Privacy
& Transparency
Worried about data collection?
So are we. That's why we built Webful differently.
Our commitment
Webful is designed to respect your privacy and that of your visitors.
Radical minimalism
We collect only the data necessary for the service: page views, time spent, referrer (where your visitors come from). No personal data is collected.
Hosted in Europe
All your data is stored on servers in Europe (OVH France). It never leaves European territory. No transfer to the United States or other third countries.
Full anonymization
IP addresses are anonymized immediately (last octets removed). We use random session identifiers, without cookies.
Your data belongs to you
Download all your data in XML anytime from your dashboard. You can also request complete deletion of your data in one click.
What data exactly?
Full transparency: here is everything we collect.
| Data collected | Why | Duration |
|---|---|---|
|
Visited page URL
E.g.: /contact.php
|
To know which pages are visited | 24 months (Pro) / 3 months (Free) |
|
Time spent on page
In seconds
|
To measure engagement | 24 months (Pro) / 3 months (Free) |
|
Referrer
E.g.: google.com, direct
|
To know where your visitors come from | 24 months (Pro) / 3 months (Free) |
|
Device type
Desktop, mobile, tablet
|
To optimize mobile experience | 24 months (Pro) / 3 months (Free) |
|
IP address (anonymized)
192.168.x.x → 192.168.0.0
|
To detect unique visits (session) |
Immediate
The full IP is never stored
|
|
Session ID (random)
E.g.: abc123xyz789
|
To group pages of the same visit | 24 months (Pro) / 3 months (Free) |
What we do NOT collect
- ❌ No name, surname, email of your visitors
- ❌ No full IP address
- ❌ No third-party cookies (Google, Facebook, etc.)
- ❌ No browser fingerprinting
- ❌ No cross-site browsing data
"In-app" product analytics (option)
For software vendors who measure usage of their own application.
The In-app option lets a software vendor measure how their users interact with THEIR application (features used, journeys, activation). This processing is separate from the website tracking described above.
Our role: data processor
For this option, the vendor who installs our code remains the data controller: they decide what they measure about their users. Webful acts as a data processor under the GDPR: we process this data solely on their behalf and per their instructions. The terms of this processing are set out in our Data Processing Agreement (DPA), an annex to the Terms of Sale.
Opaque identifier, no mandatory personal data
The user is identified by an opaque identifier chosen by the vendor (for example an internal number). Webful itself collects no personal data (no email, no name). If the vendor chooses to send us an email or a name to recognize their users, they do so under their own responsibility and after obtaining the necessary consent.
Two retention periods
- • Detailed data (each recorded action): retained for 90 days, then automatically deleted by a daily script.
- • Aggregated statistics (usage curves, retention rates, with no individual detail): retained for 24 months to allow tracking over time.
As with everything else, the right to erasure is guaranteed: the vendor can request the complete deletion of one of their users' data at any time (detail + statistics), via a dedicated function.
How does it work technically?
For the curious and developers.
1. A visitor arrives on your site
The Webful script (webful-tracker.js) runs in the browser. It is hosted on your servers (no external CDN).
<script src="/wp-content/plugins/webful/assets/js/webful-tracker.js"></script>
2. Anonymous session generation
A random identifier is generated in the browser (localStorage). No cookies. This ID automatically changes after 30 minutes of inactivity.
sessionId: generateRandomId() // Ex: "wbf_abc123xyz789"
3. Data transmission (HTTPS only)
Data is sent to the Webful API encrypted via HTTPS. The visitor's IP address is anonymized server-side immediately.
POST /api/track.php
{
"site_id": "WBF-12345",
"url": "/contact.php",
"referrer": "google.com",
"device": "desktop",
"session_id": "wbf_abc123xyz789"
}
// IP anonymized: 192.168.45.123 → 192.168.0.0
4. Secure storage in Europe
Data is stored in a MySQL database hosted at OVH France. Encrypted connection, daily backups, restricted access.
5. Automatic data deletion
An automatic script (CRON) deletes data beyond your plan's retention period: 24 months for Pro accounts, 3 months for Free accounts. You can also request immediate deletion from your dashboard.
Export all your data in XML
In compliance with GDPR, you can download all the data from your site.
What's included
- ✓ All page views
- ✓ All referrers
- ✓ Time spent per page
- ✓ Anonymized sessions
- ✓ Device type used
- ✓ SEO data (scores, analyses)
- ✓ Tracked conversions
Format & usage
- ✓ Standard XML format
- ✓ Compatible with Excel, LibreOffice
- ✓ Usable by scripts (Python, etc.)
- ✓ Precise timestamps
- ✓ Instant export (under 5 sec)
- ✓ No download limit
How to export your data?
Log in to your Webful Dashboard → "Settings" tab → "My data" section → Click "Download my data (XML)"
Go to my DashboardYour GDPR rights
You have full control over your data.
Right of access
View all your data from your dashboard, anytime.
Right to portability
Export your data in XML to use elsewhere.
Right to erasure
Delete all your data in one click from settings.
Right to rectification
Correct your account information anytime.
Right to object
Disable tracking for your site in one click.
Right to restriction
Request temporary freeze of your data.
Any questions about your data or your rights?
Contact our teamFrequently asked questions
Does Webful use cookies?
Do I need to display a cookie consent banner?
Who can access my data?
How do I permanently delete my data?
Does Webful share data with Google or Facebook?
How long is data retained?
Respectful tracking, finally.
Join the websites that chose transparency.
Free for 1 month - No credit card - Cancel in one click