Privacy Policy

Effective date: 26 February 2026
Last updated: 6 October 2026
Version: 1.0

Summary

CompactSaaS provides web analytics and related services to businesses ("Customers"). Our Customers add a tracking script to their websites, and we collect data about their website visitors ("End Users") to provide analytics dashboards and reports.

This policy covers:

• Customers — people who create a CompactSaaS account and use our dashboard
• End Users — visitors to our Customers' websites whose activity is collected by our analytics service

We collect the minimum data necessary to provide our services. We do not sell personal information. We do not use cookies for tracking. We do not collect form inputs or passwords from End Users.

Key facts:

• End User IP addresses are never stored — they are used only as an input to a pseudonymous visitor identifier (see Section 2.3) and are then discarded
• Analytics data is stored in the United States (Northern Virginia)
• End User analytics data is automatically deleted after 90 days by default
• You can contact us at privacy@compactsaas.com for any privacy enquiry

1. Who we are

CompactSaaS is operated by Compact SaaS Pty Ltd (ABN 75 680 223 965, ACN 680 223 965). Our contact details for privacy enquiries are:

• Email: privacy@compactsaas.com
• Postal address: 81-83 Campbell Street, Surry Hills NSW 2010, Australia

In this policy, "we", "us", and "our" refers to CompactSaaS. "You" refers to either a Customer or an End User, depending on context.

2. Personal information we collect

2.1 Information about Customers (account holders)

When you create a CompactSaaS account, we collect:

We also generate and store:

• A unique team identifier and user identifier
• Subscription status and billing cycle information
• API keys (stored as SHA-256 hashes only — the plaintext key is shown once at creation and never stored)

2.2 Information about End Users (website visitors)

When an End User visits a Customer's website that has our tracking script installed, we collect:

What we do NOT collect from End Users:

• We do not set cookies on End Users' browsers. The tracking scripts use a small number of browser-storage keys, including one optional persistent visitor identifier, listed in Section 10
• We do not collect form inputs, passwords, search queries typed into forms, or any text entered by the End User
• We do not collect email addresses, names, or any directly identifying information about End Users
• We do not fingerprint devices beyond the user agent string
• We do not track End Users across different Customers' websites
• We do not collect sensitive information (health, political, religious, ethnic, or sexual orientation data)

2.3 Visitor and session identification

When the persistent browser identifier described in Section 10 is not used, we count visitors with a pseudonymous identifier: a SHA-256 hash of the IP address, browser user agent and website ID, shortened to 16 characters. The IP address itself is not stored. The identifier stays the same while the IP address and browser stay the same, and changes when either changes. Because it includes the website ID, it differs between Customers' websites. It is not designed to be reversed, but we treat it as personal information.

Visits are grouped into sessions with a random session identifier that the tracking script creates and keeps in sessionStorage until the browser tab is closed (see Section 10).

2.4 Automatically collected technical information

When Customers use our dashboard or API, our infrastructure automatically logs:

• Request timestamps and HTTP method/path (in our logging system)
• Error information when something goes wrong (sent to our self-hosted error tracking service)

3. How we collect personal information

3.1 Directly from Customers

We collect Customer information when you:

• Create an account (email, password — handled by an enterprise managed identity provider)
• Complete your business profile (name, phone, country, industry, company size, tax ID, billing address)
• Add a payment method (handled by Stripe — we receive a token, not card details)
• Contact us for support

3.2 From End Users via the tracking script

Our Customers install a JavaScript tracking script on their websites. When an End User loads a page, the script sends a request to our tracking endpoint containing the data described in Section 2.2.

The tracking script:

• Runs only on page load and navigation events (or when the Customer triggers a custom event)
• Does not set cookies; uses only the browser-storage keys listed in Section 10
• Does not read or transmit form field values
• Does not access the DOM beyond the page URL, title, and referrer
• Can be blocked by standard ad blockers or browser privacy settings

3.3 From third parties

• Our content delivery network provides geographic location (country, region, city) based on the End User's IP address at the network edge. We receive only the resolved location, not the IP address used to determine it.
• Stripe provides payment status, subscription events, and invoice data via webhooks. Stripe's handling of payment information is governed by Stripe's privacy policy.

4. How we hold and protect personal information

4.1 Storage location

All data is stored on Amazon Web Services (AWS) infrastructure in Northern Virginia, United States. This means personal information about both Customers and End Users is transferred to and stored in the United States.

See Section 7 for more information about overseas disclosure.

4.2 Security measures

We implement the following security controls:

• Encryption at rest: All databases are encrypted using AWS Key Management Service (KMS). Archival storage uses dedicated KMS encryption keys.
• Encryption in transit: All data transmission uses TLS (HTTPS). Our tracking endpoint, dashboard, and APIs all require HTTPS.
• Access control: Customer authentication uses an enterprise managed identity provider with optional multi-factor authentication (TOTP). API access uses SHA-256 hashed API keys. Administrative access requires a super-admin role.
• Environment isolation: Our build infrastructure, staging environment, and production environment are isolated from each other with separate access controls and credentials.
• Object storage security: All object storage is private by default, with public access blocked, and supports versioning for recovery from accidental deletes.
• Tenant isolation: Each Customer's analytics data is partitioned by team ID in our database. Customers cannot access other Customers' data. API key authentication enforces tenant boundaries at the authoriser level.

4.3 Data retention

When analytics events expire, they are permanently deleted from our database. For websites with unlimited retention, raw events are archived to encrypted S3 storage (AWS KMS) before deletion from the primary database.

5. Purposes for collection, use, and disclosure

5.1 Customer information

We collect, use, and hold Customer information for the following purposes:

• Providing our service: Account authentication, dashboard access, API access, analytics processing
• Billing: Creating and managing subscriptions, processing payments, generating invoices, usage metering (via Stripe)
• Service communications: Sending verification codes, password resets, team invitations, anomaly alerts, and billing notifications (via AWS SES)
• Support: Responding to enquiries and resolving issues
• Security: Detecting and preventing unauthorised access, fraud, and abuse
• Legal compliance: Tax reporting, responding to lawful requests

We do not use Customer information for marketing purposes beyond service-related communications. We do not sell Customer information.

5.2 End User information

We collect and use End User information solely to provide analytics services to our Customers. Specifically:

• Analytics processing: Counting page views, tracking sessions, calculating bounce rates, identifying traffic sources, generating geographic and device breakdowns
• Real-time metrics: Showing active visitors and current pages (data retained for 1 hour in our real-time cache)
• Usage metering: Counting page views and events for billing purposes (we count the number of events, not the content)

We do not:

• Use End User data for our own marketing or advertising
• Build profiles of End Users across different Customers' websites
• Sell, rent, or trade End User data
• Use End User data for any purpose other than providing analytics to the Customer whose website the End User visited

5.3 Disclosure to third parties

We disclose personal information to the following categories of recipients:

We do not disclose End User analytics data to any third party. Analytics data is only accessible to the Customer who owns the website.

We may disclose personal information if required by law, regulation, or legal process (such as a court order or lawful request from a government authority).

6. Accessing and correcting your personal information

6.1 Customers

You have the right to request access to the personal information we hold about you, and to request correction of any information that is inaccurate, out of date, incomplete, or misleading.

To make a request, contact us at privacy@compactsaas.com. We will respond within 30 days.

You can also directly access and update much of your information through the CompactSaaS dashboard:

• Account profile and contact details
• Business classification and tax ID
• Billing address
• Team members and their roles
• API keys (create, view metadata, revoke)

6.2 End Users

If you are an End User and wish to access or correct personal information we hold about you, please contact us at privacy@compactsaas.com. Because we do not collect directly identifying information about End Users (no names, emails, or accounts), we may need to work with the relevant Customer to identify the data associated with your visit.

Note that our analytics data is pseudonymous. Session identifiers are random values created in the browser, and visitor identifiers are either a random browser identifier or a hash of the IP address, browser user agent and website ID (see Section 2.3); we treat both as personal information. Geographic data is approximate (city-level at most). We do not hold enough information to identify a specific individual from our analytics data alone.

6.3 Refusal of access

We may refuse access to personal information in limited circumstances permitted by the Privacy Act, such as where providing access would pose a serious threat to the life or health of any individual, or would unreasonably impact the privacy of other individuals. If we refuse a request, we will provide written reasons.

7. Overseas disclosure

All personal information we collect is stored and processed in the United States (Northern Virginia). This applies to both Customer account data and End User analytics data.

Our third-party service providers are located in:

We rely on contractual controls (data processing addendums) with our infrastructure providers to ensure that personal information is handled consistently with the Australian Privacy Principles.

If you are located in Australia, your personal information will be transferred to the United States when you use our service. By using CompactSaaS, you acknowledge this transfer. If you are a Customer deploying our tracking script on a website with Australian visitors, you should disclose this overseas transfer in your own privacy policy and collection notices.

8. Complaints

If you believe we have breached the Australian Privacy Principles or handled your personal information inappropriately, you can make a complaint by contacting us at:

• Email: privacy@compactsaas.com
• Postal address: 81-83 Campbell Street, Surry Hills NSW 2010, Australia

We will:

1. Acknowledge your complaint within 5 business days
2. Investigate the complaint and provide a response within 30 days
3. If we cannot resolve the complaint within 30 days, we will inform you of the reason for the delay and provide an expected timeframe

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Email: enquiries@oaic.gov.au
• Postal address: GPO Box 5218, Sydney NSW 2001

9. Our Customers' obligations

CompactSaaS acts as a data processor on behalf of our Customers. Our Customers are data controllers who determine the purpose of collecting analytics data about their End Users.

If you are a CompactSaaS Customer, you are responsible for:

• Including information about your use of CompactSaaS in your own privacy policy
• Providing appropriate collection notices to your End Users (such as cookie banners or privacy notices) that disclose the use of third-party analytics
• Ensuring that your use of our analytics service complies with applicable privacy laws in your jurisdiction
• Notifying us if you deploy our tracking script on a website that may collect sensitive information (such as a health, counselling, or religious services website)

If you deploy our tracking script on a website where the subject matter could reveal sensitive information about visitors (for example, a mental health service), you should obtain express consent from your End Users before enabling analytics tracking, as the mere act of visiting such a website may constitute sensitive information under the Privacy Act.

10. Cookies and tracking technologies

CompactSaaS does not use cookies for analytics tracking.

Our tracking scripts do not set cookies. They use the following browser-storage keys on the Customer's website. Each key is scoped to that one website, so it cannot be used to recognise an End User across different Customers' websites.

Controls. The persistent visitor identifier (aa_visitor_id) is not written or sent when any of the following applies, and the advanced tracking script also removes any value left by an earlier visit:

• The Customer has turned on the "No persistent visitor ID" setting for that website and installed the updated snippet, which carries data-persistent-id="false". From the moment the setting is on, our ingestion service also ignores any visitor identifier a browser sends for that website, even before the snippet is updated.
• The End User's browser sends a Global Privacy Control signal.
• The End User's browser sends a Do Not Track signal.

When the persistent identifier is not used, we derive a pseudonymous identifier on our servers from a hash of the IP address, user agent and website ID; the IP address itself is not stored. If the browser blocks storage, the scripts write nothing and keep working with values held in memory for that page load only.

These controls apply to browser tracking. On the server-to-server API (/v1/track), the Customer supplies the visitor identifier and is responsible for honouring their visitors' privacy preferences; when the "No persistent visitor ID" setting is on, /v1/track drops any supplied visitorId.

Our Customer dashboard (the CompactSaaS web application) uses standard authentication cookies managed by our identity provider for maintaining your login session. These are strictly necessary for the functioning of the dashboard and are not used for tracking or analytics purposes.

11. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify Customers via email or dashboard notification for significant changes

We encourage you to review this policy periodically.

12. How to contact us

For any questions, concerns, or requests related to this privacy policy or our handling of personal information:

• Email: privacy@compactsaas.com
• Postal address: 81-83 Campbell Street, Surry Hills NSW 2010, Australia

This privacy policy was last reviewed on 26 February 2026. It applies to the CompactSaaS service operated by Compact SaaS Pty Ltd (ABN 75 680 223 965).