Privacy Policy

1. Controller

Lucas Bender
BLEA Media
Stobäusstraße 43
82515 Wolfratshausen
Germany
Email: lucas@blea-media.com

2. Collection and Processing of Personal Data

We collect and process personal data from our users only to the extent necessary to provide a functional website and our content and services.

2.1 When Using Our Website (Marketing Pages)

When you merely visit our website for information purposes, we collect only the personal data that your browser transmits to our server:

  • IP address
  • Date and time of the request
  • Time zone difference to Greenwich Mean Time (GMT)
  • Content of the request (specific page)
  • Access status/HTTP status code
  • Amount of data transferred
  • Website from which the request originates
  • Browser
  • Operating system and its interface
  • Language and version of browser software

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating and securing the website).

Our web server shortens the IP address before writing it to its access logs (for IPv4 the last byte is dropped, for IPv6 everything after the first 48 bits). The logs are overwritten automatically, usually after a few days. To prevent abuse we limit the number of requests; for this we briefly process the full IP address and delete it after one hour at the latest.

2.2 When Registering for and Using Trackneat

When you create an account or use our service, we collect:

  • Name and email address
  • Organization/agency name
  • Password (stored encrypted)
  • Payment information (processed by Stripe; we do not store full card numbers)
  • Tracking data for monitored websites (only those you add)
  • IP address and browser identifier of your login sessions (to protect your account; deleted no later than one day after the session expires)

Legal basis: Art. 6(1)(b) GDPR (contract performance).

As part of providing the service, we also record usage milestones of your account (e.g. adding your first website, completing your first check, generating reports). These records serve the provision and billing of the service.

If you reach us through a link with campaign parameters (for example from one of our ads), we store at registration which campaign and which ad you came from (the so-called utm parameters; they contain no identifier of you as a person). We store Meta's click ID (fbclid) only if you consented to marketing cookies; it is used solely for the transmission to the Meta Conversions API (section 2.5).

We also analyse this campaign information and the usage milestones in aggregate to improve our advertising and the setup of the service, for example: how many trials from a campaign complete their first check? Only the operator of Trackneat sees these analyses. We do not analyse what individual members of a team do in a workspace. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving our service and our advertising). You can object to this at any time (Art. 21 GDPR): in Trackneat under Profile → Privacy → "Internal analysis by Trackneat", or by email to lucas@blea-media.com. Your account and your workspaces are then no longer included in these analyses.

2.3 Cookies and Tracking Technologies

We use cookies and similar technologies to analyze the use of our website and optimize our marketing.

Meta Pixel (Facebook Pixel): On some pages we use the Meta Pixel. This may collect various data, including your IP address and browser information, and transmit this to Meta Platforms Ireland Limited. For more information, see Meta's privacy policy: https://www.facebook.com/policy.php.

Microsoft Clarity: On our marketing website (not in the Trackneat app) we use Microsoft Clarity by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, only if you have consented to analytics cookies. Clarity records how you use the pages (clicks, scrolling, mouse movements, pages visited, device and browser) and shows this as heatmaps and session recordings. What you type into form fields is not recorded. Clarity sets cookies for this (for example _clck and _clsk) that last up to one year. Microsoft may also process data in the USA; Microsoft Corporation is certified under the EU-US Data Privacy Framework. We use the analyses to make the website easier to understand. Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent). You can withdraw your consent at any time via “Cookie settings” in the page footer; Clarity then deletes its cookies. More information: https://privacy.microsoft.com/en-gb/privacystatement

You can object to the use of cookies and tracking technologies at any time via your browser settings or our cookie banner.

Legal basis for tracking cookies: Art. 6(1)(a) GDPR (consent), where required.

2.4 Product Analytics (PostHog)

We use PostHog (EU-hosted) to collect anonymous usage statistics. This includes: which features are used, where users encounter issues, and conversion flows. We do not store your IP address, email, or any personally identifiable information in PostHog. You can decline analytics in the consent banner on first login or disable it anytime under Profile → Privacy.

2.5 Marketing & Advertising

We use Meta Pixel and Google Analytics 4 on our marketing pages to understand which ads lead to signups. These are only loaded if you consent to Marketing/Analytics cookies on the marketing site.

Meta Conversions API: In addition to the Meta Pixel, we transmit certain events server-side (e.g. the start of a trial or the completion of a subscription) to the Meta Conversions API operated by Meta Platforms Ireland Limited. This includes your email address (SHA-256 hashed only) and ad click IDs (fbc/fbp). This transmission only takes place if you consented to marketing cookies during registration. Legal basis: Art. 6(1)(a) GDPR (consent). For more information, see Meta's privacy policy: https://www.facebook.com/policy.php.

2.6 Anonymous Reach Measurement

We count page views, call-to-action clicks and steps in our signup and activation process server-side and in aggregate form only. Counts are kept per day and hour, by ad campaign and ad, by the page of our website, by the domain of the referring website (for example google.com, without the full address) and by device class (desktop, mobile or tablet). We derive the device class from the browser identifier of the request, which we evaluate briefly for this and to filter out bots and do not store. No cookies are set and no IP addresses, browser identifiers or device identifiers are stored; the counts cannot be attributed to any individual. This measurement does not require consent.

In the same way, we count how often “Accept all”, “Only necessary” or “Save selection” is chosen in the cookie banner, and how many page views of our website come from automated programs (for example search engine crawlers or scripts). Only daily totals are stored; no cookies are set and no IP addresses or identifiers are stored.

For links we have tagged ourselves (for example in our LinkedIn profile or our email signature), we also count the utm_source and utm_medium values from the address. If a page is opened in the built-in browser of an app such as Instagram, Facebook, LinkedIn or TikTok, we count that app as the origin. For automated requests we count the type of program (for example search engine, AI crawler, SEO tool, link preview, monitoring or script) and the name of well-known programs (for example Googlebot). Requests for server files that do not exist on our site (for example .env) are rejected and counted by type of file. For this we briefly evaluate the browser identifier and the requested address and store only daily totals per category, no IP addresses, browser identifiers or full addresses.

In addition, our marketing website loads our own Trackneat beacon directly from trackneat.com. It only counts how often analytics and advertising tags fire on our website (for example a Google Analytics 4 page-view event, which fires only after your consent) and transmits nothing but these counts. It sets no cookies and stores no IP addresses, device identifiers or other personal data. We do not use Google Tag Manager.

2.7 Emails and Feedback

Emails about your account: we send you emails that are part of using Trackneat, for example alerts and reports about your monitored websites, notes about your trial and your subscription. You can unsubscribe from tips during the trial via the link in each of those emails. Legal basis: Art. 6(1)(b) GDPR (performance of contract).

Emails about product updates, offers and feedback requests: you only receive these if you agreed at signup or under Profile → Privacy. Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time, via the unsubscribe link in each of these emails or under Profile → Privacy.

Feedback in Trackneat: if Trackneat detected a problem on one of your websites that has since been fixed, we occasionally ask you for a short rating within Trackneat, at most once every 90 days. Answering is voluntary. We store your rating (1 to 5), your optional text, whether and under which name we may quote you, the date and your workspace, to improve Trackneat. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving our service). We delete your answers when you delete your account or workspace, or earlier on request.

Quotes: if you allow us to quote you, you state the name, and optionally the agency, under which we may publish the quote. We store your text and these details separately from your account, together with the date of your consent as proof. The quote stays published even after your account is deleted, until you withdraw your consent. You can withdraw it at any time, for example by email to us; we then remove the quote and delete its text and name. Legal basis: Art. 6(1)(a) GDPR (consent).

2.8 Sign-in with Google or Microsoft

Instead of an email address and password, you can also sign up and log in with your Google or Microsoft account. If you click “Continue with Google” or “Continue with Microsoft”, you are forwarded to that provider's sign-in page, where its privacy policy applies. After you confirm, the provider sends us your name, your email address, whether the provider has verified this address, and an identifier of your account with the provider.

Of this, we store your name, your email address and the identifier, so we recognise you the next time you log in. We do not store profile pictures or the provider's access tokens, and we do not access any other data in your Google or Microsoft account. If a Trackneat account with the same verified email address already exists, we link the two. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). We delete the data together with your account.

Providers: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Both providers may also process data in the USA. The parent companies Google LLC and Microsoft Corporation are certified under the EU-US Data Privacy Framework.

2.9 Free tracking check

On our website you can check without an account which tracking tags run on a website (“Tracking check” page). To do this, we process the address you enter and load the page with our check browser on our server in Germany. We keep the address and the result for at most one hour and then delete them automatically. To prevent abuse, we limit the number of checks per IP address; for this we store a pseudonymised value (hash) of your IP address and, so that the same website isn’t checked too often, a pseudonymised value of the checked domain, each for at most 24 hours. Before the check starts, your browser solves a small computing task that makes automated requests harder. We don't use a third-party provider for this.

The only data we keep permanently are anonymous daily counts: how many checks there were, the detected shop system (for example Shopify or WordPress), the domain ending (for example .de) and how many issues were found, without the address. The legal basis is our legitimate interest in providing the check and protecting it from abuse (Art. 6(1)(f) GDPR).

3. Storage Duration

We store your personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by statutory retention periods. Account data is stored for the duration of the contractual relationship and thereafter for the legally prescribed retention periods.

Trials without a subscription: if your free trial ends without a subscription, we delete all monitoring data of your workspace (monitored websites, check results, beacon counts and reports) 30 days after the trial ends. Your user account stays so you can come back later. If you haven't signed in for 12 months, we also delete your account and tell you by email 14 days beforehand. Deleted data remains in our backups for up to 30 days.

4. Disclosure of Data

Your personal data is disclosed to third parties only if:

  • you have given your express consent (Art. 6(1)(a) GDPR),
  • this is necessary for contract performance (Art. 6(1)(b) GDPR),
  • there is a legal obligation (Art. 6(1)(c) GDPR), or
  • this is done on the basis of legitimate interests (Art. 6(1)(f) GDPR).

Recipients may include:

  • Stripe Payments Europe Ltd. (payment processing)
  • Hetzner Online GmbH (hosting)
  • Meta Platforms Ireland Limited (if tracking cookies are accepted)
  • Cloudflare, Inc. (bot protection during signup)
  • Sendinblue SAS (Brevo), Paris, France (sending emails)
  • PostHog, Inc. (product analytics, data stored in the EU in Frankfurt; only with your consent)
  • Google Ireland Limited (Google Analytics 4; only with your consent)
  • Functional Software, Inc. (Sentry), San Francisco, USA (error monitoring for our servers; data stored in the EU in Frankfurt; only technical error reports are sent, without IP addresses, email addresses or request contents)
  • Google Ireland Limited and Microsoft Ireland Operations Limited (sign-in with Google or Microsoft, only if you use it; section 2.8)
  • Microsoft Ireland Operations Limited (Microsoft Clarity on the marketing website; only with your consent; section 2.3)

5. Your Rights

You have the right to:

  • request information about your data stored by us (Art. 15 GDPR),
  • have incorrect data rectified (Art. 16 GDPR),
  • request deletion of your data (Art. 17 GDPR),
  • restrict processing (Art. 18 GDPR),
  • request data portability (Art. 20 GDPR),
  • object to processing (Art. 21 GDPR).

To exercise your rights, contact us at: lucas@blea-media.com.

6. Data Security

We use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, loss, destruction, or access by unauthorized persons.

7. Changes to This Privacy Policy

We reserve the right to amend this privacy policy to adapt it to changed legal situations or changes to our service. The current version is always available on this page.