Legal · privacy policy

Privacy policy.

Last updated 9 November 2026.

This policy covers personal data about you, our customer: your account, billing and emails with us, and your visits to clickvitals.com. For data the ClickVitals script collects from visitors to your websites, see section 8 and our privacy and data page.

1. Who we are

ClickVitals is run by Mason Lyons, trading as ClickVitals, in the United Kingdom. For your account data, we're the controller under UK GDPR. Contact us about anything in this policy at [email protected].

2. What we hold about you

Account: your email address, a hashed copy of your password (we never see or store the password itself), your organisation's name, the people you invite and their roles, and whether you've verified your email.
Sites: the websites you add and their settings.
Billing: your plan, billing period and subscription status, and the IDs Stripe uses for your customer record and subscription. Your card details go straight to Stripe and never reach our servers.
Emails: messages you send us, and a record of the account emails we send you (verification, password reset, usage and billing notices).
Technical logs: our servers log requests to the app, which can include your IP address and browser, for security and fixing faults.

3. Why we use it, and our lawful basis

To provide the service you signed up for: your account, dashboards, billing and the emails that go with them. Basis: performing our contract with you.
To keep the service secure and working: preventing abuse, investigating faults. Basis: our legitimate interest in running a secure service.
To keep records of payments, as the law requires. Basis: legal obligation.

We don't send marketing emails without your consent, we don't sell your data, and we don't use it for advertising.

4. Cookies

The app at app.clickvitals.com sets two cookies, both strictly necessary: one keeps you logged in, and one protects forms against cross-site request forgery. There are no advertising or tracking cookies.

clickvitals.com uses ClickVitals itself to measure the site. It sets no cookies and stores nothing on your device; how it works is set out on the privacy and data page.

5. Who processes data for us

We use a small number of providers, each only for the job listed:

Amazon Web Services: hosting the app and database, and sending account emails. Data is stored in London (eu-west-2).
Stripe: taking payments and managing subscriptions.
Cloudflare: hosting clickvitals.com and our DNS.
MXroute: hosting our email inbox, so it holds the emails you send us.

Some of these providers process data outside the UK, for example Stripe in the United States. Where they do, the transfer is covered by UK adequacy regulations or by the UK's approved data transfer agreements.

6. How long we keep it

Account and site data: while your account is open. When you close it, we delete it within 30 days.
Billing records: six years after the transaction, as UK tax law requires. Stripe keeps its own records under its own policy.
Server logs: 14 days.
Emails with us: as long as needed to deal with what you asked about, and no more than six years.

7. Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to move it to another service. Email [email protected] and we'll reply within one month. To correct your email address or close your account, email us; you can reset your password yourself from the login page.

If you're unhappy with how we've handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

8. Your website visitors

When you install ClickVitals on your site, you're the controller of the data it collects about your visitors, and we process it for you, only on your instructions and only to provide the service. Our terms of service set out those instructions and your responsibilities.

The script is designed to collect as little as possible: no cookies or device storage, no fingerprinting, and raw IP addresses are never stored. The full list of what's collected is on the privacy and data page. That data is stored in the UK. If one of your visitors contacts us, we'll pass the request to you.

9. Changes

If we change this policy in a way that matters, we'll email account holders before it takes effect. The date at the top shows when it last changed.