Privacy Policy

Visitors to our customers' sites

For visitors, the website owner is the controller and we are their processor (see the Data Processing Addendum). The AvaGotYa tag collects what is needed to tell people from automated traffic:

• network data: IP address, network operator (ASN), approximate country and city,
• browser data: user agent, language, screen and device characteristics, and a device identifier stored in first-party storage,
• ad data: click identifiers (such as gclid), campaign tags and the referring page,
• behaviour signals: timing, scrolling, and click positions on the page (coordinates only, never what was typed),
• form signals on forms the site owner enables: timing, a hidden honeypot field, and the form's destination path — not the contents of the form,
• optional session replay, off by default: a recording of page structure with all text and every input masked, kept 30 days.

We use this to score each visit, to report to the website owner, and — if the owner turns protection on — to add IP addresses to the owner's ad-account exclusion lists. We don't use it for advertising, we don't build cross-site profiles, and we don't sell it.

Our customers

For customer accounts we are the controller. We hold your sign-in email, your sites, the settings you choose, your statements, and — if you connect them — your Google Ads spend and click metrics, and encrypted access to Google Ads. We use them to run the service, bill it, support you, and send service email. Payments are processed by PayPal.

Google user data

If you connect Google Tag Manager or Google Ads, we use the data Google returns only to provide the feature you asked for (installing the tag; reading spend and metrics; adding exclusions you approved). AvaGotYa's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google user data for advertising, sell it, or let humans read it except for security, legal compliance, or with your permission to troubleshoot.

How long we keep it

• raw visit events: 90 days; daily aggregates and statements: as long as your account is open, plus 13 months,
• session replays: 30 days,
• our own product analytics: 13 months,
• Google access: until you disconnect, or 6 months of inactivity.

Where it lives and who helps us

Data is stored with Supabase (database, in the United States) and served through Netlify. PayPal processes payments. Google is involved only for the Google features you connect. Each is bound by contract to protect the data.

Your rights

Customers can export or delete their account data by emailing us. Visitors should contact the website they visited; we'll help that website answer access, deletion and opt-out requests. California residents: we do not sell or share personal information for cross-context behavioural advertising.

Contact

ryan@avakata.agency · Full Stack Woo, LLC (doing business as Avakata), Wellington, Florida, USA.