[invisit](https://invisit.dev) · [Docs](https://invisit.dev/docs) · [llms.txt](https://invisit.dev/llms.txt) · [llms-full.txt](https://invisit.dev/llms-full.txt) # Privacy Policy - Effective: 2026-11-05 - Page: https://invisit.dev/legal/privacy This policy explains how Muhammed Miraç Berk ("invisit", "we", "us") handles personal data when you visit invisit.dev, create an account, or otherwise use the Service described in our [Terms of Service](https://invisit.dev/legal/terms.md). It does **not** cover the data invisit processes for its customers about the visitors of their websites and short links. For that data the customer (the website owner) is the controller and invisit is their processor; see [How we handle our customers' visitor data](#how-we-handle-our-customers-visitor-data) below and our [Data Processing Agreement](https://invisit.dev/legal/dpa.md). If you arrived here from someone else's website, their privacy policy is the one that tells you about their analytics. ## Who we are The controller of the personal data described in this policy is Muhammed Miraç Berk, an individual based in Ankara, Türkiye. You can reach us about anything in this policy at `privacy@invisit.dev`. ## The short version - We collect what we need to run your account, bill it, keep it secure and support you. We do not sell personal data and we do not use it for advertising. - invisit.dev and the dashboard set no advertising or third-party tracking cookies. - Payments are handled by Polar, our merchant of record. We never see your full card number. - You can export your data and delete your account from the dashboard at any time. ## What we collect and why | What | Examples | Why we use it | Legal basis (GDPR) | | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------- | -------------------------------------------------- | | Account data | Name, email address, password (stored only as a salted hash), profile picture if you upload one or sign in with Google or GitHub | Creating and running your account, signing you in, sending account email | Contract (Art. 6(1)(b)) | | Workspace and configuration data | Workspaces, sites, links, members and their roles, invitations, alert settings, API keys and MCP tokens | Providing the features you use | Contract | | AI assistant connections | The apps you connect over MCP, what you granted each, and for every request the tool called, when and whether it succeeded. Not your conversation with the assistant, and not what the calls send or return beyond the ids of the sites and items they touch | Running the connection within what you allowed, limiting abuse, investigating incidents | Contract; legitimate interests: security | | Billing data | Plan, billing period, invoices, the Polar customer and subscription ids, billing country | Selling and managing subscriptions, tax and accounting | Contract; legal obligation (Art. 6(1)(c)) | | Connected-service credentials | Keys and webhook secrets you enter to connect payment providers or alert channels | Fetching revenue data and sending alerts you asked for. Stored encrypted. | Contract | | Security and session data | IP address, user agent, sign-in times, active sessions, a record of security-relevant actions | Keeping accounts secure, detecting abuse and fraud, investigating incidents | Legitimate interests (Art. 6(1)(f)): security | | Bot-protection signals | Browser and device signals collected by Cloudflare Turnstile when you sign up | Stopping automated sign-ups | Legitimate interests: preventing abuse | | Support and communications | Messages you send us, and our replies | Answering you and improving the Service | Contract; legitimate interests | | Product email | Usage notices (for example at 80% and 100% of your event limit), trial and billing notices | Telling you what you need to know about your account | Contract | | Service usage | Which features are used, errors and performance measurements from our servers | Running, fixing and improving the Service | Legitimate interests: operating a reliable product | | Site and dashboard analytics | Pages viewed on invisit.dev and in the dashboard, how you arrived, and actions such as creating a site, measured with invisit itself: no cookies, no stored IP address, and in the dashboard only a one-way hash of your account id | Understanding how people find invisit and which features they use | Legitimate interests | We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. You do not have to give us personal data, but without an email address and a way to sign in we cannot provide an account. ## Cookies and similar technologies The dashboard uses only strictly necessary cookies: a session cookie that keeps you signed in and short-lived cookies that protect sign-in flows. They are prefixed `invisit` and are essential to the service you asked for, so they need no consent. The dashboard and invisit.dev store a few preferences in your browser's local storage, such as your colour theme. They never leave your device. Cloudflare, which sits in front of our sites, may set cookies needed for security and bot protection. We set no advertising, social-media or cross-site tracking cookies. ## Who we share data with We share personal data only with: - **Service providers** who process it for us under contract and our instructions: hosting (Hetzner), network, email delivery, file storage and bot protection (Cloudflare), and payments (Polar). Our current list, with what each does and where, is on the [subprocessors page](https://invisit.dev/legal/subprocessors.md). - **Polar** as merchant of record. When you buy a plan, Polar is the seller and processes your payment and billing details under [its own privacy policy](https://polar.sh/legal/privacy). - **Google**, only if you choose "Sign in with Google", under Google's privacy policy. - **GitHub**, only if you choose "Sign in with GitHub", under GitHub's privacy statement. We ask it for your public profile and your email addresses, and keep only your verified primary one. - **The people you work with.** Other members of a workspace can see your name, email and role there, and what you change in it. - **Services you connect.** When you connect a payment provider or an alert channel, we send it what is needed for the connection to work. - **AI assistants you connect.** When you connect an assistant such as Claude or ChatGPT, it receives the analytics and settings its tool calls read, as you, within what you granted. What its provider does with them is covered by that provider's privacy policy. You can disconnect an assistant at any time under Account, Connected apps. - **Authorities and others where the law requires it**, or where it is necessary to protect the rights, property or safety of invisit, our users or the public. Where we can, we tell you first. - **A buyer or successor**, if invisit is involved in a merger, acquisition or sale of assets. We will tell you before your data becomes subject to a different privacy policy. ## International transfers Our servers are in the European Union (Falkenstein, Germany). Some providers, such as Cloudflare, Polar, Google and GitHub, are based in the United States or operate global networks, and invisit itself is based in Türkiye. Where personal data leaves the EEA, UK or Switzerland for a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK and Swiss equivalents), or on the provider's certification under the EU-US Data Privacy Framework, together with supplementary measures where needed. You can ask us for a copy of the relevant safeguards. ## How long we keep it | Data | How long | | ---------------------------------------- | ------------------------------------------------------------------------------------------------ | | Account, workspace and configuration | As long as your account exists. Deleted when you delete your account, workspace, site or link. | | Billing records and invoices | As long as tax and accounting law requires, 5 years from the end of the year of the transaction. | | Session data | Until the session ends or expires. | | Application logs | 60 days. | | Proxy access logs (including IPs) | 14 days, unless needed longer to investigate a specific security incident. | | Audit trail of security-relevant actions | 2 years from the action, to investigate abuse and meet legal obligations. | | Support messages | Up to 3 years after the conversation ends. | | Site and dashboard analytics | Kept without an end date, like every invisit site's analytics. They hold no IP addresses. | | Backups | Deleted data leaves our backups as they are rotated, within 30 days. | ## How we protect it All traffic is encrypted in transit with TLS. Passwords are stored as salted hashes. Credentials you give us for connected services are encrypted at rest, and each part of our system holds only the secrets it needs. Access to production is limited to the people who run invisit, and administrative access is recorded in an audit trail. No system is perfectly secure; if a breach affects your personal data, we will tell you and the authorities as the law requires. ## Your rights Depending on where you live, you have the right to: - **access** the personal data we hold about you and get a copy of it; - **correct** it if it is wrong; - **delete** it; - **restrict** or **object to** our use of it, including where we rely on legitimate interests; - **port** it, receiving it in a structured, machine-readable format; - **withdraw consent** at any time, where we rely on consent; - **complain** to a data protection authority, in particular where you live or work. We would appreciate the chance to deal with your concern first. Most of this you can do yourself: edit your profile and delete your account in the dashboard, and export your analytics from each site. For anything else, email `privacy@invisit.dev`. We answer within one month, and may need to confirm your identity first. ### California residents Under the CCPA as amended by the CPRA, you have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and not to be discriminated against for exercising these rights. The categories we collect are those in the table above: identifiers, commercial information, internet or other network activity, and approximate geolocation derived from IP addresses. We collect them for the business purposes described in this policy. We **do not sell** personal information and **do not share** it for cross-context behavioural advertising, and have not done so in the past 12 months. We do not use or disclose sensitive personal information for purposes that require a right to limit. You can exercise your rights, or have an authorised agent do so, at `privacy@invisit.dev`. ### Türkiye If you are in Türkiye, you have the rights set out in Article 11 of the Personal Data Protection Law No. 6698 (KVKK), and you can exercise them by writing to us at the address above or to `privacy@invisit.dev`. ## How we handle our customers' visitor data When a website uses invisit, data about its visitors (pages viewed, referrers, approximate location, device type, events, link clicks, feedback they submit) is processed on behalf of that website's owner, who decides what is collected and why. In brief: - The tracker sets **no cookies**. Visits are counted with a pseudonymous identifier derived from the site, the date, a coarse device class and the IP address, using a keyed hash mixed with a random salt generated for each day. The salt is deleted about a day after that day ends, after which the day's identifiers cannot be recomputed. Because the identifier changes every day, visits cannot be linked across days or across sites, unless the website owner links visits to its own signed-in users with `identify`, which stores only a keyed hash of the owner's user id. - The IP address is used to derive that identifier and an approximate location (country, region, city), and is **not stored** with the analytics. - The tracker can honour Global Privacy Control and Do Not Track, and can wait for consent, if the website owner sets it to. - We do not sell visitor data, use it for advertising, or combine it across our customers. If you are a visitor of a website that uses invisit and want to exercise your rights, contact that website's owner. If you contact us, we will forward your request to them. ## Children The Service is not directed to children under 16 and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it. ## Changes to this policy We will post any change here with a new effective date. If a change is material, we will email account owners before it takes effect. ## Contact Muhammed Miraç Berk, Ankara, Türkiye. Email: `privacy@invisit.dev`.