satsuサツ

Privacy Policy

Last updated: 6 November 2026

Privacy is at the core of Satsu — it’s what the product is about. This policy explains what data we process when you use our website or create an account, and what the Satsu analytics tool collects on our customers’ websites.

1. Controller

Yousif Paulus, Graf-Adolf-Straße 2, 51065 Köln, Germany. Email: hello@satsu.pro. See the Imprint for details.

2. The short version: no cookies, no tracking of individuals

The Satsu analytics tool sets no cookies, uses no persistent identifiers, and builds no cross-device or cross-person profile. In our assessment, running Satsu therefore needs no consent banner. How this works technically is documented at “How it’s private” and “What we track”.

3. Visiting this website

When you access our website (satsu.pro), our hosting provider processes technically necessary access data (e.g. IP address, request time, requested resource, user-agent) to deliver the site and keep operation secure. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning service). This access data is not used for advertising or profiling.

We measure the public pages of satsu.pro with Satsu itself, under exactly the rules described in section 6 for our customers’ websites: no cookies, no persistent identifiers, no tracking inside your account. We count a few actions on these pages, such as starting a site check, copying the install command or completing a signup, without anything that identifies you.

4. Account and use of the service

When you create a Satsu account, we process:

  • your name, email address and a hashed password (argon2, never in plain text; accounts migrated from the previous Satsu keep a bcrypt hash until their next sign-in),
  • the timestamp of your acceptance of the Terms and this Privacy Policy,
  • your organizations, workspaces, sites and settings,
  • billing-related metadata (plan, usage) — payment data itself is held by Stripe, see below.

The legal basis is Art. 6(1)(b) GDPR (performance of the contract). We also send functional emails (e.g. email verification, password reset, invitations).

If you sign in to the Satsu app on your iPhone, we additionally process, as account data, a device session per signed-in device (device name, time last seen) and, if you enable notifications, the push token Apple issues for that device. We use them to keep you signed in and to deliver the notifications you enabled. Device sessions and push tokens are deleted when you sign out on that device and when you delete your account. This concerns only you as a signed-in customer; the app contains no analytics SDK and nothing changes for visitors of your websites.

5. Developer tools (CLI, MCP, API keys)

If you use the satsu-analytics package, its command line (CLI) or its MCP server for coding agents, we additionally process the data below. Unless stated otherwise it is account data and the legal basis is Art. 6(1)(b) GDPR (performance of the contract). This concerns only you as a customer and developer; nothing changes for visitors of your websites.

  • CLI sign-in. When you run npx satsu-analytics init or login, the CLI opens a sign-in request that you confirm in your browser. We store a hash of the request’s secret code, the short code shown in your terminal, the client name the CLI sends (satsu-analytics onfollowed by your computer’s hostname), the status and time of the request and, once you confirm it, your account, the organization you chose and the key that was created. A request can be confirmed for 10 minutes. Whatever its outcome (confirmed, denied or never confirmed), the request is deleted automatically about 24 hours after it expires, at the latest one hour later; a request nobody confirms is never linked to an account. Your IP address is used to limit the number of sign-in attempts (Art. 6(1)(f) GDPR, protection against abuse): a counter per address is kept for about a minute, and the address is not stored beyond that.
  • Personal API keys. A confirmed sign-in creates a personal API key that acts as you. We store only a SHA-256 hash of the key, never the key itself, together with its name (CLI · client name · date), its organization, when it was created, when it was last used and, if it was revoked, when. You see your own personal keys under Settings → API keys; owners and admins of the organization see all of its keys with name, creator and last use. A revoked key stops working immediately. Key records belong to the organization and are deleted with it; if you delete your account, your personal keys stop working and remain without a reference to you.
  • Agent action log.Every change made through a key is logged: the key, the organization and the user, the kind of action (creating a site, setting a site’s domain, creating or changing a goal, starting an audit, creating an uptime monitor), the object it affected, a one-line summary such as “SEO audit on example.com” and the time. You see the log of your own keys under Settings → API keys; owners and admins see it for every key of the organization. The log is kept as long as the key record exists. Reads are not logged individually: we only note, per organization and calendar week, whether the MCP server, the CLI or the REST API was used.
  • “Created by” marker. Sites, goals and uptime monitors record whether they were created in the dashboard, by the CLI or by an agent. Everyone who can see the object sees the marker; it is kept as long as the object exists.
  • Local dev ping. On a local host such as localhost, the package’s components do not load the tracker. Instead they send one dev ping per page load, containing the site ID and the address of the local page without its query string. We use it only to confirm that the install works: per site we keep the time of the latest ping for 15 minutes, so the CLI and the dashboard can show “Seen from your local dev server”. The ping is not stored as an event, does not count against your plan, appears in no statistic and creates no session fingerprint. The ping passes through our message queue only until it is processed, at most 24 hours; its page address, IP address and user-agent are never written to our database.
  • Domain suggestion. While a site has no domain, we remember the first public hostname its traffic comes from (for example example.com) for 30 days and offer it in the dashboard as the site’s domain. This is the hostname of your website, not visitor data; local hosts and IP addresses are never suggested. Everyone who can see the site sees the suggestion.

The MCP server runs on your own machine. It answers your coding agent with aggregated statistics and with your audit and uptime results, never with raw events or session identifiers. What your agent does with these answers, including which AI provider it sends them to, is under your control. The package sends no usage telemetry beyond the API calls it needs. How keys are stored on our side and on your machine is described on the Security page.

6. Analytics data on our customers’ websites

If you run a website with the Satsu tracker, it collects only anonymous usage signals. Collected or derived server-side, in particular:

  • pageviews (path without its query string, screen width, and the referrer reduced to its origin and path — its query string and fragment are removed),
  • custom events — without personal data in their properties,
  • country (derived from the IP, at country level only; the IP itself is never written to the analytics database),
  • browser, operating system and device class (from the user-agent),
  • UTM parameters and the mere presence of an ad click-id parameter (only its name, never its value),
  • the value of the browser’s Sec-Fetch-Site header (for example same-origin or cross-site), which attributes visits whose referrer the browser hides,
  • outbound-link clicks, file downloads and page-performance measurements (Web Vitals), stored as events,
  • a live-visitor marker, held in memory for 60 seconds and never stored.

To group a visit within a single day, Satsu derives a daily-rotating, non-reversible fingerprint sha256(site · ip · user-agent · day · salt). The salt is itself a secret that changes every day. The raw IP and user-agent are never written to the analytics database: they pass through our message queue only until they are processed, at most 24 hours, and are used only to derive the fingerprint, the country, the browser, operating system and device class, and to filter bots. The fingerprint changes at midnight (UTC), so no cross-day or cross-site profile is created. In our assessment, this means no personal data requiring consent is processed.

In data-protection terms, our customers are the controllers for the analysis of their own website; Satsu acts as a processor. We provide a Data Processing Agreement (DPA) on request.

7. What we deliberately don’t do

  • no cookies and no persistent identifiers,
  • no session recordings, mouse movement or individual heatmaps,
  • no cross-day fingerprints and no recognition across days,
  • no reverse-IP company lookup,
  • no sharing or selling of data to advertising networks.

8. Processors and hosting

  • Hosting: Hetzner Online GmbH, Germany. Our servers, and with them all analytics events, are located in Finland.
  • Payments: Stripe (as Merchant of Record). Payment data is processed by Stripe; we do not store full payment instruments.
  • Email: Namecheap (Private Email) sends and receives our transactional and support email.
  • AI citation checks: Anthropic receives the prompts and brand names you configure for AI citation checks. It receives no visitor data.
  • Push notifications:Apple (Apple Push Notification service) delivers the notifications you enable in the iOS app; it receives the device’s push token and the notification text.

9. Retention

Account data is kept for the duration of use and beyond where statutory retention obligations apply. Other data is deleted automatically:

  • analytics events: after 60 months; your plan’s retention window limits how far back the dashboard and API can read,
  • AI-crawler visits: after 13 months,
  • audit and AI citation run history: after 90 days,
  • raw uptime checks: after 95 days (daily summaries are kept),
  • the local dev ping: after 15 minutes; the domain suggestion: after 30 days,
  • raw events in our message queue: once processed, at most after 24 hours,
  • jobs in our job queue (emails, audits, notifications): once processed, at most after 7 days.

When you delete a site, a workspace or your account, the analytics events of the affected sites are deleted within an hour. For an export of your data, email hello@satsu.pro.

10. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). You can delete your account at any time in settings. For requests, contact us at hello@satsu.pro. You also have the right to lodge a complaint with a data protection authority.

11. Excluding yourself from tracking

On a website using Satsu, you can exclude yourself locally by setting localStorage.setItem("satsu_ignore", "true") in the browser console.

12. Changes

We update this policy when our processing or the legal situation changes. The version published here applies.