anltcs, please contact the owner of that website: they control the data and we act on their instructions.

The Service is hosted in the European Union. Where a provider processes data outside the European Economic Area, we rely on the safeguards recognised by GDPR, such as standard contractual clauses, and we make sure the data is protected to the same standard.

The Service is intended for businesses and professionals. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy as the Service evolves. Material changes will be announced in the dashboard or by email before they take effect. The date at the top of the page tells you when it was last revised.