Your data. Your rules.

1. Who we are

AI Infos Web Statistics ("we", "us", "our") is a web analytics platform operated by AI Infos. We provide a privacy-respecting website analytics service to website owners ("Customers") who install our tracking script on their websites ("Websites").

This policy covers:

• Visitors to our Websites — people who visit the websites of our Customers that have installed our tracking script.
• Users of our Service — Customers who create an account on AI Infos Web Statistics.
• Visitors to our own site — people who visit stats.iqbalmahmud.com (this website).

2. Data collected about end visitors

When a visitor lands on a website that uses our tracking script, we collect the following information to generate analytics:

• Page URL and referrer URL — so we can track which pages are visited and where traffic comes from.
• UTM parameters — campaign source, medium, name, content, and term (if present in the URL).
• Browser type, OS, and device category — derived from the User-Agent header (desktop/tablet/mobile).
• Visitor country — derived from the IP address via a server-side GeoIP lookup. The raw IP address is never stored in our database.
• A daily anonymous session hash — we compute a non-reversible hash (SHA-256) of the IP address + User-Agent + date. This hash resets every 24 hours and cannot be used to track a visitor across days or across sites. We use it solely to distinguish unique visitors within a single day.

We do not use fingerprinting, supercookies, localStorage, IndexedDB, or any other technique to track visitors across sites or sessions.

3. Data collected about registered users

When you create an account and use our dashboard, we collect and store:

• Name — the name you provide during registration.
• Email address — used for login, password resets, and optional reports/alerts.
• Password — stored as a bcrypt hash. We never store plaintext passwords.
• Account settings — timezone, notification preferences, two-factor authentication settings.
• Billing information — if you subscribe to a paid plan, payment processing is handled by our payment processor. We store only your plan level and renewal date, not card details.
• API tokens — stored as bcrypt hashes. Used to authenticate API requests.
• Support messages — if you contact us via the contact form, we store your name, email, and message content.

We use this data to provide and improve the Service, authenticate you, send transactional emails (password resets, alert notifications, reports), and respond to support requests.

4. Cookies

Our tracking script sets no cookies whatsoever. Websites that install our script do not need to display a cookie consent banner for analytics purposes.

Our own dashboard (the application at stats.iqbalmahmud.com) uses one strictly-necessary session cookie:

• Session cookie — a secure, HttpOnly cookie that keeps you logged in while you use the dashboard. It expires when you close your browser or log out.

No analytics, marketing, or tracking cookies are set on our own website either. We eat our own cooking — we track our own site traffic using our own cookieless script.

For full details, see our Cookie Policy.

5. Third parties and sub-processors

We do not sell your data or your visitors' data to any third party. We do not share data with advertisers. We do not use Google Analytics, Facebook Pixel, or any third-party tracking on our own website.

We work with a small number of sub-processors to operate the service:

• Hosting provider — our infrastructure runs on servers located in [your server region]. Your data is stored in this region.
• Email delivery — we use a transactional email provider to send system emails (password resets, reports, alerts). Only your email address is shared with them for delivery purposes.
• Payment processor — if you have a paid plan, payments are processed by our payment gateway. We do not receive or store card numbers.

6. Data retention

• Analytics data — retained for as long as your account is active. If you delete a website from your account, its analytics data is permanently deleted within 30 days.
• Account data — retained while your account is active. If you delete your account, all personal data is deleted within 30 days.
• Contact form messages — retained for up to 2 years for record-keeping, then permanently deleted.

7. Security

We implement industry-standard security practices:

• All data in transit is encrypted via TLS (HTTPS).
• Passwords are hashed with bcrypt (cost factor 12).
• API tokens are never stored in plaintext.
• Databases are not exposed to the public internet.
• Two-factor authentication is available for all accounts.
• Regular automated backups are performed.

No system is 100% secure. If you believe you've found a security vulnerability, please report it to [email protected] and we will respond promptly.

8. Your rights

Depending on where you are located, you may have the following rights regarding your personal data:

• Right to access — request a copy of the personal data we hold about you.
• Right to rectification — correct inaccurate data (you can update most data directly in your account settings).
• Right to erasure — request deletion of your personal data. Account deletion removes all your data.
• Right to data portability — receive your data in a machine-readable format.
• Right to object — object to processing your data for specific purposes.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise your rights, contact us with your request. We will respond within 30 days.

9. Children

Our service is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced via email to registered users and via a notice on this page at least 14 days before they take effect. Your continued use of the service after a change constitutes acceptance of the updated policy.

The "Last updated" date at the top of this document reflects the most recent revision.

11. Contact

For privacy-related questions, data subject requests, or concerns, please contact: