Privacy Policy

This policy explains what personal data RedAnalytica ("we", "us") processes when you use ProductLense, why, for how long, and what rights you have. RedAnalytica is a sole proprietorship registered in India (GSTIN 24AHRPH4502J1ZD) based in Ahmedabad, Gujarat, India, and operates the website at https://productlense.app and the hosted service at https://app.productlense.app.

ProductLense handles two different groups of people, and our role differs for each:

• Our customers: people who create an account, their team members, and people who contact us. For their data we are the controller (GDPR) and the Data Fiduciary (India’s Digital Personal Data Protection Act, 2023).
• Visitors to our customers’ sites: people who visit websites and apps where a customer has installed ProductLense. For their data we are a processor (GDPR) and a Data Processor (DPDP), acting on our customer’s instructions under the Data Processing Agreement. The customer is the controller and Data Fiduciary.

1. Data about our customers

We do not buy data about you, and we do not use your data for advertising.

Cookies. The dashboard at https://app.productlense.app sets one strictly necessary session cookie, pl_session, HttpOnly and SameSite=Lax, valid for 30 days, to keep you signed in. To open reports instantly, the dashboard also keeps a copy of your recently viewed reports and your display preferences (such as theme and sidebar) in your browser’s local storage; clearing your browser’s data for the site removes them. The marketing site at https://productlense.app sets no cookies; it stores your theme choice in your browser’s local storage only if you pick one. Our own site uses ProductLense for analytics, which sets no cookies.

Payments. Paid plans are sold by Dodo Payments as merchant of record. You enter card, UPI or bank details directly with Dodo Payments; we never receive them. Dodo Payments tells us your subscription status, plan, billing country and email.

2. Data about visitors to our customers’ sites

When a customer installs the ProductLense script, it sends us, for each pageview or event: the page URL (with query parameters other than utm_*, ref, gclid, fbclid and msclkid removed in the browser), the referrer, the page title, the viewport width, the browser language, the event name and properties the customer chose to send, and a timestamp. The request carries the visitor’s IP address and user agent, as every web request does.

• No cookies or device storage. The script sets no cookies and writes nothing to local storage for visitors. The one exception is a site’s own team: a person who opens the site with ?pl_ignore=1 to stop counting their own visits gets a pl_ignore flag in local storage, at their request, and ?pl_ignore=0 removes it. If the customer’s code calls identify, the customer’s user id is kept in the tab’s session storage until the tab closes.
• No stored IP addresses. The IP address is used in memory to compute a visitor id and to look up the country, and is then discarded.
• Daily-salted visitor id. The visitor id is a SHA-256 hash of the site id, IP address, user agent and a salt that changes every day and is never stored. It cannot be reversed and cannot link the same person across days or across sites.
• Identify. If a customer sends a user id and traits such as an email address with identify, we store them so the customer can attribute payments to the visitor’s first visit.
• Billing data. If a customer connects a billing provider, we store the customer’s customers, subscriptions, payments, refunds and fees, which include their customers’ names and email addresses.

We process this data only to provide analytics and attribution to that customer. If you are a visitor and want to exercise your rights, contact the website owner first, as they decide how the data is used. If you contact us, we will pass your request to them.

3. Retention

4. Who we share data with

We use carefully selected service providers for hosting, content delivery, payment processing and transactional email. A current list of subprocessors is available on request at [email protected]. Each processes data only on our instructions and under a written agreement. Ask and the daily insight run on our own servers: no outside AI model or AI company gets your data or your questions.

We disclose data to authorities only when required by law, and we will tell the affected customer unless the law forbids it. We do not sell personal data.

5. Where data is stored and international transfers

The service runs on servers in Germany, with encrypted backups in the EU. RedAnalytica is based in India, so administrative access to the systems happens from India. Transfers of personal data from the EU, EEA, UK or Switzerland to India and to subprocessors outside those regions are covered by the European Commission’s Standard Contractual Clauses and, for the UK, the International Data Transfer Addendum, together with the security measures described below.

6. Security

Traffic is encrypted with TLS. Billing credentials are encrypted at rest with a key held only in the server environment. API keys are stored as SHA-256 hashes. Webhooks are verified with each provider’s signature. Access to production is limited to named people at RedAnalytica. Backups are encrypted. Details are on the security page.

7. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict and port your personal data, to object to processing based on legitimate interest, and to withdraw consent where processing relies on it. Under India’s DPDP Act you have the right to information about processing, correction, completion, updating and erasure, grievance redressal, and to nominate another person to exercise your rights in the event of death or incapacity.

To exercise any right about your account data, email [email protected] from your account email. We respond within 30 days, or sooner where the law requires. You can delete sites and your whole account yourself in settings. “Export data” in site settings downloads a zip of the site’s daily aggregates, its payments without customer names or emails, and its ad spend. Analytics data is purged within minutes of deleting a site or account, and always within 7 days; backup copies expire within 30 days.

If you are in the EU, EEA or UK, you can complain to your local data protection authority. In India, you may approach the Data Protection Board of India after using our grievance process.

8. Grievance officer

As required by Indian law, our grievance officer is Sanni Heruwala, reachable at [email protected]. Complaints are acknowledged promptly and answered within the time the law requires.

9. Children

ProductLense is a business service and is not directed at children. You must be 18 or older to create an account. Customers must not use ProductLense to knowingly collect personal data of children under 16 in the EU or under 18 in India without the consent the law requires.

10. Changes

When we change this policy materially, we email account owners at least 14 days before the change takes effect and update the date at the top of this page.

11. Contact

RedAnalytica (redanalytica.in), Ahmedabad, Gujarat, India. Privacy and grievances: [email protected]. Support: [email protected]. Security: [email protected].