Privacy Policy

PageView.ro is a service of S.C. CloudX Digital Agency, Str. Principală nr. 358, Sângeru, județul Prahova, România, registered under trade register no. J29/1572/2016, tax ID RO36481851. You can reach us at [email protected].

Two different kinds of data flow through the product, and our legal role is different for each. Getting this distinction right matters more than any promise we could make.

• Reader data — the pageviews measured on a publisher's website. The publisher is the controller: they decide that measurement happens, on which pages, and on what legal basis. We are the processor and act only on their documented instructions. The terms of that relationship are set out in our Data Processing Agreement.
• Account data — the name, email address and password of the people who sign in to the PageView.ro dashboard, together with the sign-in records that keep those accounts secure. Here we are the controller.
• This website — pageview.ro runs our own tracker, in the same cookieless default mode described below. For that measurement we are the controller.

One beacon is sent when a page is opened, a small heartbeat roughly every ten seconds while the page is visible, and one final beacon when the reader leaves. This is everything a beacon can carry, and what actually gets stored:

• No cookies in the default mode. The tracker sets none.
• No raw IP address is stored. It is held in memory only long enough to compute the hashed identifier and derive a country, then discarded.
• No raw user-agent string is stored. It is parsed into a device class, a browser family and an operating-system family, then discarded.
• No cross-site tracking. The site's own domain is one of the hash inputs, so the same browser produces a different identifier on every site — the values cannot be joined across publishers.
• No fingerprinting. No canvas, font or audio probes, no advertising identifiers, no data sold or shared with ad networks.
• No names, email addresses, phone numbers or form contents. The tracker cannot read form fields.
• No city-level or GPS location. Geolocation stops at the country code.

To tell one reader apart from another within a single day, we compute a hash rather than store an identifier:

• The inputs are the user agent, the IP address and the site's own domain.
• The hash is keyed (SipHash-2-4) with a 16-byte random salt, generated fresh each day and rotated at 00:00 UTC.
• Only the current and the previous day's salts are kept; older salts are deleted outright. Once a salt is gone, the corresponding hashes can no longer be recomputed — by us or by anyone holding the database.

Three consequences follow, and we would rather you hear them from us than discover them. The identifier dies at UTC midnight, so a reader who returns tomorrow counts as a new visitor and unique-visitor totals across multi-day ranges overstate the number of real people. It is scoped per site, so nothing links a reader between publishers. And it is a pseudonym, not an anonymisation: under the GDPR it remains personal data, which is precisely why the rest of this policy exists.

In the default mode the tracker sets no cookies. It writes one short-lived value into the browser's sessionStorage (afm_pv): the path of the page and a timestamp, so that reloading the same article within thirty minutes is not counted as a second read. It carries no identifier and it disappears when the tab is closed.

If a reader opts out (section 7), a single afm_optout flag is written to localStorage so the choice survives future visits.

The dashboard at pageview.ro is a different matter: signing in sets a strictly necessary session cookie. Without it we cannot keep you logged in.

A publisher may switch on a first-party identity — internally person_id, stored in the reader's browser as afm_pid — in order to distinguish new readers from returning ones. It is off by default, it is enabled per site, and it requires a deliberate change in that site's settings.

• When it is enabled, a stable identifier is stored in the reader's browser (localStorage plus an afm_pid cookie, marked Secure over HTTPS) and regenerates after 365 days.
• The server honours it only for a site that has actually opted in — the attribute appearing on a site that has not opted in collects nothing.
• It is written alongside the pseudonymous events and into a durable profile record holding first seen, last seen and a pageview count.

• Global Privacy Control. If the browser sends the GPC signal, the tracker sends nothing at all — no pageview, no heartbeat, no exit.
• A per-browser opt-out. Calling window.__afm.optout() on any page running the tracker sets an afm_optout flag in localStorage and halts measurement immediately for that browser.
• Blocking the script. The tracker is an ordinary JavaScript file; any content blocker that stops it stops everything.

There is no mailing list to unsubscribe from, and in the default mode there is no profile to delete: the daily hash is unrecoverable within 48 hours by design.

Deletion in the live database takes effect on request (section 10). Backups roll off on their own schedule; we do not surgically edit a backup, and we would rather say so than imply otherwise.

For reader data we do not choose the legal basis — the publisher does, as controller. In practice:

• Cookieless measurement is normally run on the controller's legitimate interest under Article 6(1)(f), because it stores nothing on the reader's device and builds no cross-site profile. The controller must still document that balancing assessment.
• The optional first-party identity requires consent under Article 6(1)(a) together with Article 5(3) ePrivacy, obtained by the publisher before the mode is switched on.

For the account data of dashboard users we rely on Article 6(1)(b) (performance of our contract with you) and Article 6(1)(f) (keeping accounts and the service secure).

Articles 15 to 22 give you the rights of access, rectification, erasure, restriction of processing, data portability, and objection, as well as the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We take no automated decisions about individuals: the product counts pages, it does not score people.

Where to send a request depends on which data you mean:

• Reader data — write to the publisher whose website you visited. They are the controller. We assist them and answer within the deadlines set by our Data Processing Agreement.
• Account data, if you hold a PageView.ro login — write to us at [email protected].

Two erasure paths are implemented in the product, not merely promised in a document:

• One person. Given a reader's first-party identifier, every matching row is deleted from the raw events and from the durable visitor profiles. An empty identifier is rejected outright, so the operation can never be turned into an accidental wipe of a whole site's cookieless data.
• One site. On a publisher's instruction we erase all of that site's analytics data: the raw events, all three rollups, the bot hits, the aggregator hits and the visitor profiles. It is irreversible, it is confirmed by typing the site's own name, and the capability ships disarmed at platform level until an operator explicitly arms it.

In both cases the deletion is executed asynchronously against the live database and is not reversible once started. Backups expire as described in section 8.

We keep this list short on purpose. These are the only third parties involved in running the service:

There is no email provider, no CRM, no advertising network, no session-replay tool and no third-party analytics anywhere in the reader-data path. Changes to this list are published on this page; the notification and objection procedure is set out in the Data Processing Agreement.

The ingest, the databases, the dashboard and the backups all run on EU infrastructure in Germany. Analytics data is stored exclusively in the European Union, which is why no Standard Contractual Clauses are required for this processing.

Two clarifications, because “EU-only” is easy to claim and easy to get wrong. First, the country-lookup database is downloaded from its United States publisher onto our EU servers and queried locally; nothing about a reader travels outbound. Second, the tracker host sits behind a CDN with a global edge network, so a beacon may be terminated at an edge node close to the reader before it reaches our servers — while storage of every event still happens only in Germany.

• Pseudonymisation at the point of collection: the identifier is hashed before anything is written, and the raw IP address and user-agent string are never persisted.
• All traffic travels over HTTPS.
• Every site key is bound to an allow-list of domains; requests from other origins are rejected. Rate limits apply per site and per IP address.
• Access to a site's data requires an explicit membership with a role (viewer or admin). The platform-administration surface is separate from customer workspaces.
• Dashboard passwords are stored hashed. An administrator-issued temporary password forces the user to set their own on first sign-in.
• The private read API key is never exposed to a browser — integrations such as the WordPress plugin keep it server-side — and it can be rotated or revoked at any time.
• Outbound webhooks are HTTPS-only, signed, and blocked from reaching internal or private network addresses.
• The site-wide erasure capability ships disarmed and must be explicitly enabled by an operator before it can be used.
• Access logs on the tracker host are kept disabled, or IP-anonymised, as a standing operational rule.
• Administrative actions in the platform console are written to an audit log.
• Backups are stored in the EU region and restores are drilled quarterly rather than assumed. Backups and database volumes are encrypted at rest.

If you believe your data has been mishandled, tell us first — [email protected] — and we will investigate. You also have the right to lodge a complaint with a supervisory authority. In Romania that is the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro); you may equally complain to the authority in your own country of residence.

We do not operate a mailing list, so we will not promise you a notification email. Changes are published on this page and the “last updated” date changes with them. Changes that materially affect publishers are additionally surfaced inside the dashboard. If you are a customer, the notification procedure that binds us contractually is in the Terms of Service and, for processing matters, in the Data Processing Agreement.

S.C. CloudX Digital Agency, Str. Principală nr. 358, Sângeru, județul Prahova, România. trade register no. J29/1572/2016, tax ID RO36481851. Email: [email protected]. We have not appointed a data protection officer: our processing does not meet the Article 37(1) thresholds (we are not a public authority, and reader analytics on behalf of our customers is neither large-scale processing of special-category data nor large-scale systematic monitoring carried out for our own purposes). Data protection questions go to the address above and are handled by the company.