Who does what
Twelvebit ("we") runs twelvebit, a web and revenue analytics service. There are two kinds of data, and our role differs for each:
- Your account data, such as your name and email address. For this data we are the controller.
- Analytics data that the tracker collects on your websites. For this data you are the controller, and we process it for you as your processor. We use it only to provide the service to you.
What the tracker collects
When a person visits a website that uses twelvebit, the tracker sends:
- the page address, the referrer and campaign parameters (for example utm_source),
- the browser, the operating system, the device type, the screen width and the language,
- the country, region and city, which come from the hosting network with the request,
- the custom events and props that the site owner chooses to send, for example signup with plan=pro,
- for revenue attribution: the amount, currency, product and customer ID of a payment, from the site owner's payment provider.
The tracker does not read form fields, does not record sessions or screens, and does not build profiles across different websites. The setup prompt tells coding agents not to put personal data in event props.
Requests from known bots and crawlers are not counted as visitors.
Cookies
The tracker sets two first-party cookies on the website's own domain:
| Cookie | Lifetime | Purpose |
|---|---|---|
| _tb_vid | 1 year | A random visitor ID, so a return visit counts as the same visitor and a payment can join the visits before it. |
| _tb_sid | 30 minutes | A random visit ID, so page views in one visit belong together. |
Site owners can turn on cookieless mode. Then the tracker sets no cookies. The visitor ID becomes a one-way hash of the IP address, the browser and a secret salt that changes every day, so it cannot follow a person from one day to the next.
The twelvebit dashboard uses only the cookies it needs to keep you signed in. This marketing site uses no third-party cookies and no advertising tags.
IP addresses
twelvebit uses the IP address only while it handles a request: to apply the site owner's exclusion rules, to stop floods of fake traffic and, in cookieless mode, as one input of the daily hash. We do not store IP addresses.
Your account data
When you create an account we store your name, your email address, a hash of your password (or the ID from the sign-in provider you choose), your team, your sites and their settings. We use this data to run your account, to send you service emails such as password resets and alerts you set up, and to answer you when you write to us. When billing starts, our payment provider processes your payment details. We do not see your full card number.
Where we process data
Analytics data and account data are processed in the European Union. The database runs in Germany. We use a small number of subprocessors, for example for hosting and for sending email. We will publish the list of subprocessors on this page before the end of the public beta.
How long we keep data
- Analytics data stays while the site is in your account. When you delete a site, we delete its analytics data.
- When you close your account, we delete your account data and your analytics data within 30 days.
- We keep invoices and other records for as long as the law requires.
Your rights
Under the GDPR you can ask us for a copy of your data, ask us to correct or delete it, ask us to limit how we use it, object to its use, and take it to another service. You can also complain to a data protection authority.
If you visited a website that uses twelvebit, please contact the owner of that website first, because they control that data. We help them answer your request.
Contact
Write to privacy@twelvebit.io for any question about this policy or your data. If we change this policy in a way that matters, we tell account holders by email before the change applies.