Privacy Policy

Effective Date: March 2, 2026 Last Updated: June 10, 2026

1. Introduction

This Privacy Policy explains how Siavak Analytics SL ("we," "us," or "our"), a company registered in Spain, collects, uses, stores, and protects your personal data when you use Analytics Detectives (the "Service") available at https://analyticsdetectives.com.

We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) (EU Regulation 2016/679) and applicable Spanish data protection laws (LOPDGDD — Ley Orgánica 3/2018).

By using the Service, you agree to the practices described in this Privacy Policy.

2. Data Controller

Siavak Analytics SL Email: privacy@analyticsdetectives.com

3. Data We Collect

3.1 Account & Authentication Data

We use Google OAuth 2.0 for authentication. We do not receive or store your Google password. From your Google account we receive your name, email address, and profile photo URL, which are used to create and maintain your account.

The Google Analytics read-only data permission is requested separately from the identity permission. You may decline the Google Analytics permission and continue to use the parts of the Service that do not depend on Google Analytics data.

3.2 Google Analytics Data

With your authorization, we access your Google Analytics 4 (GA4) property data through the Google Analytics Data API and Admin API in read-only mode. This includes property and data stream configurations, analytics reports (dimensions, metrics, events, conversions), and account/property metadata. We do not modify your GA4 configuration.

3.3 Service Usage & Diagnostics

We collect information about how you use the Service, including pages visited, features used, audit results, AI conversations, and quota consumption. We also capture crash and error diagnostics from your browser when something goes wrong, and login context such as device type, browser, language, timezone, approximate geolocation derived from your IP address, and any marketing attribution parameters present in the link you arrived from. The raw IP address itself is not stored.

For product analytics and user-experience research, we use third-party tools including Amplitude and Microsoft Clarity, which capture aggregated usage events, session replays, and heatmaps.

Conversations you have with our AI assistant features may be reviewed by our team to support you and to improve the Service.

3.4 Pre-Account Contact Data

Before you create an account, you may share personal data with us through public surfaces of the Service:

  • Waitlist sign-ups. When you join the waitlist we collect your name, email address, and any marketing attribution parameters present in the link you arrived from. We send you a confirmation email and an approval email when your slot is granted, plus occasional onboarding reminders. Every email contains an unsubscribe link.
  • Marketing leads. Public marketing forms may submit your email address and basic source/attribution data to us so that we can follow up and link the lead to a future account.
  • Invite and referral attribution. If you arrive with an invite or referral code, we record that code so the signup can be attributed to the referrer.
  • Beta intake. From time to time we run separate beta intake programmes for new features outside the main app, which collect the information described on the relevant intake form.

3.5 Cookies

We use essential session cookies to maintain your authenticated session. We also use a small number of analytics cookies set by our third-party product-analytics and session-replay providers. Analytics cookies are not required for the core functionality of the Service.

4. How We Use Your Data

We process your data for the following purposes:

| Purpose | Legal Basis (GDPR) | |---|---| | Providing, securing, and supporting the Service (authentication, account management, security monitoring) | Performance of contract (Art. 6(1)(b)) / Legitimate interest (Art. 6(1)(f)) | | Processing your Google Analytics data on your behalf to provide analytics features | Consent (Art. 6(1)(a)) | | Communicating with you (transactional emails, marketing emails including engagement measurement, waitlist and onboarding messages) | Consent (Art. 6(1)(a)) / Legitimate interest (Art. 6(1)(f)) | | Processing payments and keeping records required by tax and accounting law | Performance of contract (Art. 6(1)(b)) / Legal obligation (Art. 6(1)(c)) | | Product analytics, session replay, crash and error diagnostics, and reviewing conversations with AI assistant features to provide support and improve the Service | Legitimate interest (Art. 6(1)(f)) | | Marketing attribution and operating the invite/referral programme | Legitimate interest (Art. 6(1)(f)) / Performance of contract (Art. 6(1)(b)) | | Identifying you as a customer through your company name and logo (opt-out available in Account → Privacy & Data) | Legitimate interest (Art. 6(1)(f)) | | Publishing aggregated, anonymous, and un-identified statistics derived from Service usage in benchmarks, research, and marketing materials | Legitimate interest (Art. 6(1)(f)) |

We may use aggregated, anonymous, and un-identified information derived from the use of the Service (such as the prevalence of data quality issues across all audited properties) to publish benchmarks, research, and marketing materials. We will never identify specific properties, accounts, or organizations in such publications.

5. Google API Services User Data Policy

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

  • We only use Google user data to provide and improve the Service's user-facing features.
  • We do not transfer Google user data to third parties except as necessary to provide the Service, as required by law, or with your explicit consent.
  • We do not use Google user data for advertising or to serve ads.
  • We do not allow humans to read Google user data unless we have your affirmative consent, it is necessary for security purposes, it is necessary to comply with applicable law, or our use is limited to internal operations and the data has been aggregated and anonymized.

When you use AI features that analyse your Google Analytics data, the relevant analytics output is sent to a third-party AI provider strictly to generate the analysis you requested. Your Google account credentials and profile data are never sent to AI providers.

5.1 Revoking Google Access

You can revoke Analytics Detectives's access to your Google account at any time by:

  1. Visiting your Google Account Permissions page and removing Analytics Detectives.
  2. Contacting us at privacy@analyticsdetectives.com to request disconnection and deletion of all Google-derived data.

Upon revocation, we will delete your Google-derived data within 30 days. Your account will be deactivated since Google OAuth is required for authentication.

6. Third-Party Processors

We use the following third-party services to operate the Service. Each acts as a data processor under GDPR:

| Processor | Purpose | Location | |---|---|---| | Google | Authentication, Google Analytics data access, file and form storage used to operate the Service | United States / Global | | OpenAI and Google (Gemini) | Third-party AI providers used to power AI assistant features | United States | | Resend | Transactional and marketing email delivery, including open/click engagement tracking | United States | | LemonSqueezy | Payment processing as Merchant of Record and subscription management. We do not directly collect or store your card or bank details; LemonSqueezy provides us with subscription status, transaction history, and customer identifiers. | United States | | Amplitude | Product analytics and session replay | European Union | | Microsoft (Clarity) | Session replay and heatmaps | United States / Global | | ipapi | IP geolocation lookup during login | Global | | Replit | Application hosting, database, and managed AI integration layer | United States |

Google data summary. Google receives the data needed to authenticate you and to serve your Google Analytics requests on your behalf. Where AI providers are used to analyse Google Analytics data, only the analytics output relevant to your request is sent — never your Google account credentials or profile data.

7. Data Retention

  • Account-linked personal data: deleted within 30 days of account deletion or revocation of Google access.
  • Anonymous benchmark data: retained in unlinked form after the link to your original Google Analytics property is severed, so it can no longer be associated with you.
  • Activity and error logs: retained for up to 90 days, then deleted.
  • Pre-account contact data (waitlist sign-ups, marketing leads, beta intake responses): retained for up to 24 months if you do not create an account, or for the duration of your account.
  • Records required by tax and accounting law: retained as required by applicable law.

8. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States, where our third-party processors operate. These transfers are protected by:

  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • Adequacy decisions where applicable
  • The processors' compliance with applicable data protection frameworks

9. Your Rights Under GDPR

As a data subject in the EU, you have the following rights:

  • Right of Access (Art. 15) — Request a copy of your personal data.
  • Right to Rectification (Art. 16) — Request correction of inaccurate data.
  • Right to Erasure (Art. 17) — Request deletion of your personal data.
  • Right to Restriction (Art. 18) — Request that we limit processing of your data.
  • Right to Data Portability (Art. 20) — Receive your data in a structured, machine-readable format.
  • Right to Object (Art. 21) — Object to processing based on legitimate interest.
  • Right to Withdraw Consent — Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at privacy@analyticsdetectives.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos — AEPD) at www.aepd.es.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including industry-standard administrative, technical, and physical safeguards such as encryption in transit, secure session management, access controls, rate limiting, and regular security reviews.

11. Children and Age Requirement

The Service is intended for users who are at least 18 years old. We do not knowingly collect personal data from individuals under 18. If we become aware that we have collected data from a person under 18, we will take steps to delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service and updating the "Last Updated" date. Your continued use of the Service after changes constitutes acceptance of the revised policy.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, contact us at:

Siavak Analytics SL Email: privacy@analyticsdetectives.com Website: https://analyticsdetectives.com