Privacy Policy

Last updated: 16 June 2026. This policy explains how DataLook ("we"), based in Cairo, Egypt, handles personal data, both for visitors to our own site and for end-users tracked through our analytics on our customers' websites.

Our privacy-first design

DataLook is built to be cookieless and to avoid storing data that identifies a person across days:

• No cookies or browser storage are used to identify visitors.
• No cross-site tracking, canvas/WebGL/font fingerprinting, or device fingerprints.
• A visitor identifier is derived server-side by hashing IP + user-agent with a daily-rotating salt; the raw IP is not stored, and the identifier cannot be reversed or linked across days.
• Keys that look like personal data (e.g. email, phone) in custom properties are dropped in the browser and again on our servers.

Data we process

For analytics events: page URL, referrer, UTM parameters, and a small passive context object (screen/viewport size, device pixel ratio, color depth, language, timezone, coarse country). For accounts: your name, email, and billing metadata handled by our Merchant of Record.

Roles under GDPR

For the analytics data our customers collect on their sites, the customer is the data controller and DataLook is the processor, acting on the customer's instructions. For our own account/marketing data, DataLook is the controller. We can provide a Data Processing Agreement (DPA) to customers on request.

Legal basis & your responsibilities (customers)

If you install DataLook on your site, you are responsible for having a lawful basis and for any notices or consents required by applicable law for the data you send us, and for linking your own privacy policy.

Sub-processors

We use a small set of infrastructure and service providers, including Hetzner (EU hosting), Resend (email), and Lemon Squeezy (payments). A current list is available on request.

Retention

Analytics events are retained for as long as your account is active. Account data is kept while your account is active and deleted within 30 days after closure, subject to legal retention requirements.

Your rights

Depending on your location, you may have rights to access, correct, delete, or port your personal data, and to object to or restrict processing. To exercise them, email [email protected]. You can also export your analytics data as CSV or JSON at any time from the product.

International transfers

Your analytics data is hosted in the European Union (Hetzner). Where it is accessed from outside the EU (including from Egypt, where our team is based), we rely on appropriate contractual safeguards such as Standard Contractual Clauses.

Changes

We may update this policy; the "Last updated" date reflects the latest version.

Contact

Privacy questions: [email protected]. Data controller: DataLook, Cairo, Egypt.