Hitsteps Privacy and Cookie Policy

What this policy covers

This privacy policy describes how Hitsteps uses and protects information collected when you use Hitsteps directly, or when your browser interacts with a website that uses Hitsteps services.

Hitsteps is committed to protecting the privacy of website owners and their visitors. We may update this page from time to time, and the newest version will always be published here.

Information we collect from Hitsteps users

When a website owner registers, manages an account, opens a support request, or purchases a license, we may collect information needed to provide the service.

• Name, email address, and telephone number if provided.
• Hitsteps account ID, login details, and hashed password data.
• Website details, tracking settings, Segment definitions, and dashboard preferences.
• Billing, subscription, invoice, and Shopify app installation records where applicable.
• Support tickets, messages, and account-related correspondence.

We collect this information to create accounts, authenticate users, provide dashboards, process billing, prevent abuse, and respond to support requests.

Chrome extension data

The Hitsteps Chrome extension is used by account owners and authorized operators to monitor their own Hitsteps dashboard from the browser toolbar.

• The extension stores the user's Hitsteps API key and extension preferences in Chrome local storage.
• The extension sends the API key to Hitsteps to retrieve visitor counts, pageview counts, dashboard notification status, and live support availability updates.
• When live support presence is enabled, the extension may send whether the browser session is active or idle so the operator is not shown as available while away.
• When notifications are enabled, the extension may receive and display notification titles, descriptions, links, and bundled local sound choices for dashboard events or live support requests.

The Chrome extension does not read browsing history, inspect page content on websites, collect keystrokes, monitor mouse movement, or inject tracking code into pages visited by the user.

Our use of information received from Google APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

Data Studio (formerly Looker Studio) data source

The Hitsteps data source for Google Data Studio lets Hitsteps customers show their own website analytics in Data Studio reports. It runs as a Google Apps Script project published by Hitsteps.

• Google permission: the data source requests only "Connect to an external service" (https://www.googleapis.com/auth/script.external_request). It uses this permission only to request the customer's reports from https://www.hitsteps.com/api/, the only address it is allowed to contact.
• Stored at Google: the Hitsteps API code you enter is kept in your own Apps Script user storage so Data Studio can reconnect. Report results are cached in your Apps Script user cache for up to one hour.
• Sent to Hitsteps: the API code, the report and the date range that Data Studio requests. Hitsteps returns aggregate analytics for that website, without visitor identities.
• Not accessed: the data source does not read your Gmail, Google Drive, Sheets, contacts, calendar or other Data Studio reports, and it does not send your Google account name or email address to Hitsteps.

Hitsteps uses this information only to return the reports you request. We do not sell it, use it for advertising, or use it to train AI models. The owner of a Data Studio report decides who can see it. To remove the stored API code, revoke the connector's access in Data Studio. To remove the Google permission, use your Google Account permissions page (https://myaccount.google.com/permissions). Cached results expire within one hour.

Hitsteps' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Information processed for customer websites

Hitsteps processes analytics data on behalf of website owners so they can understand how visitors use their sites. Each website profile belongs to its authenticated account owner.

We do not allow cross-site or cross-account tracking. Data for one customer website is not made available to another customer.

How we use information

We use collected information only for purposes connected to operating, securing, improving, and supporting Hitsteps.

• Provide real-time analytics, visitor history, live chat, alerts, uptime monitoring, and CRM-style follow-up tools.
• Show website owners aggregated and visitor-level reports inside authenticated dashboards.
• Maintain account records, billing records, and customer support history.
• Protect accounts, investigate abuse, debug service problems, and improve reliability.
• Send important service messages and, where allowed, product updates that users can unsubscribe from.

How information is shared

We do not sell, distribute, or lease personal information to third parties unless we have permission, need to provide the service, or are required by law.

• Customer website data is visible only to authenticated users who are allowed to access that website profile.
• We may use infrastructure, security, email, payment, analytics, and support providers to operate Hitsteps.
• We may disclose information when required to comply with law, enforce our terms, prevent fraud, or protect our users and service.

Our website and customer dashboards may contain links to other websites. Those websites are not governed by this privacy policy, and you should review their own privacy policies.

Hitsteps AI and OpenAI

Hitsteps AI is an optional dashboard feature. An account owner or administrator must enable it for the account, and each dashboard user must review a one-time disclosure before sending a first message. The account owner or an account administrator can disable Hitsteps AI later from website settings.

When a dashboard user sends a Hitsteps AI message, Hitsteps sends the user’s question, a bounded number of recent chat messages, and the Hitsteps analytics or account information needed to answer to OpenAI through its API. Confirmed account actions may also send the proposed action and the information needed to perform it. Users should avoid entering unnecessary sensitive or special-category personal information.

• Provider and purpose: OpenAI Ireland Ltd. and applicable OpenAI affiliates process the data to generate answers, invoke authorized Hitsteps tools, provide security, and prevent abuse.
• Model training: OpenAI states that API inputs and outputs are not used to train or improve its models by default unless the API customer explicitly opts in. Hitsteps does not opt in to model-training data sharing for this feature.
• Provider retention: under OpenAI’s default API controls, abuse-monitoring logs may contain prompts and responses and are retained for up to 30 days, subject to stated legal and safety exceptions. Hitsteps sends Responses API requests with response storage disabled, but that setting does not by itself remove OpenAI’s separate abuse-monitoring logs.
• Hitsteps records: When encrypted support-history retention is enabled, Hitsteps stores questions, bounded recent chat context, AI replies, and proposed or confirmed action details for 30 days to investigate failures and improve reliability. The content is encrypted with separately managed keys. Staff review requires an exact account and request, conversation, or action reference, a named reviewer, a ticket or incident reason, a time-limited production authorization, and an access-audit record written before decryption. Hitsteps deletes the encrypted content automatically after 30 days and retains the content-access audit for 365 days. Enabling this mode requires users to review the updated Hitsteps AI disclosure. Separately, Hitsteps retains limited account, dashboard-user, website, request, model/tool-usage, confirmation, and categorized safety-event metadata for 90 days. A limited conversation can also remain in the user’s browser tab for up to 24 hours and can be cleared with New chat.
• International transfers: OpenAI and its infrastructure or moderation providers may process data outside the EEA, including in the United States. Hitsteps uses the data-processing and transfer safeguards in its provider agreement, including the European Commission’s Standard Contractual Clauses where required, and applies data minimization, access control, encryption in transit, bounded history, and pseudonymous safety identifiers as supplementary measures.

See the Hitsteps subprocessor list for provider details and links to OpenAI’s current data-control and subprocessor information.

Connections to AI assistants through MCP

You can choose to connect an AI client, such as ChatGPT, Claude or Cursor, to Hitsteps through the Model Context Protocol (MCP). You sign in on Hitsteps and review the requested permissions before authorizing a connection. Access is limited by your account, website permissions, plan and granted scopes. The MCP server receives the client's tool requests and arguments, not automatically the client's entire conversation history.

Depending on the requested tool and permissions, the client can receive account and website identifiers, names and URLs; aggregated traffic, country, device, acquisition, page, conversion and uptime reports; plan and feature-access information; goals, campaigns, Segments, Funnels, Mentions and website configuration; and uptime contact names, email addresses or phone numbers. Chat-scoped requests can include visitor names and email addresses, a visitor reference and country, ticket messages and internal notes. Chat messages are returned as bounded plain text rather than duplicate HTML. Alert listings provide categories, state, event times and dashboard links rather than stored message bodies. Website and account data supplied for an authorized change is stored as that feature normally requires.

At your request, the tracking-code tool also returns your website tracker identifier, installation snippets and website API code so the assistant can help install Hitsteps. Keep the API code private: it can also provide legacy read access where that compatibility path is enabled. Other passwords, private keys, provider API keys and verification codes are entered on Hitsteps dashboard pages, not collected through MCP tools.

Requested results are transmitted to the AI client you selected and its operator. That provider and its service providers may process or retain them under their own terms, privacy policy and account settings, including outside your country. Review those policies before connecting. The OpenAI API controls described in the preceding Hitsteps AI section apply to that dashboard feature; each external client has its own processing and retention terms. Hitsteps cannot erase copies already held by the connected provider.

Hitsteps uses these requests to authenticate and authorize access, return the information you request, carry out explicitly confirmed changes, prevent misuse and diagnose service reliability. MCP cannot change account billing, licenses, passwords or two-factor authentication. Form capture, consent mode and text, and Do Not Track settings are managed in the dashboard and cannot be changed through MCP. MCP does not offer filters for visitor IP, names, registered identity, city, region, organization or wallet-extension classifications. Existing dashboard filters and website consent rules continue to apply.

For operation, security and reliability, MCP usage records contain account and optional website identifiers, credential type, public OAuth client identifier, a client category derived from registration metadata, tool name, outcome category, duration and time. This usage store excludes prompts, tool arguments, result content, raw user-agent strings, tokens and full error messages. Confirmed-write records contain hashed request and idempotency identities and minimal target/outcome metadata. These stores are separate from the ordinary login/security audit, which can contain account identity, IP address, browser/request metadata and a session hash.

MCP usage metadata and hashed write-operation state become eligible for deletion after 90 days; write-audit metadata after 365 days. Authorization codes expire after five minutes and become eligible for deletion one day after expiry. Access tokens last one hour; rotating refresh tokens have an absolute 90-day family lifetime. Only token/code hashes are stored by OAuth. Token rows become eligible for deletion 30 days after refresh expiry or revocation. Registration address data and its rate-limit hash become eligible for clearing after one day. Registered client metadata has no automatic deletion deadline; ordinary login/security audit records also currently have no automatic deletion deadline. OAuth cleanup is probabilistic and batched, so deletion can lag these eligibility dates. The underlying analytics and customer records follow the feature and plan retention described elsewhere in this policy.

You can cancel before authorizing, disconnect in your AI client, or have the client call Hitsteps' advertised OAuth revocation endpoint. Server-side revocation invalidates the access and refresh tokens in that connection family. Disconnecting a client does not necessarily call revocation; contact Hitsteps support if you need server-side revocation or an erasure request and cannot confirm that it happened. Website-permission changes are checked on subsequent requests. Revocation stops future access but does not remove data already received by a provider or records still retained under the periods above.

Where the existing website analytics feature is used, Hitsteps can detect the presence of browser wallet extensions to classify browser capabilities. This is extension-presence information, not a wallet address, balance, transaction history or access to funds. These classifications are not exposed as MCP Segment filters. Website owners remain responsible for the applicable visitor notice and consent.

Contact Hitsteps about access, revocation or erasure.

How long we keep information

We keep information only as long as it is needed for the purposes described in this policy, unless a longer period is required for legal, accounting, security, or dispute-resolution reasons.

• Account information is kept while the customer account is active and being used.
• Inactive customer accounts may be suspended and deleted after 720 days of inactivity.
• The Free plan includes 14 days of detailed visitor history; paid plans offer 30–360 days. Visitor profiles are aged from their most recent activity, and expired records are removed in scheduled batches.
• Aggregated statistics, such as total pageviews or visitor counts, may remain while the customer has an active account.

How we protect information

We use technical and organizational safeguards designed to protect information from unauthorized access, disclosure, alteration, or destruction.

• Dashboard access requires authentication, and website data is no longer shared through public report URLs.
• Passwords are salted and hashed; cleartext passwords are not stored.
• Hitsteps redirects service access to HTTPS by default to encrypt data in transit.
• Production data access is limited to authorized staff, and development work uses separated or dummy data where possible.
• Servers are protected with firewall controls and maintained with security updates and operational monitoring.

Access, deletion, and opt-out choices

Website owners can manage many privacy-related settings from their Hitsteps dashboard, including consent, anonymization, and tracking options.

GDPR Privacy Controls

Visitors should first contact the website owner where their information was collected. If the website owner does not reply within seven days, visitors may Contact us and provide the website address plus enough information for us to locate a match.

Visitors can also opt out from being tracked on customer websites by using our tracking opt-out form.

DPA forms are available upon request for customers who need one.

How we use cookies

Cookies help us keep users logged in, remember dashboard preferences, diagnose service problems, understand returning visitors, and respect opt-out choices. Dashboard cookies that are necessary for login and security cannot be disabled inside Hitsteps. Tracking cookies are used only when permitted by the website owner's settings and visitor consent requirements.

Browsers control cookie storage. You can remove cookies in your browser settings, but doing so may log you out or reset preferences.

Changes to this policy

We may update this privacy policy to reflect product, security, legal, or operational changes. When we make material changes, we will update the date at the top of this page and may provide additional notice when appropriate.

Questions about this policy can be sent through our contact page.