Site Logo

Privacy Policy

Last updated: August 11, 2026

This Privacy Policy explains how Key Arg B.V. ("we", "us", "our") collects, uses, and processes information when:

  • you visit our website located at https://dev.statable.com(the "Website");
  • you create an account or use our analytics services (the "Services") as a customer ("Customer"); or
  • our analytics script is deployed on a third-party website that you visit.

We are committed to providing a privacy-focused analytics service and to minimizing the collection and processing of personal data.

1. Scope Of This Privacy Policy

This Privacy Policy applies to three different situations:

  • Visitors of our Website.
  • Customers who create an account and use our Services.
  • Visitors of websites that use our analytics script.

Different types of information may be processed depending on how you interact with us.

2. Privacy-First Design

Our analytics system is designed to minimize personal data collection and to prevent identification of individual website visitors.

Our analytics system does not use cookies, browser storage (such as localStorage or sessionStorage) or device fingerprinting techniques to identify visitors.

We do not attempt to uniquely identify individual devices or users across websites, browsers or time periods, and we do not track individuals across multiple websites, services or applications.

Our analytics system is designed so that visitor identifiers are unique to each website and cannot be correlated across different websites using our Services.

Key principles include:

  • The analytics script does not use cookies.
  • Raw IP addresses are not written to the analytics database.
  • A temporary pseudonymous identifier is generated and rotated daily.
  • Cross-site tracking is not performed.
  • Visitor identifiers cannot be linked across different websites.

Our goal is to provide website analytics while significantly reducing privacy risks for website visitors.

3. Information Collected When You Visit Our Website

When you visit our Website without creating an account, we do not set tracking cookies, we do not profile you and we do not use your data for advertising.

We do measure traffic on this Website using Statable itself. That measurement works exactly as described in section 9: no cookies, nothing stored on your device, and your IP address and User-Agent used only to compute a per-day identifier which is then discarded. For this Website we are the controller of that measurement, and our legal basis is our legitimate interest (Article 6(1)(f) GDPR) in understanding how our own site is used. If your browser sends a Do Not Track or Global Privacy Control signal, our script collects nothing at all.

However, limited technical information may be processed automatically for security and operational purposes through standard server logs and infrastructure services.

This may include:

  • IP address (processed transiently by infrastructure providers but not stored by us),
  • browser type,
  • operating system,
  • request timestamps,
  • error logs.

This information is used solely for security monitoring, preventing abuse or attacks and maintaining the availability of the Website.

4. Information Collected When You Create An Account

To use our Services, you must create an account.

During registration we may collect:

  • email address,
  • authentication provider identifier (if you sign in through Google).

Authentication is performed through one-time verification codes sent to your email address, rather than passwords.

We store:

  • your email address,
  • account metadata,
  • authentication events,
  • sign-in history: for each sign-in we record the IP address, approximate location (country and city) and browser used, so that you can recognise unfamiliar sessions and so that we can investigate account abuse. These records are kept while the corresponding session remains valid.

5. Third-Party Authentication Providers

Users may also create an account or sign in using third-party authentication providers such as Google.

When you choose this option, the authentication provider may share certain information with us, including:

  • your email address,
  • a unique authentication identifier.

We use this information solely to create and manage your account and to authenticate your access to the Services.

We do not receive access to your Google password or other information from your Google account.

Your use of third-party authentication services is subject to the privacy policies of those providers.

Google's Privacy Policy is available at https://policies.google.com/privacy.

6. Authentication Cookies

To keep you logged in to your account, we use authentication cookies.

These cookies are strictly necessary for the functioning of the Service.

We use two authentication tokens:

  • Access token: is stored in a cookie, valid for a few minutes (currently 5).
  • Refresh token: is stored in a cookie, valid for approximately 7 days.

These cookies are used only for authentication. They are not used for tracking or advertising and are not shared with third parties.

7. Payment Information

Payments for the Services are processed by Stripe. When you purchase a subscription, payment information is submitted directly to Stripe.

We do not store full payment card details. Stripe may provide us with limited information necessary to manage subscriptions, including:

  • billing email address,
  • payment status,
  • subscription status,
  • transaction identifiers.

Stripe processes payment data according to its own privacy policy.

8. Data Retention

Analytics data is retained while the Customer's account exists. We do not delete it automatically when a subscription lapses: the Customer can delete individual websites or the entire account at any time from the dashboard, and we delete the associated analytics data on request. Deletion is permanent and immediate.

Operational and security logs are retained for a limited period where necessary for security and reliability.

9. Analytics Data Collected Through Customer Websites

When our analytics script is deployed on a Customer's website, it collects limited, non-identifying data about page visits and interactions.

This data may include:

  • page URL and referrer URL, stored without query strings or fragments — campaign parameters (UTM) are extracted into separate fields and the rest of the query string is discarded at ingest,
  • browser type,
  • operating system,
  • device type,
  • country, region and city (derived from the IP address via a local GeoIP database; the IP itself is not retained). City-level data includes approximate city-centre coordinates used for map widgets — never the visitor's precise location,
  • page view timestamps,
  • session duration,
  • engagement time and scroll depth,
  • outbound link clicks and file downloads, when those features are enabled,
  • custom events (if configured by the Customer).

A temporary pseudonymous visitor identifier is generated using a keyed hash of the visitor's IP address, User-Agent, the site identifier and the calendar date. The key is a secret held only by us. The raw IP address is not written to the analytics database.

This identifier is unique per website and cannot be used to track visitors across different websites.

10. Infrastructure And Hosting

Our Services run on our own servers, located in the Netherlands at the NorthC data centre in Oude Meer. NorthC provides the facility — rack space, power and physical security — and has no access to the data on our servers.

We implement reasonable technical and organizational measures to protect the Services.

We use Bunny as a content delivery network and proxy. Bunny may process network traffic information including:

  • IP addresses,
  • request headers,
  • routing data.

Bunny's privacy policy is available at https://bunny.net/privacy/.

11. Security Monitoring

We maintain security and operational logs, including:

  • server access logs,
  • abuse monitoring logs,
  • a diagnostic log of requests our analytics endpoint could not process. It exists solely so that we can find and fix faults, and it is never used for analytics, reporting or profiling.

These logs are used only for security and operational purposes.

12. Legal Bases For Processing

When we act as a data controller, we process personal data on the basis of the legal grounds permitted under applicable data protection laws, including performance of a contract, legitimate interests, and compliance with legal obligations.

Performance of a Contract

We rely on the performance of a contract to:

  • provide the Services to Customers;
  • create and manage user accounts;
  • authenticate users when logging into the Services;
  • assist with the resolution of technical or other issues related to the Services;
  • manage our relationship with you and communicate with you, including:
    • operational and transactional communications related to ordering and using the Services;
    • notifications about changes to our Services, new features, or security updates;
    • responses to support requests and other communications necessary for the provision of the Services;
  • provide information that you have requested from us or that we are required to send to you in connection with the Services;
  • exercise our rights and perform our obligations under our agreements with you.

Legitimate Interests

We rely on our legitimate interests, provided that these interests are not overridden by your rights and freedoms, to:

  • improve and develop our products and services;
  • conduct research, testing, and analysis of our products and features;
  • monitor and analyze usage of our Services and Websites;
  • promote and increase engagement with our products;
  • send marketing communications, including information about new services, newsletters, product offers, and promotions that may be relevant to you.

You may opt out of marketing communications at any time by:

  • using the unsubscribe link in our emails;
  • updating your communication preferences in your account settings; or
  • contacting us at support@statable.com.

We may also rely on legitimate interests to disclose information in connection with a corporate transaction, such as a restructuring, merger, acquisition, financing, or sale of assets.

Legal Obligations

We process personal data when necessary to comply with legal obligations, including to:

  • prevent, detect, and report unlawful or fraudulent activities;
  • ensure network and information security;
  • protect our users, our Services, and our infrastructure;
  • comply with applicable laws, regulations, legal processes, or governmental requests.

13. Disclosure Of Information

We may disclose information described in this Privacy Policy to:

  • Third-party service providers and partners that assist us in operating the Services and Websites, including those described in this Policy.
  • Regulators, courts, law enforcement agencies, government authorities, fraud prevention agencies, or other third parties where we believe disclosure is necessary to comply with applicable law or legal process, enforce our legal rights, protect our users or the public.
  • Actual or potential buyers and their advisers in connection with a merger, acquisition, restructuring, financing, or sale of all or part of our business.

You can contact us to let us know that you object to the further use or disclosure of your personal data for certain purposes, such as for direct marketing purposes.

14. International Data Transfers

Your analytics data is processed and stored exclusively on servers in the Netherlands and is not transferred outside the EEA.

Account and billing data may be processed outside the EEA by our payment provider (Stripe, United States) and, if you choose to sign in with Google, by Google LLC (United States), or GitHub (United States). Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.

15. Data Subject Rights

Depending on applicable data protection laws and subject to certain limitations, you may have the following rights with respect to personal data that we process as a data controller:

  • You have the right to request access to your personal data and to obtain a copy of it.
  • You have the right to request correction of inaccurate or incomplete personal data.
  • You may request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.
  • You may request restriction of processing in certain situations, for example while we verify an objection you have raised.
  • Where applicable, you may request that your personal data be provided in a structured, commonly used, and machine-readable format and transmitted to another controller.
  • You may object to the processing of your personal data in certain circumstances, including where personal data is used for direct marketing purposes.
  • If you believe that your personal data is being processed in violation of applicable data protection laws, you have the right to lodge a complaint with your local data protection authority.

Exercising Your Rights

You may exercise your rights by contacting us at support@statable.com.

We may request information necessary to verify your identity before responding to your request.

Please note that we can assist you with exercising your rights only where we act as the data controller of your personal data (for example, when we process your email address for account management or marketing communications).

If you interact with a website that uses our analytics Services, the website owner acts as the data controller for analytics data collected through that website. Any requests relating to such analytics data should be directed to the relevant website owner.

Where applicable, we will assist our Customers in responding to requests relating to analytics data in accordance with applicable data protection laws.

16. Children's Privacy

Our Services are not intended for individuals under 18; our analytics is not knowingly used to collect data from children under 13.

17. Changes To This Policy

We reserve the right, at our sole discretion, to put into effect, modify or revise this Policy at any time by posting this Policy or revised Policy on this page. The Policy or any changes will become effective upon posting of the revised Policy. Depending on the significance of the changes to this Policy we will use reasonable efforts to inform you by posting a notice on the Website or by using other ways to notify you about the changes.

18. U.S. Privacy Rights Notice

How we act. Where a Customer runs Statableon a website directed at U.S. residents, we act as that Customer's service provider under the CCPA/CPRA, and as a processor under other U.S. state privacy laws. We process visitor data only to provide the analytics service under our Terms and our Data Processing Agreement, and we do not retain, use or disclose it for any other purpose.

What we do not do. We do not sell or share personal information, as those terms are defined by the CCPA/CPRA. We do not use personal information for cross-context behavioural advertising or for profiling, we do not combine visitor data across our Customers, and we operate no advertising network.

Opt-out preference signals.Our analytics script checks for Global Privacy Control and Do Not Track before it sends anything. When either signal is present the script collects and transmits nothing at all, so no request about that visit ever reaches us. This applies to every visitor worldwide, by default, whether or not a U.S. state law requires it and with no configuration on the website owner's side.

Rights requests.Rights relating to analytics data collected through a Customer's website should be directed to the operator of that website, who determines the purposes of the processing; we assist our Customers in responding to such requests. For personal data we hold in our own right — your account email address and billing details — you may contact us at support@statable.com to request access, correction or deletion. We will not discriminate against you for exercising any of these rights.

Applicability. Several U.S. state privacy laws apply only above revenue or volume thresholds that our business does not currently meet. Where that is so, the commitments above are ones we make voluntarily and apply regardless. If our activities change such that these laws apply to us directly, we will update this notice.

19. Contact Information

If you have any questions about this Privacy Policy, please contact us:

  • Email: support@statable.com
  • Address: Key Arg B.V., Herckenrathstraat 1, 2681 DG Monster, South Holland, the Netherlands
  • Chamber of Commerce (KvK): 89388496