WhereTheyLeave
Log in

Privacy Policy

Effective date: March 13, 2026 · Last updated: October 25, 2026 · wheretheyleave.com

1. Overview

WhereTheyLeave ("we", "our", "the Service") is a website analysis tool operated by Dominik Supiński (sole trader, United Kingdom). This Privacy Policy explains what data we collect, how we use it, and what rights you have.

Our core privacy principle: the analysis runs in your browser. An uploaded file is read there and never leaves it. For the GA4 connection, our backend fetches the data and hands it to your browser. In both cases we keep the finished report, not the raw data, and we have no access to your customers' personal information.

2. Data We Collect

2.1 Account data

When you register or sign in, we collect:

  • Email address
  • Name (if provided via Google Sign-In)
  • Authentication tokens (managed by Supabase Auth)
  • Account creation date and last login timestamp
  • How you heard about us and what best describes you, if you answer these optional questions at sign-up. They help us see where our users come from
  • The country you finish signing up from, as your connection shows it. We keep the country only, not your IP address

2.2 Usage data

We collect minimal usage metadata to operate the service:

  • Number of analyses run and generated report results (stored for logged-in users to build history and trends)
  • Subscription plan and billing status
  • A hashed IP address, for rate limiting
  • When an analysis stops with an error: which step it reached, your browser type and the page address — never the data being analysed
  • Hosting logs (IP address, browser type) kept by our hosting provider for a short time

2.3 Analytics data (GA4 / file uploads)

How your funnel data is handled depends on the source. File uploads are processed entirely in your browser. Data from the GA4 API connection is fetched by our backend and delivered to your browser for analysis. In both cases, raw analytics data is not stored on our servers.

  • File uploads are read locally by your browser. Neither the file nor its rows are uploaded.
  • GA4 data is fetched from Google's API by our backend using your stored OAuth token and delivered to your browser for analysis. The raw rows are not cached or retained on our servers.
  • What is saved with a report: the computed figures, the names of the events and pages it used, and aggregated revenue totals.

Reports generated from your data are saved to the database for logged-in users and used to build trends and analysis history. If you run an analysis without an account, the finished report is parked on our servers for 48 hours so you can save it after signing up; then it is deleted. Only the browser that ran it can open or save it.

2.4 Payment data

Paid plans are sold through Link, Stripe's checkout service, as merchant of record. Stripe collects your name, billing address and payment details and acts as an independent controller for them under its own privacy policy. We never see or store card numbers. We store only your plan, its status and billing period, the renewal date, and the Stripe customer and subscription IDs.

2.5 Cookies and local storage

We use:

  • Session cookies — required for authentication (Supabase Auth), and a short-lived cookie that ties a guest report to the browser that ran it.
  • SessionStorage — temporary storage of your current report. Cleared on tab close.
  • LocalStorage — your cookie choice (wtl_cookie_consent) and, for a guest run, the id of the parked report, until you save it or it expires.
  • Google Analytics (gtag.js) — loaded only when you explicitly accept analytics cookies. Used to understand how visitors use our website. You can change your preference at any time via the cookie settings link in the footer.

No advertising cookies are used. Analytics cookies (Google Analytics) are loaded only with your explicit consent.

2.6 Aggregated revenue data

We store aggregated revenue totals (total revenue, transaction counts) from your connected analytics account to power campaign ROI tracking and version comparison features. We do not store individual transaction details, customer data, or order-level information.

2.7 Anonymous industry benchmarks

We use aggregated, anonymized metrics derived from saved reports (such as conversion rate, cart abandonment and page-speed scores, grouped by industry category) to compute industry benchmark averages shown to our users. These averages never identify you, your organization, or your website: an average is only ever published when it is computed from at least 30 different projects, and no individual values are ever shown or shared. Deleting a project or your account removes its underlying contributions; already-published averages are irreversible aggregates and are retained.

3. Google API Data (GA4 Integration)

WhereTheyLeave uses the Google Analytics Data API with the following scope:

analytics.readonly — read-only access to your Google Analytics 4 properties.

email — used to identify your Google account and display your email address in the app.

How access is used:

  • Your OAuth access token and refresh token are stored in our database (Supabase). Only our server processes can read them: not your browser, and not other members of your organization.
  • Requests to the Google Analytics Data API are made from our backend server on your behalf, using your stored token.
  • GA4 data retrieved from the API is used exclusively to generate your analysis report. The raw rows are delivered to your browser and are not stored on our servers; the finished report is saved to your account. Our server logs record errors, not data.
  • Tokens are never shared with anyone. Figures from a finished report (aggregated metrics, event and campaign names) reach our AI provider only when you use an AI feature (section 5).
  • GA4 data is not used to train AI models or for advertising purposes.

You can revoke access at any time at myaccount.google.com/permissions. This immediately invalidates your stored tokens and disconnects your GA4 integration. You can also disconnect from within the app at any time. When you disconnect, or delete a project, an organization or your account, we also revoke our access at Google, unless another connection still uses that Google account.

We request offline access so the app can refresh your GA4 connection automatically without requiring you to re-authorize on every visit. That is what the refresh token is for; it is stored and protected the same way as the access token.

Limited Use Disclosure

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • We only use GA4 data to provide and improve the funnel analysis features visible to you.
  • We do not transfer GA4 data to third parties, except as necessary to provide the service or as required by law.
  • We do not use GA4 data for advertising, ad targeting, or any purpose unrelated to the core service.
  • No human reads your GA4 data, except with your explicit consent, for security investigation, or to comply with applicable law.

4. Your Rights (UK GDPR and GDPR)

If you are in the United Kingdom or the European Economic Area, you have the following rights:

  • Access — request a copy of personal data we hold about you.
  • Rectification — correct inaccurate personal data.
  • Erasure — request deletion of your account and all associated data.
  • Restriction — request that we restrict processing of your data.
  • Portability — receive your data in a structured, machine-readable format.
  • Objection — object to processing based on legitimate interests.
  • Withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, email us at hello@wheretheyleave.com. We will respond within 30 days.

You can also complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority where you live.

Legal basis for processing: contract performance (account and subscription management) and legitimate interests (service improvement and security). We do not rely on consent for core service functionality.

5. AI-Powered Features

WhereTheyLeave offers optional AI-powered features — the AI Analyst chat on reports and on the project dashboard, and AI-written recommendations — that help you interpret your data. Some are included on every plan and some only on paid plans; the pricing page lists them.

How AI features work:

  • When you use an AI feature, your generated report data (aggregated metrics such as funnel steps, conversion rates, and drop-off percentages) is sent to the Anthropic API (Claude) for processing.
  • The AI Analyst on the project dashboard also sends how those metrics changed across your saved reports, and how the project is set up: the report schedule, the number of report recipients (not their addresses), the data connection status, your plan's usage, and recent project activity, including the names of teammates who did it.
  • Only processed report output is sent — never raw analytics data, file contents, or personally identifiable information about your website visitors.
  • Anthropic does not use data sent via their API for model training. Their data retention policy applies (see anthropic.com/privacy).
  • AI conversations are stored in your account for continuity: one per report, and one per project per calendar month. A project's conversation is visible to the members of its organization. How many questions you can ask depends on your plan. You can choose not to use AI features at any time.
  • We log AI requests (prompt, response, model, token count) for debugging and service improvement. These logs are associated with your user ID and retained for 90 days.

AI-generated insights are informational only and should be verified before making business decisions.

6. Data Sharing and Sub-processors

We use the following third-party processors:

  • Supabase (authentication and account database) — hosted in EU region.
  • Stripe (payments, as merchant of record through Link) — an independent controller for payment data, PCI-DSS compliant.
  • Vercel (hosting) — servers in EU region (Frankfurt).
  • Resend (transactional email).
  • Anthropic (AI-powered analysis features) — data processed via API under Anthropic's API terms; not used for training.
  • Google — PageSpeed Insights (receives your site's public address to measure its speed) and, with your consent, Google Analytics on our own website.

We do not sell personal data. We do not share data with advertisers. We do not use your data to train AI models.

7. Data Retention

  • Account data and reports — retained while your account exists, on any plan, also after a paid plan ends. Deleted within 30 days of an account deletion request, or with the account after 2 years without a sign-in (we email you 30 and 7 days before; signing in once keeps everything).
  • Deleted accounts that used free analyses — that count and a keyed hash of the email address, for 180 days, so the count doesn't reset when the same address signs up again (legitimate interest: preventing abuse of the free plan). The hash can't be read back as the address; it only shows that the same address came back.
  • Money-back refunds — a keyed hash of the email address and Stripe's fingerprint of the card (not the card number), for 730 days, so the money-back guarantee applies once per person (legitimate interest: preventing abuse of the guarantee).
  • Guest reports — 48 hours.
  • AI request logs — 90 days.
  • Hashed IP addresses (rate limiting) — 24 hours.
  • Billing records — retained for as long as UK tax law requires.
  • Raw analytics data (file rows, GA4 rows) — never stored on our servers.

8. Security

We apply the following security measures:

  • All data in transit encrypted via TLS 1.2 or higher.
  • Database access restricted to authenticated server processes only.
  • OAuth tokens are readable only by our server processes; the browser and other organization members cannot query them. Browser sessions use signed, short-lived tokens that refresh automatically.
  • Regular dependency audits and security updates.

We will notify affected users of any data breach within 72 hours of discovery, as required by GDPR Article 33.

9. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If changes are material, we will notify registered users by email at least 14 days before the change takes effect. Continued use of the Service after that date constitutes acceptance of the updated policy.

11. Contact

Data Controller: Dominik Supiński, sole trader, trading as WhereTheyLeave

Email: hello@wheretheyleave.com

Website: https://wheretheyleave.com/privacy

Country of establishment: United Kingdom