Skip to content
Start free trial

Legal

Privacy policy

Last updated:

1. Who we are

theBizness.ai ("we," "our," or "us") provides privacy-focused web analytics, UTM tracking and Stripe revenue attribution. This policy explains what data we collect, why, who processes it for us, how long we keep it and what rights you have. It covers our website, our dashboard, our tracking script and our public APIs.

We play two roles:

  • For your account and billing, we are the controller of the data you give us when you sign up and use the dashboard.
  • For visitor and customer data that our customers collect on their own websites, the customer is the controller and we are their processor. We process that data only to provide the Service. If you are a visitor to a website that uses theBizness.ai, contact the website's operator first about your data.

2. Information we collect

2.1 Website tracking data (collected on our customers' websites)

When our script is installed on a website, each pageview and event can include:

  • the page address (origin and path only; query strings are always removed, and a fragment is removed unless it is a hash route such as #/pricing used by hash-routed apps), the referrer and the UTM parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content);
  • the browser's user agent, screen size, page-load timing and time zone, from which we derive the browser, device type and an approximate country (not from the IP address);
  • a visitor identifier and a session identifier, stored in first-party cookies on the customer's domain (see section 5);
  • custom events and conversions the customer chooses to send, with the properties they include, such as an event name, an order ID, an amount and a currency.

A hash-route fragment (one that starts with #/ or #!/) is kept, without any query inside it, because hash-routed apps use it as the page path. Customers should not put personal data in URL paths or hash routes. They can set data-hash-routing="false" on the script tag to stop the script sending fragments at all. With data-hash-routing="true", a route without a slash is recorded with one (#about as #/about). Fragments that contain = or & (such as a token passed back after a sign-in redirect), or that are longer than 100 characters, are never recorded.

IP addresses are not stored with tracking data. Our servers see the visitor's IP address when the request arrives, as any web server does. We use it only as a rate-limit key. For the per-minute limits on the tracking endpoints it is held in server memory for about one minute, and we never write the address itself to our database. (The limits on sign-in, sign-up and password reset, and the daily allowance of custom events and sales reported from a browser, keep a keyed hash instead: see section 6.) Our hosting and network providers (section 4) may keep IP addresses in their standard operational logs.

The script does not read email addresses from the page. A customer's own server can send a customer email with a purchase, and Stripe provides it when Stripe is connected.

2.2 Account information

  • your name and email address, and whether you have verified it;
  • a password hash (we never store your password itself), or the profile details Google gives us when you sign in with Google: your name and email address;
  • your subscription: plan, status, billing period dates, tracked-event usage and your Stripe customer ID. Card details are collected and stored by Stripe, never by us;
  • the websites you add: their domain, time zone and reporting currency, and the settings you choose;
  • keys and secrets you store with us (your restricted Stripe API key, its webhook signing secret and your ingest secret), which are encrypted at rest;
  • short-lived security records used to limit sign-in, sign-up, password-reset, email-verification resend, password-confirmation, Stripe-connection and AI requests (see section 6).

2.3 Stripe data (from a customer's connected Stripe account)

When a customer connects Stripe, Stripe sends us, through a webhook and a restricted key, the data needed for revenue attribution:

  • sales, renewals, refunds and cancellations, with amounts, currencies, product and plan names and Stripe object IDs;
  • the paying customer's email address and, where Stripe has it, name;
  • the checkout metadata the customer chooses to add, such as a website ID, a visitor ID and a session ID, which link a sale to a visit.

2.4 Communications

When you email us or use the chat on our public pages, we receive what you write and your contact details. The chat provider's script also receives technical data from visitors to those pages whether or not they open the chat (section 4). We send you transactional email, such as an email address verification link or a password reset link. We do not send marketing email.

3. How we use information

  • to provide the Service: record and report visits, events and revenue, attribute sales to channels and show them in the dashboard;
  • to generate AI insights for your websites (section 4): when you click Generate insights, and automatically when you open the dashboard of an account with an active plan or trial, for a website that has at least 100 pageviews in the last 7 days and no insights from the last 3 days;
  • to create and secure your account, process payments, enforce plan limits and prevent abuse;
  • to answer support requests and send the transactional email described above;
  • to diagnose problems and improve the Service, using aggregated and technical data.

We do not sell personal data, and we do not use it for advertising or share it for cross-context behavioral advertising.

4. Service providers

We use these providers to run the Service. Each processes the data described, only for the purpose given.

  • MongoDB Atlas (MongoDB, Inc.) hosts our database, which holds all the data described in section 2.
  • Vercel hosts and runs our application. It handles the requests it receives for our website and APIs, including IP addresses, as part of delivering them.
  • Stripe processes subscription payments and our customers' billing. Stripe is also the source of the revenue data in section 2.3 for customers who connect it. Stripe sets its own cookies on its hosted checkout and billing pages.
  • Google provides optional sign-in with Google (OAuth). We receive your name, email address and whether Google has verified your email. Google also sends a profile picture address; we do not store or use it.
  • OpenAI generates AI insights. When you click Generate insights, and automatically when you open the dashboard of an account with an active plan or trial, for a website that has at least 100 pageviews in the last 7 days and no insights from the last 3 days, aggregated analytics for that website for the last 7 days (traffic sources, top pages, devices, browsers, and visitor, order and revenue totals and trends) are sent to OpenAI. Customer names and email addresses are not included.
  • Crisp provides the support chat widget. On our public marketing, documentation, blog and legal pages its script loads automatically, after your first click, key press or scroll, or about five seconds after the page loads. From then on Crisp receives your IP address, browser details and the address of the page you are on, even if you never open the chat. If you do chat, it also receives what you type. It never loads in the dashboard, onboarding or on the sign-in, sign-up, forgot-password, reset-password and verify-email pages.
  • Cloudflare (Cloudflare, Inc.) provides DNS, content delivery and image resizing for thebizness.ai (the images on our public pages are resized and delivered through its image transformation service), and R2 storage and delivery for the blog images served from cdn.thebizness.ai. Requests to those hostnames, including the visitor's IP address and request headers, pass through Cloudflare.
  • Resend delivers our transactional email (email verification and password reset). It receives the recipient's name, email address and the message.
  • YouTube hosts our product demo video. It loads from YouTube's privacy-enhanced (youtube-nocookie.com) player only when you choose to watch it.

We also use PixelDojo to generate illustrations for blog posts from text prompts written by our team. No customer or visitor data is sent to it. We may share information when the law requires it, to protect rights and safety, or as part of a merger or sale of the business, in which case we will tell you.

5. Cookies and browser storage

5.1 The tracking script on a customer's website

The script sets two first-party cookies on the website where it is installed. By default they belong to the exact host that served the page. A website owner can choose to share them across the subdomains of their own site. They are not third-party cookies, and they are not used to follow people across different websites.

  • thebizness_visitor_id (cookie): identifies a returning visitor. 365 days.
  • thebizness_session_id (cookie): identifies a visit. It expires one hour after the last tracked activity.
  • thebizness_utm and thebizness_referrer_data (localStorage): the campaign and referrer that brought the visitor, used for attribution for up to 30 days, so a later purchase can be attributed to it. After 30 days the script ignores the entry, but it stays in the browser until a newer visit replaces it or the visitor clears their site data.

When the optional data-cookie-domain attribute is set, the script first writes a test cookie named thebizness_cookie_domain_probe on that domain and deletes it again at once, to check that the browser accepts cookies for it. Without the attribute nothing is probed.

If a website owner serves the script through their own domain (a proxy), the browser attaches that domain's cookies and the page address to the request that loads the script. The script sends its own requests without cookies and with an origin-only referrer, and the recommended proxy configuration removes the Cookie and Authorization headers (and, for the script file, the referrer) before forwarding to us, so they do not reach our servers.

Safari and Brave limit how long cookies and localStorage written by JavaScript last (about 7 days), so returning visitors in those browsers can appear as new visitors. Whether a consent banner is required before these cookies are set depends on the jurisdiction. That decision belongs to the website owner. We use the same script on our own public pages and on the sign-in, sign-up, forgot-password, reset-password and verify-email pages (path only, never the query string), and not in the dashboard or onboarding.

5.2 Our website and dashboard

  • __Secure-next-auth.session-token (cookie; next-auth.session-token in local development): keeps you signed in. It is HttpOnly, Secure, SameSite=Lax and host-only (no Domain attribute). It lasts up to 30 days after you last used the site, and at most 90 days in total.
  • __Host-authjs.csrf-token and __Secure-authjs.callback-url (cookies): set by the sign-in flow to protect sign-in against forged requests and to remember where to send you afterwards. They last until you close the browser. In local development the same cookies are named authjs.csrf-token and authjs.callback-url.
  • __Secure-authjs.pkce.code_verifier (cookie): set only while you sign in with Google, to protect that sign-in against forgery (PKCE). It expires after 15 minutes at the latest and is removed when the sign-in finishes.
  • theme (localStorage): your light or dark theme choice.
  • privacy-settings (localStorage): whether the dashboard hides customer names and emails on screen.
  • selectedWebsiteId (localStorage): the website you last opened in the dashboard.
  • thebizness.dashboard.range (localStorage): the date range you last chose in the dashboard.
  • thebizness:signin-email (sessionStorage): an email address you typed on the sign-up, sign-in or forgot-password page, handed to the next of those pages in the same tab so you do not retype it. It is removed as soon as it is read.
  • currentWebsiteId and currentWebsiteDomain (sessionStorage): the website you are setting up, carried between the steps of onboarding.
  • selectedPlan (sessionStorage): the plan you picked on the pricing page, carried through sign-up to checkout.
  • signInRedirectAt and billing-session-refresh-at (sessionStorage): the time of your last automatic redirect to the sign-in page or refresh of your session on the billing page. They stop either from repeating in a loop.

sessionStorage values live only in the tab that wrote them and disappear when you close it.

Crisp, when it loads, stores its own cookies and browser storage (names starting with crisp-client) to keep a chat conversation going, whether or not you open the chat. YouTube may set cookies once you play the demo video. These are described in the providers' own policies.

6. Retention

  • Raw pageview, custom event and conversion event records are deleted automatically 25 months after they were recorded.
  • Revenue, customer and cancellation records are kept while your account exists, so your reports stay complete. Each conversion you send is also stored as a revenue record, which is kept with your account, because that record carries the visitor and session IDs and any email address you included.
  • Account data is kept while your account exists. Disconnecting Stripe keeps historical revenue and removes the key.
  • Deleting your account (Settings in the dashboard) cancels your theBizness.ai subscription at once, with no refund of the unused part of the period (see the Refund policy), removes our webhook endpoints from your connected Stripe account, and deletes your websites and all of their analytics, revenue, customer, conversion and insight data, your sign-in and email-link records, and your account. Other devices where you are signed in are signed out within about 5 minutes. Payment and invoice records, and the Stripe customer record they belong to, stay in Stripe for tax and accounting. We do not delete them.
  • Security records for rate limiting hold a keyed hash of an IP address, an email address or an internal account or website ID (the daily browser-event allowance hashes a website ID together with an IP address), never the value itself. They expire when the limit window ends (at most 24 hours) and are removed automatically shortly afterwards.
  • Email verification and password reset links are stored only as hashes. They are valid for 24 hours and 1 hour, can be used once, and are deleted automatically a day after they expire.

7. Your choices and rights

Depending on where you live, including the European Economic Area, the United Kingdom and California, you can ask to access, correct, delete, restrict or export your personal data, and to object to its processing. You also have the right not to be discriminated against for using these rights.

  • Customers can edit their name and delete their account from account settings in the dashboard, disconnect Stripe, delete a website and turn on privacy mode to hide customer details on screen.
  • Website visitors can clear cookies and browser storage at any time. To exercise your rights over data collected on a website that uses theBizness.ai, contact that website's operator. You can also email us and we will pass your request on to them or help them answer it.
  • If you are in the EEA or UK and think we have not handled your data properly, you can complain to your local data protection authority.

To make a request, email [email protected] from the address of your account. We may need to verify your identity before we act on it.

8. Security

We use HTTPS, hashed passwords, encryption at rest for the Stripe keys and secrets you store with us, access controls and rate limiting. The tracking endpoints only accept browser traffic from the website's own domain, or from your server with your ingest secret. No system is completely secure, so we cannot guarantee absolute security.

9. International transfers

We process data in the United States. If you are located elsewhere, your information is transferred to and processed in the United States and in the other countries where our providers operate, which may have different data protection laws than yours.

10. Children's privacy

The Service is not intended for children under 16, and we do not knowingly collect personal information from them.

11. Changes to this policy

We may update this policy. We will post the new version here with a new "Last updated" date, and tell you in advance if a change is material. See also our Terms of service.

12. Contact

Questions about this policy or your data? Email us at:

[email protected]