Privacy Policy

Numative ("Numative", "we", "us") provides website analytics with change attribution. We are based in Illinois, United States. For anything in this policy, contact us at support@numative.com.

This policy covers two distinct situations: data we collect from you when you visit our website or hold a Numative account, where we decide how the data is used, and data our analytics service records on our customers' websites, where the customer decides and we process it on their behalf.

When a website owner installs the Numative tracker on their site, we process visitor data on that owner's behalf. The tracker is designed to avoid identifying individuals:

• No cookies and no persistent identifiers. The tracker sets no cookies and stores nothing on a visitor's device that outlives the browsing session, other than a voluntary opt-out preference.
• Per event we record: the page URL, the referrer, the event name and any custom properties the site owner sends, the browser and operating system family (for example "Chrome on Windows", never full version strings), a screen-size bucket, approximate location derived from the IP address at collection time, and a visitor identifier.
• The visitor identifier is a one-way hash of the site, IP address and user agent, salted with a secret that rotates every day and is scoped per site. The same visitor cannot be recognized across days or across sites, and the hash cannot be reversed. Raw IP addresses and user agent strings are not stored with events; they are used transiently to compute the hash, classify bots, derive approximate location and enforce rate limits.
• Sessions use a random identifier kept in the visitor's own sessionStorage that expires after 30 minutes of inactivity.
• Change detection sends a numeric fingerprint of the page's own content (title, description, heading, approximate length). It contains no visitor data.
• Opt-out. We honor Do Not Track and Global Privacy Control. On a site that has enabled it, a visitor sending either signal is dropped before anything is stored.

For sites that connect Google Analytics instead of our tracker, we read reporting data from the GA4 API on the customer's instruction and do not collect anything from that site's visitors ourselves.

If you are a visitor to a website that uses Numative and you have questions about that site's data practices, contact the site owner, who is the controller of that data.

When you create and use a Numative account, we collect:

• Account details: name, email address and a hashed password, or your Google sign-in identity.
• Organization and team data: the organizations you belong to, roles and invitations.
• The sites you register and everything the product records about those sites: traffic statistics, page snapshots and change history, rankings, backlinks and reports.
• OAuth tokens for Google integrations you choose to connect (GA4, Search Console). Tokens are limited to read-only scopes and encrypted at rest.
• Billing status. Payments are handled by Polar as merchant of record; we never see or store full card numbers.
• Emails we exchange with you, including support requests sent through our contact form.
• Basic server logs and error reports needed to run and secure the service.

We use this data to provide and improve the service, send the reports and alerts you configure, bill you, and respond to you. We do not sell personal information and we do not use your data for third-party advertising.

If you connect a Google integration, Numative accesses data from your Google Account only through the read-only scope you grant, and only to display that data back to you inside your dashboard:

• Google Analytics (analytics.readonly): we call the Google Analytics Data API to read the aggregate reporting metrics of the GA4 property you select (such as sessions, users, pageviews, traffic sources and page performance). We never create, edit or delete anything in your Analytics account.
• Google Search Console (webmasters.readonly): we call the Search Console API to read the aggregate search metrics of the property you select (clicks, impressions, click-through rate, average position, and your top queries and pages). Read-only; we never modify the property or submit sitemaps.

We use this Google data solely to provide the Numative dashboard, reports and alerts to you, the user who authorized it. We do not sell it, do not use it for advertising, and do not allow humans to read it except with your consent, for security, or to comply with the law. It is not transferred to anyone except the subprocessors that operate our service, or as required by law. OAuth tokens are encrypted at rest, and you can revoke access at any time by disconnecting the integration in Numative or from your Google Account permissions, which removes the stored tokens.

Numative's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use a small set of infrastructure providers to run Numative. Each processes data only as needed to provide its function:

No visitor-level analytics data is shared with DataForSEO, Ahrefs or Google; those integrations concern public web pages and accounts you connect. Data is processed in the United States.

Analytics data is retained for as long as you keep your site in Numative; keeping history indefinitely is a product feature, not an accident. Deleting a site removes its analytics data, and deleting your account removes your account data, in each case within a reasonable period and subject to records we must keep for legal or billing purposes.

You can access and update account information from your account settings, export your analytics data from the product, and delete sites or your entire account. Depending on where you live, you may also have legal rights to access, correct, delete or port personal information. To exercise any of these, email support@numative.com. We respond to every verified request.

All traffic is encrypted in transit. OAuth tokens are encrypted at rest. Passwords are stored only as salted hashes. Access to production systems is limited to what operating the service requires. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as required by law.

Numative is a business tool and is not directed to children under 13. We do not knowingly collect personal information from children.

We will post any changes to this policy on this page and update the effective date. For material changes we will notify account holders by email.

Questions about privacy at Numative: support@numative.com.