Privacy and security
GDPR and India DPDP
Who is controller and processor when you use ProductLense, why cookieless counting usually needs no consent banner, and what identify changes.
For the visitors and customers of your sites, you decide what is collected and why; ProductLense, operated by RedAnalytica, processes the data on your behalf under the Data Processing Agreement. This page explains the position in plain terms. It is not legal advice.
Roles
| Law | You | RedAnalytica (ProductLense) |
|---|---|---|
| GDPR (EU, EEA) and UK GDPR | Controller | Processor |
| India's Digital Personal Data Protection Act, 2023 | Data Fiduciary | Data Processor |
The DPA covers instructions, subprocessors, international transfers (Standard Contractual Clauses), breach notice, audits, and deletion and return of data.
Anonymous traffic
Before identify, ProductLense stores no IP addresses, sets no cookies, writes nothing to the device, and keeps only a visitor id that changes every UTC day and cannot be recomputed once the day's salt is deleted. Many data protection authorities treat cookieless, aggregate audience measurement of this kind as possible without consent, on the basis of legitimate interest. Whether you need consent also depends on the other scripts on your site and on your jurisdiction, so check your whole setup. How the id works: Cookieless visitor counting.
Identified users
Once your code calls identify, the visitor's activity is linked to your user id, and payments from your billing provider are linked to it as well. That linked data is personal data you control:
- Describe ProductLense analytics and revenue attribution in your own privacy notice.
- Send only identifiers you are entitled to process; do not send special category data (health, religion and so on) in props or traits.
- Billing data that ProductLense reads (customer email and name, payments, subscriptions) already exists in your billing provider; ProductLense reads it with read-only access.
Requests from individuals
For an access or deletion request about one of your users, find them by the user id you passed to identify. If a request reaches RedAnalytica directly, it is forwarded to you. For site-level export and deletion see Export and deletion.
Data location
Data is stored in Germany. A list of subprocessors is available on request, as set out in the privacy policy, which also names the grievance officer for India.