GDPR compliance for Varify Real Time Tracking
How Varify Analytics collects, processes and stores data, and what that means under the GDPR.
What the tracking script records
Five categories are collected when the script runs on your site.
| Category | Examples | Notes |
|---|---|---|
| Event data | Page views and custom events such as button clicks or form submissions | Event names and properties are defined by you, not by Varify |
| Device and browser | Browser, operating system, device type, user agent string | Standard browser attributes, no fingerprinting beyond them |
| Page context | Page path, domain, referrer | No query strings and no full URLs by default |
| Timezone | IANA string such as Europe/Berlin | Used for reporting, not geolocation. No GPS and no coordinates |
| Identifiers | anonymous_id, session_id | anonymous_id is a UUID generated on load if none exists, held in localStorage and carried across all anonymous events. session_id is held in sessionStorage and generated again for every new tab and every new session |
No cookies. Identifiers are kept in first-party localStorage and sessionStorage in the visitor's browser. They leave the device only inside an event payload sent to Varify.
No personal data in event properties
Varify records random identifiers. Names and email addresses must not be sent.
- We never require or request names or emails.
- Keep metadata free of personal data.
- Use opaque values in event properties.
- Review what your team sends before release.
Your responsibility
Personal data in metadata or event properties is not permitted. Check every custom property before you ship it.
Where the data lives
Two infrastructure providers, one storage region inside the EU.
No IP addresses
The SDK stores none. No IP field exists in the event data model, and none is written to the database at any point.
Frankfurt, Germany
All analytics data is stored in the ClickHouse Cloud region eu-central-1, inside the European Union.
No onward sharing
Analytics data goes to no advertising network, no reseller and no third party beyond the subprocessors listed here.
| Subprocessor | Role | Location |
|---|---|---|
| Cloudflare (already in use for experiment delivery) | Request processing on Workers, close to the visitor. No persistent storage of event data at the edge | Global edge network |
| ClickHouse Cloud | Database and data storage | eu-central-1, Frankfurt, Germany |
No ClickHouse tracker is loaded in the browser, so there is no direct connection between the visitor's device and ClickHouse. No IP address is transmitted to ClickHouse.
How long data is kept
Raw events
Retained for 6 months (180 days) from the date of collection, then permanently deleted.
Aggregated reports
Experiment snapshots and reports without customer data are retained indefinitely.
Same for everyone
The retention period is not configurable per customer or per plan. One rule applies to all accounts.
Erasure requests in practice
Deleting a team deletes its data: all associated events and records are removed permanently.
A visitor is identified by a random anonymous ID and a session ID, not by a real-world identity. Raw events are also removed automatically once the retention period of 6 months has passed.
Consent stays under your control
You can configure a tracking activation event so that events are sent only after consent has been obtained.
- Obtain any consent the law requires.
- Let your CMP decide when the script loads.
- Name Varify as a processor in your policy.
8. Data processing agreement
Varify Tracking is optional to use. ClickHouse is listed as A5.7 in Appendix 5 of the DPA.
The script ships without a consent banner of its own, and it does not evaluate Do Not Track signals or prior consent before sending events.
Technical measures in the pipeline
Isolation, access limits and encryption, enforced at infrastructure level.
Tenant isolation
Every row carries a team identifier. Row-level security in the database returns only your own rows, even if application code fails.
Least-privilege access
Separate database credentials for writing and reading. The write role cannot read, the read role cannot change or delete.
Encryption in transit
HTTPS/TLS from the script to our Workers and on to ClickHouse Cloud. No plain HTTP endpoint exists in the pipeline.
Encryption at rest
Stored analytics data is encrypted with AES-256 and provider-managed keys, enabled by default for every service.
Secret handling
API keys and environment configuration are held as Cloudflare environment secrets inside Cloudflare Workers.