Privacy notice templates

When you collect personal information from people, privacy law in most places expects you to tell them, at or before collection, who you are, why you collect it, who receives it and how to reach you. Using CompactSaaS does not do that for you: you are the one publishing the website, link or QR code.

This page gives you notices to adapt for the CompactSaaS features that touch your visitors. Each one describes what CompactSaaS processes for that feature. You supply the parts only you can: your identity and contact details, your purposes and your lawful basis.

These templates are a starting point, not legal advice. Have your own adviser check them against the law that applies to you before you publish.

Fill in the variables

Each template marks the parts you must replace with angle brackets. Replace every one before you publish. A notice that still shows a bracketed variable tells your visitors nothing.

The templates also use the word "Customer" for you, the person who publishes the website, link, QR code or report (as in "the Customer’s purposes", "Customer analytics" or "Customer-selected destination"). Where it stands alone, replace it with "we" or your name.

CompactSaaS's own address for questions about CompactSaaS's handling of the information is privacy@compactsaas.com. The CompactSaaS Privacy Policy explains how CompactSaaS handles it.

Analytics

Put this on every site or app that runs the CompactSaaS tracking script, in a place visitors see before or as the script runs, such as a privacy page linked from every page.

Analytics notice

<Customer legal name> uses CompactSaaS Analytics, supplied by Compact SaaS Pty Ltd, to understand use of this website or application.

When analytics is enabled, <Customer legal name> and CompactSaaS may collect the page hostname and path, full query string, page title, full referrer, campaign and click identifiers, custom events and event data, browser language, screen dimensions, user agent, browser/device characteristics, coarse country information, timestamps and pseudonymous session or visitor identifiers.

CompactSaaS's standard tracker does not inspect form fields. Information can nevertheless be included by <Customer legal name> in custom event data or appear in URLs, query strings, titles or referrers.

The tracker uses sessionStorage to maintain a pseudonymous session identifier. It does not use analytics cookies or localStorage for that identifier. Request infrastructure processes an IP address to route and secure the request and derive coarse location and pseudonymous identifiers. The IP address is intended not to form part of the Customer-facing analytics event, but may occur in infrastructure logs.

We use this information to produce website/app analytics, operate and secure the service and investigate errors. AWS processes it principally in the United States. If analytics information is not collected, the underlying page may still operate, but <Customer legal name> will not receive the corresponding analytics.

Contact <Customer privacy contact> about the Customer’s purposes, lawful basis and choices. CompactSaaS's Privacy Policy (https://compactsaas.com/privacy-policy/) explains its handling of the information.

Two things only you can add: the purposes for which you use the analytics, and the lawful basis or consent you rely on. Do not put personal information into custom event data, URLs or page titles unless your notice says so.

Short links, redirects and custom domains

A short link or redirect sends the visitor straight to its destination, so there is no moment to show a notice. Put this on the page, message, advertisement or QR code where people first meet the link.

Link and redirect notice

This link is operated for <Customer legal name> using CompactSaaS. When you request it, Compact SaaS Pty Ltd's network and request infrastructure processes information including IP address, user agent, referrer, country, host, URI, protocol, response status, edge location and time. This operational processing may occur whether or not Customer analytics is enabled.

If <Customer legal name> has enabled link analytics, CompactSaaS may also create a pseudonymous event containing destination/referrer, device, country and traffic-source information.

The link redirects you to a Customer-selected destination. The destination operator receives ordinary request information and handles it under its own privacy terms. If the information is not processed, CompactSaaS cannot resolve or secure the redirect.

Contact <Customer privacy contact> or privacy@compactsaas.com. See the CompactSaaS Privacy Policy (https://compactsaas.com/privacy-policy/).

CompactSaaS also keeps a privacy route on its own domain: https://compactsaas.com/privacy/ sends the visitor to the Privacy Policy. You can name it in your notice for people who reach a link without seeing your page first.

QR codes

Put this next to the printed or displayed QR code, or on the page that shows it. CompactSaaS shows its own notice on the landing page for Wi-Fi, contact and calendar codes; your notice covers the moment before the scan.

QR privacy notice

This QR code was published by <Customer legal name> using CompactSaaS. Scanning or invoking it may reveal or act on a structured payload selected by that Customer, which may include a URL, Wi-Fi details, email address, telephone/SMS content, coordinates, contact card or event information.

Anyone with the QR code or a valid associated action URL may be able to retrieve the payload without logging in. Do not scan or share it if you do not trust the publisher. Your device, operating-system provider, destination operator or communications provider may process the payload independently.

CompactSaaS processes request, device and security information to deliver and secure the QR service. Contact <Customer privacy contact> about the content and privacy@compactsaas.com about CompactSaaS processing.

Public analytics shares

A public share link lets anyone who has the link see a website's report. Put this wherever you post or send the link, and tell the people you send it to that the link can be forwarded. CompactSaaS shows its own notice on the report page.

Public analytics report

This report was made public by <Customer legal name> using CompactSaaS. Anyone with the share URL may view the website's name and domain and, for a period they choose of up to one year, its total pageviews, visitors and events, its pageviews, visitors and events for each day, and the ten pages, referring websites, browsers and visitor countries with the most recorded events. The report shows totals and rankings, not individual visits, but on a website with little traffic a short period can relate to a single visit. The link stops working when it expires — no more than 365 days after it was created — or sooner if the Customer turns it off or deletes it, or deletes the website or its team.

CompactSaaS processes request and security information when you view the report. Contact <Customer privacy contact> about the report and privacy@compactsaas.com about CompactSaaS processing.

Keeping your notices accurate

• Review each notice when you turn a feature on or change how you use it.
• If you add custom event data, say what it holds.
• If someone asks you about information you collected with CompactSaaS, answer them yourself: you decide the purposes for which you collect it. For what deleting your team removes, and what you can ask CompactSaaS to delete, see Team and account.