Start free

Your visitors stay yours.

What the GrainQL tag collects, where it is kept, how long we keep it and who helps us run the service.

What the tag collects.

The tag counts visits without cookies from the first page view. Consent adds a little more detail, never more than this.

Always

  • Page path, without the query string
  • Referrer and campaign tags
  • Device type, browser and operating system
  • Country, region and city, read from the request
  • Clicks and scroll depth, with up to 100 characters of the clicked text
  • Events your own code sends

Only after consent

  • A visitor ID that stays the same across visits
  • Screen and window size
  • Browser language and time zone

Never

  • Cookies set by the tag
  • IP addresses stored with events
  • What visitors type into forms
  • Tracking across other websites
  • Selling data, or sharing it for advertising

For heatmaps, the tag keeps a snapshot of each page. Form fields are always masked, and you can hide any other part of the page.

Before and after consent.

You pick the consent mode: automatic, opt-in or opt-out. Your banner tells the tag when a visitor agrees.

Before consent

Visitor IDNew every day
Saved on the deviceA random key, nothing personal
CookiesNone
Extra detailNone

After consent

Visitor IDKept across visits
Saved on the deviceThe visitor ID
CookiesNone from the tag
Extra detailScreen, language, time zone

Where it lives.

Your analytics data is stored in the EU, in ISO 27001 certified data centers in Finland.

Analytics eventsFinland, EU
Analytics backupsFinland, EU
Neo conversationsGermany, EU
Sign-in accountsEU
Dashboard hostingEU, US and Asia

How long we keep it.

Shorter limits by plan, and your own retention setting, are coming. Until then, ask us and we delete data for you.

Analytics eventsUp to 2 years
BackupsUp to 14 days
Neo conversationsUntil you delete them
Account detailsWhile your account is open

Write to privacy@grainql.com to erase a workspace, a visitor or a date range for good.

Neo and AI.

When you ask Neo a question, it sends the question and the query results it needs to an AI model through OpenRouter. The models run in the United States.

We do not train models on your data. You can connect your own model key in settings, and Neo then uses your account with that provider.

Who helps us run GrainQL.

Every service that can see your data or your visitors' data. Last checked 18 October 2026.

Infrastructure and storage

Where the product runs and where your data is kept.

HetznerServers for our APIs and databases, and event database backupsAnalytics events, workspace and account dataHelsinki, Finland
CloudflareNetwork edge, TLS, DDoS protection, tag delivery, short links, the Shopify app, page snapshots and database backupsVisitor requests in transit, page snapshots, backupsGlobal edge
VercelHosting for grainql.com and the dashboardDashboard sessions and requests in transitParis, Frankfurt, Washington, San Francisco and Hong Kong
SupabaseNeo conversations, memories, digests and reportsChat messages and the answers Neo givesFrankfurt, Germany

Neo and AI

Used when you ask Neo a question or run a site analysis.

OpenRouterRoutes Neo requests to the model that answers themYour question and the analytics results Neo works withUnited States
Google (Gemini)Models for Neo's Fast and Smart modes, through OpenRouterYour question and the analytics results Neo works withUnited States
Anthropic (Claude)Model for Neo's Max mode and fallback, through OpenRouterYour question and the analytics results Neo works withUnited States
GroqAutocomplete in the report editorThe report text you are writingUnited States
OpenAIReads your public pages during setupContent of your public websiteUnited States
BrowserbaseCloud browser that opens your public pages for setup and auditsContent of your public websiteUnited States
E2BSandbox where Neo runs calculations on query resultsAggregated query resultsUnited States

Accounts, billing and email

Used to sign you in, bill you and write to you.

Auth0 (Okta)Sign-in and identityName, email address, sign-in historyEuropean Union
StripeCard payments and invoicesBilling details. We never see full card numbers.United States and EU
ShopifyBilling and data for stores that use the GrainQL Shopify appStore details and order totalsGlobal
AppSumoLifetime deal licencesEmail address and licence keyUnited States
Customer.ioProduct and account emailsEmail address and product eventsEuropean Union
ResendTeam invite emailsThe invited person's email addressUnited States

Support and operations

Used to help you and to keep the service running.

FeaturebaseSupport chatMessages, and the name and email address you giveEuropean Union
SlackInternal alerts, including new privacy and support requestsName, email address and request detailsUnited States
Better StackApplication logs and error trackingServer logs, which can include request detailsUnited States
New RelicServer monitoringMetrics and logs of failed requests, which include IP addressesEuropean Union

Our own website

Used on grainql.com only. None of these run on your site through the GrainQL tag.

Google Tag Manager and Google AdsMeasuring our own adsPages visited on grainql.com and ad clicksUnited States
Meta Pixel and Conversions APIMeasuring our own ads. Off for visitors in the EEA, the UK and SwitzerlandPages visited on grainql.com. When you start or pay for a trial: a hashed email address, IP address and browser detailsUnited States

Your rights.

GrainQL is run by Cybentis Oy in Helsinki, Finland. You can also complain to the Finnish Data Protection Ombudsman.

Ask for your data

Request a copy, a correction or a deletion. We answer within 30 days.

Open

Privacy policy

The full legal text for visitors, customers and grainql.com.

Open

Data processing agreement

The terms that apply when GrainQL processes data for you.

Open

Security

How we protect the service, and how to report a problem.

Open

Find your next win this week.

Neo has its first ideas once real visitors arrive.

Start free trialExplore the live demo