Privacy policy

The controller is VSK, a French SARL with variable capital, 47 rue Vivienne, 75002 Paris, France, registered with the Paris trade register under number 105 185 789. Full details are at the bottom of this page.

VSK has not appointed a data protection officer, as the law does not require one for its activity. For any question or request, write to [email protected].

• Controller for dashboard accounts, billing, security, service e-mails, the newsletter, support and the audience measurement of taktlytics.com. These processing activities are described in part A.
• Processor (GDPR article 28) for the statistics of our customers’ websites. The customer who installs Takt on their website decides to measure its audience: they are the controller of that processing and we carry it out on their behalf, under the data processing agreement. This processing is described in part B.

For each purpose, the table gives the data processed, the legal basis (GDPR article 6) and the retention period. Retention periods are enforced by automatic purge jobs.

Encrypted database backups are kept for 7 days. Erased data therefore disappears from every copy at most 7 days after its erasure.

The dashboard only uses cookies that are strictly necessary for the service you request. They are HttpOnly, Secure and SameSite=Lax, and are never used for tracking or advertising.

Your browser’s local storage also keeps preferences that never leave your device: language, theme, last organization opened and favorite sites (tied to your user identifier), a sign-in hint, and the measurement opt-out described below.

These trackers are exempt from consent (French Data Protection Act, article 82, and CNIL guidelines). That is why Takt shows no cookie banner. The measurement script stores neither cookies nor data in visitors’ browsers, except the takt_ignore key when a visitor opts out of measurement.

Your data is accessible only to authorized VSK staff, and to the providers who help us run the service, each for its own part: hosting, traffic delivery, e-mail sending, payment, sign-in and integrations. The up-to-date list, with the country and the safeguard for each transfer, is on the subprocessors page.

We never sell or rent any data. We disclose it to an authority only upon a lawful request.

Databases and backups are hosted in Germany by Contabo GmbH. Some providers are based in the United States (Cloudflare, Stripe, Google, GitHub). These transfers rely on those companies’ certification under the EU-US Data Privacy Framework and, failing that, on the European Commission’s standard contractual clauses.

When you visit a website that uses Takt, that website is responsible for measuring its audience. Takt does it on its behalf, without ever trying to find out who you are.

• Data recorded for each page view or event: page address, without its parameters or fragment by default; referring site reduced to its origin and path; campaign parameters (UTM); country, region and city derived from the IP address; browser, operating system, device type and screen width; event properties chosen by the website; a visitor identifier.
• Visitor identifier: an HMAC-SHA256 hash of the IP address, the browser and the website’s domain, computed with a random key that changes every day and is destroyed after 48 hours. It counts the unique visitors of a day, but cannot recognize you the next day or on another website. The raw IP address and browser are never recorded.
• No cookie, no storage, no persistent fingerprint: Do Not Track and Global Privacy Control signals are honored, and no profile is built.
• Retention: 25 months, then automatic erasure. A website’s statistics are also erased when the customer deletes that website or its organization, after a 90-day grace period.

This data is pseudonymized and, in practice, cannot lead back to a person. Takt is designed to meet the consent exemption that the CNIL (the French data protection authority) grants to audience measurement: purpose limited to statistics, no cross-referencing with other processing, retention of 25 months at most. The website that measures you remains responsible for informing you and offering a way to opt out.

To exercise your rights over these statistics, contact the website you visited. Since the visitor identifier is not linked to you, neither that website nor Takt can find your data (GDPR article 11), but you can always object to measurement. If you write to us, we forward your request to the website concerned.

Turning on Do Not Track or Global Privacy Control in your browser is enough to stop being measured on every website that uses Takt. For taktlytics.com, you can also use the button below: it records your opt-out in this browser.

• Access and portability: in Settings, the “Download my data” button provides a full copy of your account data in a reusable JSON file.
• Rectification: you edit your profile from Settings.
• Erasure: you delete your account from Settings. It is deactivated immediately, then permanently erased 90 days later.
• Restriction and objection: you can object to processing based on our legitimate interest, or ask for it to be restricted, by writing to us.
• Withdrawal of consent: every newsletter contains an unsubscribe link.
• Instructions after your death: you can tell us what to do with your data after your death (French Data Protection Act, article 85).
• Complaint: you can lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or with the authority of your country of residence.

For any request, write to [email protected] from your account address. We answer within one month, which may be extended by two months for a complex request, in which case we tell you within the first month.

Takt is not intended for children. In France, a person under 15 cannot alone consent to processing based on consent, such as the newsletter: the agreement of a holder of parental authority is then required (French Data Protection Act, article 45). If we learn that a sign-up was made without that agreement, we delete it.

Traffic is encrypted (HTTPS). Two-factor authentication is required to access the dashboard. Passwords are hashed with Argon2id, third-party secrets and tokens are encrypted, backups are encrypted. In the event of a data breach that poses a risk, we notify the CNIL within 72 hours, and you without undue delay if the risk is high.

This policy may change. The date at the top of the page shows its latest version. We notify account holders by e-mail of any substantial change.