Last updated: [date of publishing]
Statblaze shows you how your website is doing, using data from your Google Analytics and Google Search Console. This policy explains what personal data we hold, why, and your rights. We keep it as short as we can, and we only ever ask Google for read-only access.
1. Who we are
Statblaze is run by [Legal name], [Address] (“Statblaze”, “we”, “us”). We are the controller of the personal data described here, except where section 4 says we act for an agency. Contact us at hello@statblaze.com. [ICO registration number]
2. What we collect
| What | Examples | Where it comes from |
|---|---|---|
| Account details | Your name and email address | Google, when you sign in |
| Google access | Read-only access tokens for Google Analytics and Search Console, stored encrypted | Google, when you approve access |
| Website reports | Daily totals such as visitors, views, clicks, page addresses, search terms, countries and device types | Your Google Analytics and Search Console |
| Things you set up | Websites, clients, tracked keywords, embed links, branding colours and logos | You |
| Billing | Your plan, subscription status and a Stripe customer reference. Card details are held by Stripe, never by us | You and Stripe |
| Technical data | IP address, browser type and the pages requested, in our hosting provider’s logs | Your browser |
The website reports are mostly anonymous totals (for example “1,240 visits from the UK”). Occasionally a page address or search term can contain personal details, such as a name typed into a search. We treat all report data as confidential.
3. Google user data
Statblaze’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms:
- We use Google data only to show you, and the people you choose to share embeds with, your dashboards and reports.
- We never sell it, use it for advertising, or use it to train AI models.
- People at Statblaze don’t look at it, except with your permission to fix a problem, for security, or where the law requires.
- You can remove our access at any time in your Google account permissions, or by deleting your Statblaze account.
4. Agencies and their clients
When an agency connects its clients’ Google properties, the agency decides what data is processed and why, and Statblaze processes it on the agency’s behalf. The agency is the controller and Statblaze is its processor, under our Data processing agreement. Clients of an agency should contact the agency about their data.
5. Why we use your data, and our lawful bases
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Running your account and showing your dashboards | Contract |
| Taking payments and keeping billing records | Contract, and legal obligation (tax records) |
| Keeping Statblaze secure and preventing misuse | Legitimate interests |
| Answering your messages and sending service emails (for example a failed payment) | Contract |
| Improving Statblaze, using our own records of how features are used (never your Google data) | Legitimate interests |
We don’t send marketing emails without your consent, and you can stop them at any time.
6. Who we share it with
We use a small number of trusted providers to run Statblaze. Each may only use the data to provide their service to us.
| Provider | What they do | Location |
|---|---|---|
| Vercel Inc. | Hosts the Statblaze app | United States and worldwide edge network |
| Neon Inc. | Hosts our database | [Neon region] |
| Stripe | Takes payments and manages subscriptions | United States and Ireland |
| Google LLC | Sign-in, and the source of your Analytics and Search Console data | United States |
| GoDaddy | Hosts our marketing website, statblaze.com/ (no account data) | United States |
We may also share data if the law requires it, or with a buyer if Statblaze is ever sold (they would be bound by this policy). We never sell personal data.
7. International transfers
Some providers are based in the United States. Where data leaves the UK, we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or on the UK International Data Transfer Agreement or Addendum.
8. How long we keep it
- Your account and settings: until you delete your account.
- Website reports: 6 months of history on the Free plan; the full history you’ve built up on paid plans, for as long as your account is open.
- When you delete your account: everything is removed from our database straight away, and our access to Google is revoked. Database backups roll off within 7 days.
- Billing records: kept by Stripe and us for 6 years, as UK tax law requires.
- Hosting logs: a short period, normally a few days.
9. Security
All connections use HTTPS. Google access tokens are encrypted before they reach our database, sign-in cookies are encrypted, and every request is checked so each account can only see its own data. Embedded reports use long secret links that can be locked to a website, given an expiry date, or revoked.
10. Cookies
The Statblaze app uses only cookies that are strictly necessary to make it work, so no consent banner is needed:
| Cookie | Purpose | Lasts |
|---|---|---|
| sb_session | Keeps you signed in | 14 days |
| sb_oauth_state | Protects Google sign-in from forgery | 10 minutes |
| sb_plan | Remembers the plan you picked while you sign in | 30 minutes |
Embedded reports don't set cookies. Stripe's checkout pages set their own cookies to prevent fraud. statblaze.com/ does not currently use analytics or advertising cookies.
11. Your rights
You can ask us to see, correct, delete or move your data, or to restrict or object to how we use it. Most of this you can do yourself: edit or remove websites in the app, and delete your whole account in Settings. For anything else, email hello@statblaze.com and we’ll reply within one month.
If you’re unhappy with how we’ve handled your data, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk or 0303 123 1113.
12. Children
Statblaze is for businesses and isn’t meant for anyone under 18.
13. Changes
If we change this policy in a way that matters, we’ll email account holders before the change takes effect. The date at the top shows the latest version.