Privacy notice.
How kindstats handles personal data, what we collect, why, where it lives, and the rights you have over it.
1. Who this notice applies to
This notice describes how Nineties Engineering OÜ, Sepapaja 6, 15551 Tallinn, Estonia (registry code 16206643) ("kindstats", "we", "us") processes personal data in two distinct situations:
- As a processor, on behalf of our customers, when their website visitors interact with sites that have the kindstats analytics script installed.
- As a controller, for visitors to
kindstats.com, people who sign up for an account, and people who contact us.
If you are a customer using kindstats to analyse traffic on your own website, the terms governing that processing live in our Data Processing Agreement.
2. Visitors to sites using kindstats
When a website uses our analytics script, kindstats collects information about each pageview without setting cookies and without persisting an identifier for the visitor.
What we collect
For each pageview we collect the page URL, the referrer host (host only, not the full URL), the approximate country derived from a local GeoIP lookup, the device class (phone, tablet or desktop), the browser family and the OS family. Beyond that, we only collect events the site operator explicitly chooses to send.
What we do not collect
We do not set or read any cookies. We do not store IP addresses; any incoming IP address is irreversibly hashed with a salt that rotates daily, making it irrecoverable. We do not fingerprint canvas, audio or WebGL, and we do not persist any identifier across sites or devices. We never sell, share or enrich data with third parties.
The legal basis for this processing is set by our customer, typically legitimate interest in measuring traffic on their own service. Because kindstats is cookieless and does not access or store information on the visitor's device, our customers generally do not need cookie consent to use it. Customers are responsible for confirming this in their own jurisdiction.
3. Account holders & visitors to kindstats.com
For our own marketing website, signup flow, billing and support, we act as a controller and process:
- Account data: email address, name, organisation name, billing details.
- Site configuration: the domains you've added, timezone, dashboard settings.
- Support correspondence: messages you send us by email or via the contact form.
When you use a form (such as signup or login) or sign in to your account, we set two strictly necessary first-party cookies: a session cookie that keeps you signed in and a CSRF cookie that protects forms against cross-site request forgery. These are required for the dashboard to function, are not used for tracking, and are exempt from consent under the ePrivacy rules.
4. Legal basis for processing
| Purpose | Legal basis (GDPR) |
|---|---|
| Operating the analytics service for customers | Performance of a contract (Art. 6(1)(b)) |
| Billing and accounting | Legal obligation (Art. 6(1)(c)) |
| Security, abuse prevention, troubleshooting | Legitimate interest (Art. 6(1)(f)) |
| Replying to support and sales enquiries | Legitimate interest (Art. 6(1)(f)) |
| Product-update and security emails | Legitimate interest (Art. 6(1)(f)) |
| Optional marketing emails | Consent (Art. 6(1)(a)), opt-in, opt-out anytime |
5. Sub-processors & international transfers
A current list of sub-processors is maintained in our Data Processing Agreement. We notify customers of new sub-processors before they begin processing, with a 30-day window in which to object.
6. Retention
- Analytics data: raw events and the history available in reports are retained for 36 months from collection, subject to earlier deletion at the customer's request or following termination as described in our Data Processing Agreement.
- Account data: retained for the lifetime of the account, plus the period required by tax law (Estonia: 7 years for invoicing records).
- Support correspondence: retained for 24 months after the case is closed.
- Server & security logs: retained for up to 30 days, then deleted; used only for security, abuse prevention and troubleshooting.
7. Your rights under the GDPR
If you are in the EEA, the UK or Switzerland, you have the right to access, rectify, erase, restrict and port the personal data we hold about you, and to object to certain processing. To exercise any of these rights, email privacy@kindstats.com. We respond within 30 days.
You also have the right to lodge a complaint with a supervisory authority. Our lead authority is the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate).
8. Changes to this notice
We may update this notice from time to time. Material changes are announced at the top of this page and, for customers, by email at least 30 days before they take effect. The "effective" date at the top reflects the current version.