Privacy
Analytics that keeps you on the right side of GDPR
Cookieless tracking, real data minimization, and an erase API that actually deletes, built so analytics stops being your compliance problem.
The requirements
What GDPR asks of analytics.
Four things a regulator actually checks, and how GetFluxly is built to answer each one.
A lawful basis without a banner
GDPR requires a lawful basis before you process personal data, and consent is the usual answer for tracking cookies. GetFluxly's default tracking is cookieless, a server-computed gfh_ hash instead of a persistent client ID, so there's nothing planted in the browser that needs a consent banner to justify.
Data minimization
Article 5 asks you to collect only what a purpose requires. Nothing about an anonymous visitor is stored before they identify themselves, so there's no shadow profile of every visitor sitting in the database on the off chance they convert.
The right to erasure
Article 17 gives people the right to have their data deleted. GetFluxly has a real erase API: call it with a profile's identifier and every event, trait, and session tied to that person is removed, not just hidden from reports.
No selling or sharing
GetFluxly doesn't sell customer data, doesn't share it with ad networks, and doesn't broker it to third parties. Your analytics data is used to run your analytics, and nothing else.
Why no banner
No cookies, no cookie banner.
Consent banners exist because most analytics tools plant a persistent identifier in the browser before a visitor has done anything, and GDPR requires a lawful basis, usually consent, before that happens. GetFluxly's default tracking doesn't work that way.
Anonymous visitors are identified with a gfh_ hash computed on the server from the request itself, not a cookie written to the browser. Nothing about a visitor is stored before they identify themselves, whether that's a signup, a login, or a form submission, so there's no persistent identifier sitting around that needs consent to justify.
Read the full mechanics on how cookieless mode works, or see the broader picture on our security page.
Rights, honored
Data subject rights.
The parts of GDPR that are about what happens after data is collected, not just how it's collected.
01
Erase on request
The erase API removes a person's events, sessions, and traits on request, not a soft delete that leaves the rows queryable. This is what backs a right-to-erasure request under Article 17.
02
Export what's held
A person's profile, its traits, and its event history can be pulled and handed over, so a data access or portability request has a real answer instead of a shrug.
03
No data sold or shared
Data collected through GetFluxly is used to run your analytics and your product's automations. It isn't sold, and it isn't shared with ad networks or data brokers.
04
EU-friendly storage
Storage and processing are handled with EU data protection obligations in mind, so a GDPR review isn't starting from a compliance deficit.
Retention
What we store, and for how long.
A specific answer, not a vague privacy-policy gesture.
- Before identification. An anonymous visitor is represented by a gfh_ hash computed server-side from the request. No cookie, no fingerprint, no name, no email, nothing that reidentifies them on its own.
- After identification. Once a visitor signs up, logs in, or submits a form, their events attach to a real profile: the traits you send us, plus the sessions and events tied to that profile going forward.
- How long it's kept. Event data is retained for up to 180 days and then deleted. Profile data stays while your account is active, so you can look back at trends over time. Delete a profile through the erase API and its data is removed, not archived.
- What we never collect. No device fingerprinting, no cross-site tracking identifiers, no purchased or third-party data appended to your visitors.
Full details on data handling, subprocessors, and storage regions are on our security page, and the legal terms are in our privacy policy.
Not legal advice. This page describes what GetFluxly does technically. Whether your use of it satisfies your GDPR obligations depends on your full data flow and jurisdiction, so check with counsel for anything that needs a legal answer.
See the rest of what's cookieless.
This page covers GDPR specifically. For the full technical picture, read how cookieless analytics works, or check our security page.
FAQ
Questions, answered.
Does GetFluxly make my site GDPR compliant automatically?
No single tool can promise that, because compliance depends on everything else on your page too, not just analytics. What GetFluxly does is remove analytics as a reason you need a cookie banner: cookieless tracking, no pre-signup storage, no fingerprinting, and a real erase API for the personal data it does hold.
Do I still need a cookie banner if I use GetFluxly?
For analytics specifically, most teams don't, because there's no persistent client-side identifier being set before consent. If your page also runs ad pixels, other cookie-based trackers, or non-essential cookies for other purposes, those still need their own basis, so check your full stack, not just analytics.
How does the erase API work?
Call it with a profile's identifier and every event, session, and trait tied to that person is deleted from the underlying data, not just hidden from the dashboard. It's built to answer a right-to-erasure request directly.
Is this legal advice?
No. This page describes what GetFluxly does technically. Whether that satisfies your specific GDPR obligations depends on your full data flow, your legal basis, and your jurisdiction, so check with counsel for anything that needs a legal answer.
Where is data stored and processed?
Storage and processing are handled with EU data protection requirements in mind. For specifics on regions and subprocessors, see our security page.