GDPR & Data Protection

Compliant by design

• No cookies, no local storage on the visitor's device - so there is generally no ePrivacy "consent for storage" trigger from Clicked.
• No fingerprinting and no persistent or cross-site identifier.
• Aggregate only. We report by traffic source; we do not build individual visitor profiles and do not identify EU/UK visitors.
• Data minimisation. IP addresses are used transiently to derive coarse location and are not stored in analytics tables.

Controller and processor

For visitor data, you (the site owner) are the controller and Clicked is your processor, processing only on your documented instructions. For your Clicked account data, we are the controller. See the roles section of our Privacy Policy.

Legal basis

Because Clicked does not store information on the visitor's device and does not identify individuals, most of our processing relies on the legitimate interest of the site owner in understanding aggregate traffic performance, with strong safeguards. You remain responsible for the legal basis of any other scripts on your site.

Sub-processors and location

Clicked runs on Cloudflare, our sole infrastructure sub-processor. Visitor requests are processed at the Cloudflare edge nearest the visitor; EU visitors are processed within Cloudflare's network. We will keep an up-to-date list of sub-processors and notify account holders of material changes.

Data Processing Agreement

If you need a signed Data Processing Agreement (DPA) for your records, email privacy@clicked.is and we will provide one.

Data subject requests

Because we hold effectively no visitor-level personal data, access and erasure requests are usually straightforward. Visitors should contact the site owner (controller); site owners can reach us at privacy@clicked.is and we will assist.

This page is provided for transparency and is not legal advice. Please have your own counsel confirm your obligations for your specific use.