Skip to content
Start freeGo to your sites

Security and data

Your analytics data is processed in the EU.

The app runs in Frankfurt, Germany. The database runs in Vienna, Austria. twelvebit does not store IP addresses. This page lists what we collect, who processes it and how access is protected.

The tracker

What the script on your site does.

  • What it collects

    The page address, referrer and campaign, the browser, device and language, the country and city, and the events that the site owner sends.

  • What it does not collect

    No form fields, no session recordings, no screens, and no profiles across different websites.

  • IP addresses

    twelvebit uses the IP address only while it handles a request: for exclusion rules, flood protection and the cookieless hash. twelvebit does not store it.

  • Cookies

    Two first-party cookies with random IDs (_tb_vid for 1 year, _tb_sid for 30 minutes), or none in cookieless mode.

Access

How keys and agents get access.

  • API keys are hashed

    twelvebit stores a SHA-256 hash of each key and its first characters, never the key. A key can be limited by scope and can expire.

  • Agents sign in with OAuth

    MCP clients get access only after you approve them in the browser. Read only is the default. An app can never manage the team or keys.

  • Disconnect at any time

    Account → Connected apps removes an app. Its tokens stop working on the next call.

  • Keys stay out of chat and git

    The setup prompt tells your agent to write the key to .env only when .env is in .gitignore. The browser tracker needs no secret.

Subprocessors

Who processes data for twelvebit.

Subprocessors
FeatureWhere or whatWhat they do
VercelUnited States, EU regionHosts the app; its functions run in Frankfurt. Handles each request, including the IP address.
netcupGermanyThe server in Vienna, Austria, that runs the database.
ResendUnited StatesSends account emails, reports and alerts.
Dodo PaymentsMerchant of recordTakes payments for paid plans. twelvebit never sees the full card number.
AffonsoAffiliate programReferral cookies on the public pages only, after a partner link.
OpenRouter, AnthropicUnited StatesAnswers questions in Ask. Receives the question and the totals it needs, not visitor identities.
TelegramInternal notificationsTells us about sign-ups and plan changes.

Retention and deletion

  • Analytics data stays while the site is in your account. When you delete a site, its analytics data is deleted.
  • When you close your account, your account data and analytics data are deleted within 30 days.

Consent

In cookie mode the script stores an identifier on the device for up to one year. In the EU and the UK this usually needs consent unless an exemption applies. Cookieless mode stores nothing on the device. See the privacy docs. This is a description of the product, not legal advice.

Report a problem

Found a security issue? Write to hello@twelvebit.io. For data requests, write to privacy@twelvebit.io. The full details are in the privacy policy.