We count the visits. Not the visitors.

"Tracking is surveillance." That's the most common objection, and it conflates two very different things.

An advertising pixel observes a person across sites that don't belong to them. That's the behavior GDPR regulates heavily, that browsers are blocking one after another, and that made third-party cookies disappear.

A tracked link counts passes through a door that you own. That's not the same operation, it's not the same legal risk, and confusing the two leads agencies to abandon perfectly legitimate measurement.

What gets recorded at each click

No vague list — here are the seven fields written to the database, and nothing else.

Statistical aggregates — daily totals by country, by device — are kept without time limit, because they no longer contain anyone. Raw events expire at thirteen months.

Look at the middle column. None of these seven fields identifies anyone. It's a door counter, not a visitor log.

What is not recorded, and why that's a choice

These three refusals are written into our privacy policy, not just on a marketing page. They're design decisions, not technical limitations.

Zero stored IP addresses. The IP is read in memory for two things — determining the country and filtering out bots — then discarded immediately. No IP is ever written to the database. The difference between "we protect it well" and "we don't have it" is that only the second survives a breach.

Zero device fingerprinting. We don't combine screen resolution, fonts, plugins, and timezone to build a persistent identifier. This practice is prohibited by the product's design, not just discouraged: the field doesn't exist anywhere.

Zero third-party cookies. The link itself deposits none. The optional tracking script placed on your client's site writes the click identifier to localStorage on your client's domain — first-party storage, under the key subtraq.click. Nothing travels to a third-party domain.

And a fourth, less well known: the referrer is truncated to its hostname. We keep instagram.com, never instagram.com/p/private-identifier…. A full path can contain personal data; we don't take it.

The responsibility split, in two sentences

This is the part American tools leave vague, and it's the first thing your data protection officer will read.

GDPR distinguishes two qualifications. For data associated with your account — authentication address, language preference, billing, API keys — we are the data controller: we decide the purposes, we answer to you.

For the clicks, leads, and sales collected on your end clients' campaigns, the relationship is reversed: [your agency](/agences-marketing) is the data controller vis-à-vis its own visitors, and we act as a processor under Article 28 of GDPR, on your instructions and nothing else.

This reversal has a very concrete practical consequence:

• It's your responsibility to inform your visitors of the tracking in place, in your privacy policy or cookie banner.
• It's our responsibility to process only what's necessary, and to prove it field by field — that's the table above.
• A data processing agreement is available on request, with no minimum tier, and what the end client sees in their report is never a list of people: it's totals by campaign.

This is not legal advice and this page doesn't substitute for it — it's a description of what the tool does. What your agency needs to write to its visitors is for you to write in your own words.

Where data lives

The point to understand about Cloudflare, because it's the only link outside the EU: it processes each request at the point of presence closest to the visitor, which can be outside the EU. What is transmitted to it is limited to what a standard HTTP request contains. The link directory — destination and status — is replicated globally with Cloudflare, and it contains no personal data: no address, no IP. Personal data stays on the German server, whose status is public.

What changes when your own code identifies someone

Up to this point, nobody is identifiable. That changes at one precise moment, and it needs to be said clearly.

When a visitor becomes a lead or a customer, your code calls lead(email) or identify(userId) — two documented calls, for you to decide whether to use. That data is associated with the click identifier and stored in your workspace. At that point, there is personal data — and it falls under your responsibility as data controller, not ours.

That's the honest limit of the exercise, and it's easy to miss in a brochure: a tool that swears never to touch personal data while offering to connect a sale to an email address isn't telling the truth. The right formulation is this: the tool collects no identity on its own; it stores one if, and only if, your application sends it.

The five questions a data protection officer asks

Can a visitor be identified? Not by us. No IP, no fingerprint, no full referrer path: raw clicks carry no identity. An identity only appears if your own application calls lead() or identify().

Do we need a checkbox in our cookie banner? The link deposits no third-party cookies. The optional tracking script writes to the local storage of your client's domain: first-party storage, to be mentioned in their privacy policy. That's a publisher's responsibility, and the policy states it plainly. The comparison with a standard analytics tool details the difference.

How long does data live? Raw events: thirteen months. Statistical aggregates: no limit, because they no longer contain personal data.

What if we leave? Data exports to CSV, the workspace is deleted on request, and deletion is permanent — not a "disabled account" that keeps everything.

What rights, and with whom? Access, rectification, erasure, restriction, objection, portability — at contact@subtraq.co, with a response within one month. And recourse before your country's supervisory authority.

Why this design measures better, not less

The paragraph nobody expects in a GDPR article. Giving up surveillance isn't a sacrifice of measurement — it's a method shift that wins on two points.

A link can't be blocked. Advertising pixels are blocked by browsers, extensions, and operating systems — increasingly so. A redirect can't be: it is the path the visitor takes. The measurement doesn't degrade as privacy advances.

You measure what you sell. A pixel gives you sessions and estimated conversions. A link connected to payment gives you a collected amount tied to a named placement. The first feeds an activity report; the second decides where next month's budget goes.

The trade-off is real and worth owning: this method doesn't follow anyone from site to site. It will never tell you what your prospect looked at elsewhere. That's exactly what we're asking of it.

The full field-by-field detail, subprocessors, and a paragraph ready to copy for a compliance questionnaire are on the security and GDPR page. And to find out which of your links actually sold, the attribution article explains the method.