Updated at: 2026-10-28.
This Privacy Policy provides information about the processing of personal data in connection with the use of the web analytics platform Noralytic (hereinafter "Service", "Platform").
The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is:
NoraMediaThis Privacy Policy applies to:
We process personal data in accordance with the following principles (Art. 5 GDPR):
Privacy by Design: Noralytic is designed so that no IP addresses, no cookies and no session data of website visitors are stored.
A user account is required to use Noralytic. In doing so, we process the following personal data:
Purpose: Provision and management of your user account, authentication, communication
Legal basis: Art. 6 (1) (b) GDPR (performance of a contract)
Storage period: Until the account is deleted, then 30 days (option to restore), followed by final deletion
For paid plans, we process:
Important: Credit card or bank data is not stored directly by us, but processed by certified payment service providers (see Section 7).
Purpose: Processing of payments, invoicing, accounting
Legal basis: Art. 6 (1) (b) GDPR (performance of a contract) and (c) (legal obligation to issue invoices)
Storage period: 10 years pursuant to Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB) (tax retention obligations)
Noralytic is a privacy-friendly analytics platform. When our customers collect website statistics, no personal data within the meaning of the GDPR is processed.
The tracking code collects the following aggregated, non-personal data:
Technical implementation: All data is stored in aggregated form and cannot be assigned to an individual person. Aggregation takes place immediately on the server side.
Purpose: Provision of website statistics for our customers to optimise their websites
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest of our customers in website analytics without personal reference)
Storage period: For as long as the website is measured with Noralytic. The statistics contain no personal data and are deleted when the website or account is deleted
Noralytic was developed to meet the following data protection standards:
Our customers integrate the tracking code on their websites. In this context:
As the website operator, the customer is independently responsible for:
In the relationship between Noralytic and the customer:
However, since no personal data is processed, in practice there is no need for a comprehensive DPA for the analytics data.
When you visit our website and use the platform, the following server log data is collected automatically:
Purpose: Ensuring system security, detection and defence of attacks (DDoS, hacking attempts), error analysis
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a secure IT infrastructure)
Storage period: Maximum 7 days, then automatic deletion
We use the following external service providers to process payments:
Provider: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland
Stripe is PCI DSS Level 1 certified. Credit card data is stored and processed exclusively by Stripe.
Privacy: https://stripe.com/privacy
Legal basis: Art. 6 (1) (b) GDPR (performance of a contract)
We send emails for the following purposes:
Legal basis: Art. 6 (1) (b) GDPR (performance of a contract) and (f) (legitimate interest)
These emails cannot be unsubscribed from, as they are necessary for the performance of the contract.
Customers can subscribe to weekly or monthly statistics reports by email.
Legal basis: Art. 6 (1) (a) GDPR (consent)
These reports can be deactivated at any time via the dashboard or the unsubscribe link in the email.
With your consent, we occasionally send information about:
Legal basis: Art. 6 (1) (a) GDPR (consent)
Unsubscribe: At any time via the unsubscribe link in the email or in the dashboard under Settings
We use the following for sending emails:
Hostinger International Ltd. (61 Lordou Vironos Street, 6023 Larnaca, Cyprus, see Section 9)
Privacy: https://www.hostinger.com/privacy-policy
Our servers and databases are hosted by:
61 Lordou Vironos Street, 6023 Larnaca, Cyprus
Privacy: https://www.hostinger.com/privacy-policy
Location: Data centre in France (EU)
Security measures: Redundant systems, regular backups
The content delivery network (CDN) is also operated by Hostinger International Ltd. (see 9.1).
Purpose: Delivery of content, DDoS protection, SSL/TLS encryption
We work with the following processors:
| Service provider | Purpose | Location |
|---|---|---|
| Hostinger International Ltd. | Server hosting, databases, email delivery, CDN, DDoS protection, backups | France (EU) |
| Stripe | Payment processing | Ireland (EU) |
Contracts pursuant to Art. 28 GDPR exist with all processors, ensuring processing in compliance with data protection law.
In principle, we process data within the European Union (EU) and the European Economic Area (EEA).
A transfer to the USA may take place with the following service provider:
We ensure that an adequate level of data protection is guaranteed by suitable safeguards.
Our website uses only technically necessary cookies:
Legal basis: Art. 6 (1) (f) GDPR (technical necessity)
We do not use analytics cookies, marketing cookies or third-party cookies.
The tracking code integrated by our customers sets no cookies and uses no LocalStorage.
We use comprehensive technical and organisational measures to protect your data:
We only store personal data for as long as is necessary for the respective purpose:
| Type of data | Storage period |
|---|---|
| Account data (active account) | Until the account is deleted |
| Deleted account | 30-day restoration period, then final deletion |
| Analytics data | As long as the website is measured, then deleted together with the website or account |
| Invoice data | 10 years (statutory retention obligation) |
| Server logs | Maximum 7 days |
| Email correspondence | 3 years, then deletion |
| Backup data | 30 days, then automatic deletion |
After the storage period has expired, data is irrevocably deleted or anonymised.
Under the GDPR, you have the following rights:
You have the right to obtain information about the personal data we process, including:
You can request the rectification of incorrect or incomplete data. You can also do this yourself in the dashboard.
You can request the deletion of your data if:
Exceptions apply in the case of statutory retention obligations (e.g. invoice data).
Account deletion: Can be carried out at any time in the dashboard under Settings → Delete account.
You can request the restriction of processing if:
You have the right to receive your data in a structured, machine-readable format.
Export function: All analytics data can be exported as a CSV file via the dashboard at any time.
You can object to the processing of your data on grounds relating to your particular situation, provided that the processing is based on Art. 6 (1) (f) GDPR (legitimate interest).
You can withdraw any consent you have given (e.g. for marketing emails) at any time with effect for the future.
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement.
Competent supervisory authority for Germany:
The Federal Commissioner for Data Protection and Freedom of Information (BfDI)
Graurheindorfer Str. 153, 53117 Bonn
Phone: +49 (0)228 997799-0
Email: poststelle@bfdi.bund.de
Website: https://www.bfdi.bund.de
We do not carry out automated decision-making within the meaning of Art. 22 GDPR that produces legal effects concerning you or significantly affects you.
No profiling takes place for marketing or evaluation purposes.
Noralytic is not aimed at persons under the age of 16. We do not knowingly collect personal data from minors without parental consent.
If we discover that we have inadvertently received data from minors, it will be deleted immediately.
We reserve the right to adapt this Privacy Policy as required, in particular in the event of:
We will announce material changes by email at least 30 days in advance.
The current version is always available on our website.
Version: 2.0
If you have questions about data protection or wish to exercise your rights, please contact us:
We will answer your requests without delay, but at the latest within 30 days.
Business customers who use Noralytic for their websites can receive a data processing agreement (DPA) pursuant to Art. 28 GDPR on request.
Note: Since Noralytic does not process any personal data of website visitors, a DPA is not required in most cases. Nevertheless, we provide it for legal certainty.
We recommend that our customers:
Sample text for your privacy policy:
Web analytics with Noralytic
We use Noralytic to analyse our website traffic. Noralytic is a privacy-friendly analytics solution that stores no IP addresses, cookies or session data. Only aggregated, non-personal statistics are collected.
More information: noralytic.com/privacy
Summary – Your data at Noralytic:
Questions? Contact us at help@noralytic.com