Browse Security and privacy
Data protection
Where events are stored, how long they are kept, and how visitors are protected.
Where your data is stored
Each organisation is created in one region, which can never change. Events are collected and stored in the EU, on Google Cloud. Each organisation's events are kept apart, and its Analytics reads only its own.
How long it is kept
Collected events are kept for 400 days.
Protecting your visitors
- Each capture feature is off until you turn it on, apart from page views and page signals.
- The tag respects consent, and events without it are stored without any identifying details and left out of Analytics. See Consent.
- IP addresses are never stored: only a shortened address, a hash that changes daily, and a location.
- Passwords, card security codes, one-time codes, PINs and anti-forgery tokens are never sent.
- Page URLs are cleaned of parameters you have not chosen to keep, and of email addresses, tokens and card-like numbers.
Some of what you capture can still be personal data, such as what visitors type into forms, a signed-in user's email address, or a Shopify buyer's contact details. Privacy and governance explains exactly what is kept, and how to leave parts of your pages out.
Your obligations
You decide what Kontala captures on your site, so you remain responsible for telling your visitors about it, and for asking their consent where the law requires it.