Privacy Policy

Klickbee is a privacy-first product-analytics and marketing-measurement service operated by Stralya (“Klickbee”, “we”, “us”). This policy explains what data Klickbee processes through its analytics SDK, dashboard, and conversion-forwarding features, and how it is used and shared. For personal data collected on a website that uses Klickbee, the website’s owner is the data controller and Klickbee acts as their processor.

When Klickbee’s SDK runs on a website, it may collect:

• Product-analytics events: page views, clicks, and custom events, with the page path/URL, referrer, and event properties provided by the site.
• Pseudonymous identifiers: a random visitor ID stored in the browser’s localStorage and a per-tab session ID in sessionStorage. These are not cookies and contain no directly identifying information.
• JavaScript errors: uncaught errors and unhandled promise rejections on the page, recorded as events with the error message (shortened) and the script URL, line and column. On by default; sites using the npm package can turn it off.
• Traffic source (attribution): the referrer, the landing page path, the UTM parameters of the landing URL (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and, when the visitor arrives from a Google ad, the Google click identifier (gclid, or gbraid/wbraid). Stored with the session and, from the first visit, with the visitor record.
• Device and browser context: user-agent, language, and screen size.
• Approximate location: country/region/city derived from the request IP address. The IP address itself is anonymized and not stored in full.
• Optional identity traits: if the site calls our identify() API, the identifier and traits it sends (for example an email address), used to recognise returning users. Klickbee stores these exactly as the site sends them, in plain text; we hash an email only in the copy forwarded to advertising platforms. Klickbee does not collect them on its own: if your site never calls identify(), no such data is stored.
• Session replay, only on sites where replay is enabled: a recording of the page as the visitor saw and used it (content, clicks, scrolling). Typed input values are masked by default, and site owners can block or mask further elements with the data-kb-block and data-kb-mask attributes.

We process this data to provide analytics (traffic, sessions, funnels, goals) to the site owner, to operate and secure the service, and, where the site owner enables it, to inject their configured marketing pixels and forward conversion events to advertising platforms.

A site owner may connect advertising accounts (Meta, Google, LinkedIn) and map their conversion goals in Klickbee. When enabled, Klickbee loads those platforms’ pixels in the visitor’s browser and/or forwards conversion events server-side to the platforms’ Conversions APIs on the site owner’s behalf (server-side forwarding is part of the Pro plan). To improve match quality (“advanced matching”), an identified user’s email may be shared in hashed (SHA-256) form, never in plain text. For Google Ads server-side conversions, Klickbee sends Google the visitor’s Google click identifier (gclid), as captured from the ad landing URL, so Google can match the conversion to the ad click; when there is none, it sends the hashed email instead. For Meta server-side conversions, when the visitor accepted the site’s ad pixels, Klickbee also sends Meta the address of the page (without its query string), the browser’s user agent and the _fbp and _fbc cookies the Meta pixel set, so Meta can match the conversion; never the IP address. Google is told whether the visitor accepted or refused the ad pixels (consent to ad user data and ad personalisation). Data shared with a platform is governed by that platform’s own privacy policy. Access tokens for connected accounts are encrypted at rest and never exposed to browsers.

Klickbee relies on the following providers to run the service. We name them without committing to a specific data-centre region.

• Vercel hosts the application and the data-collection endpoint.
• Neon provides the Postgres database that stores analytics and account data.
• Amazon Web Services (S3) stores session-replay recordings.
• Stripe processes subscription payments for paid plans.
• Anthropic processes the AI features, which are part of the Pro plan and run only when a site owner uses them: session summaries, goal suggestions and A/B variation ideas. For these, Klickbee sends Anthropic a compact brief about the site or session: page paths, event names, click labels, aggregate counts and traffic channels; for session summaries, also the device user-agent, city and country and the session’s page-and-event timeline; for goal and variation suggestions, a short excerpt of the text visible on the page, taken from a replay snapshot. The brief does not include visitor identifiers or identify() traits, although text that was visible on the recorded page is sent as it appeared.

Klickbee’s own SDK sets no cookies; it uses browser localStorage and sessionStorage for the identifiers above. Third-party ad pixels enabled by a site owner are separate tags: they may set their own cookies, subject to those third parties’ policies and to the site owner’s own consent obligations.

The SDK honours the browser’s Do-Not-Track signal by default and supports a consent mode that a site owner can require (the requireConsent option of the npm package, or data-require-consent="true" on the script tag). In consent mode, Klickbee captures nothing and loads no ad pixel until the site calls grantConsent(). Revoking consent stops further capture, but cannot unload ad pixel scripts that are already running on the page. Responsibility for obtaining any legally required consent on a given website, including for ad pixels, rests with that website’s owner.

Klickbee deletes tracking data automatically on a daily schedule:

• Events (page views, clicks, custom events and JavaScript errors): after 180 days, on every plan.
• Session replays: after 7 days on the Free plan and after 60 days on the Pro plan.
• AI session summaries: with their session, 180 days after its last activity (see below).

A session, with its location and device details, is deleted 180 days after its last activity. A visitor record (the pseudonymous identifier, first traffic source, and any identity traits sent through identify() such as an email address) is deleted once the visitor has had no activity for 180 days.

Some records are not on this daily schedule:

• Server-side conversion records (Pro): each conversion queued for an advertising platform, with the hashed email and the Google click identifier when present, is deleted 30 days after it was queued. Nothing is queued for a visitor who refused, or has not yet answered, the site's consent banner. A conversion not delivered within 7 days is never sent. The page address, user agent and Meta cookies kept for a Meta conversion are erased once it is sent.
• AI page variation suggestions: kept until they are regenerated for the same page. They are built from aggregate data and page text, not from visitor identifiers.
• Saved experiments: when a site owner saves an A/B page test, Klickbee stores with it a snapshot of each page taken from a session replay recording. It is kept until the owner deletes the saved test, so it can outlive the replay retention above.

A site owner can delete data sooner: deleting a site permanently removes its visitor, session, event and replay data, including the replay recordings in storage, and the conversion records, AI results and saved experiments above. Deleting an account, which we do on request at hello@klickbee.com, also deletes the sites that account owns.

Depending on your jurisdiction, you may have rights to access, correct, or delete personal data, or to object to its processing. Because Klickbee processes website data on behalf of the relevant site owner, please direct such requests to the website you visited; we will assist that site owner in responding. You can also contact us at hello@klickbee.com.

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above.

Questions about this policy or our data practices: hello@klickbee.com.