Compliance
Built to pass your privacy review
A single place for legal, privacy and security teams to understand how WebTracko handles website visitor data — and what you need to do on your side.
At a glance
- Company
- Xapp Digital Solutions, operator of WebTracko
- Data location
- Application and database hosted in Germany (EU)
- Your role / our role
- You are the controller; we are your processor
- Data Processing Agreement
- Included for every customer — no signature needed
- Cookies on your website
- None — anonymous IDs use browser localStorage / sessionStorage
- Keystrokes & form values
- Never collected
- Session recordings
- None stored — live page copies exist in memory only while you watch
- Visitor data sold or used for ads
- Never
- Encryption in transit
- TLS (HTTPS) everywhere
- Third-party trackers in the script
- None — the script talks only to WebTracko
Regulations
How WebTracko fits common privacy laws
GDPR & UK GDPR
WebTracko processes personal data — such as IP addresses and interaction data — on your behalf. Our Data Processing Agreement sets out our processor commitments, data stays in the EU, and you choose the legal basis for your own analytics.
ePrivacy & PECR
The script sets no cookies, but it does store anonymous identifiers in the visitor's browser storage. In the EU and UK this generally requires consent, so load WebTracko through your consent banner — only after the visitor agrees to analytics.
CCPA / CPRA
We act as your service provider: we process visitor data only to provide WebTracko to you, and we never sell or share it for cross-context behavioral advertising.
Loading WebTracko only after consent
Most consent managers can hold a script until the visitor accepts a category. Mark the WebTracko snippet as an analytics script in your consent tool, or add it from your consent callback. Visitors who decline can also be excluded at any time by setting window.webtrackoOptOut = true before the script runs.
Data handling
What WebTracko collects
Collected only after a visitor has actually interacted with the page. Keystrokes, form values and passwords are never collected.
Technical
IP address, country (looked up on our own servers), browser, operating system, device type, language, screen and window size.
Traffic source
Referring site and UTM campaign parameters. For ad clicks we keep only which network sent the visit — never the click identifier.
Pages
Page URLs with query strings removed, page titles, and navigation between pages.
Interactions
Sampled pointer positions, clicks (position and element type, never text), scrolling and window resizes.
Identifiers
A random visitor ID (localStorage) and a random per-tab session ID (sessionStorage). No fingerprinting.
Live view
A sanitized structural copy of the page, only while a team member is watching that visitor, held in memory and then discarded.
Data is retained while the website exists in your account; deleting a website or your account permanently deletes its data. Full details are in our Privacy Policy.
Security
Technical and organizational measures
EU hosting
Visitor data is stored and processed on servers in Germany.
Encrypted in transit
TLS on the collection endpoint, the API and the dashboard.
Tenant isolation
Every request is authorized against the account that owns the website.
Hardened collection
Domain allow-listing, strict schemas, size limits and rate limiting.
Script-free live view
Page copies are sanitized twice and shown in a sandbox where no customer code can run.
Account protection
bcrypt password hashing, HTTP-only sessions and emailed one-time codes for sensitive actions.
Reporting a vulnerability
If you believe you have found a security issue, please email info@xappdigital.com with the details and steps to reproduce. Please give us a reasonable time to investigate and fix the issue before disclosing it publicly, and avoid accessing other customers' data while testing.
Sub-processors
Who helps us run WebTracko
Visitor data is processed only on our EU infrastructure. We give at least 30 days' notice before adding a sub-processor that handles visitor data.
| Provider | Location | Purpose |
|---|---|---|
| Infrastructure provider | Germany (EU) | Hosting of the application and database, including visitor data |
| Amazon Web Services (SES) | United States | Transactional emails to account users — no visitor data |
| Stripe | Global | Subscription billing for customers — no visitor data |
Visitor country is determined with a locally installed copy of the DB-IP IP-to-Country Lite database, licensed under CC BY 4.0. No visitor data is sent to DB-IP.
Documents
Legal documents
Data Processing Agreement
Our processor commitments, security measures and sub-processor terms.
Privacy Policy
Exactly what we collect, how it is stored and how long we keep it.
Terms of Service
The agreement that governs your use of WebTracko.
Vendor & security questionnaires
Need a completed questionnaire or a countersigned DPA? We're happy to help.
Contact our privacy team
info@xappdigital.comReady to try WebTracko?
Free for 7 days. No credit card required. Setup takes about two minutes.