1. What this version changes
This version replaces the optional-analytics statements in the 15 October 2026 Umami privacy notice. The rest of our privacy information continues to apply. This update explains an optional analytics choice that can link selected activity from a signed-in account across visits and devices. It does not change the separate first-party browser/device security signal used for authentication and related MFA flows.
You can read the prior notice at Privacy Policy version 2026-10-15-umami.
Controller and Processor Roles. Emvadon remains the controller for accounts, authentication, and payments, as well as billing, security, support and consented product-analytics data. Where an organisation provides Customer Content containing third-party personal data, that organisation is normally the controller and Emvadon acts as processor on its documented instructions; a data processing agreement may be requested for Enterprise orders. Do not upload special-category personal data without a defined written agreement and lawful basis.
We process billing legal name, billing address, VAT/tax identification number where provided, invoice and tax records. The prior notice describes our payment processor's invoicing and tax compliance support. It also identifies operational recipients used for transactional email delivery, MaxMind login risk and geo enrichment, Cloudflare Turnstile and the first-party browser/device security signal during sign-in, organisation sign-in (SSO), and related MFA flows. It also identifies HERE mapping, Cal.com scheduling, and Instatus status communications. The security technologies support account protection and are independent of your analytics choice. Where transfers occur outside the EEA, the prior notice describes use of the EU–US Data Privacy Framework, Standard Contractual Clauses, an adequacy decision, or another lawful transfer mechanism as applicable.
2. Optional identified analytics
When production analytics is enabled, we use a self-hosted Umami instance to measure selected page views and product events. Guests are measured anonymously. For a signed-in user, we send a pseudonymous stable analytics identifier only after that person has made the separate affirmative analytics choice shown in the cookie banner or Cookie Settings. Earlier analytics choices do not authorise this identified measurement.
This identifier lets Umami link the selected activity that we send across visits and devices. It is not your name, email address, organisation identifier, raw account identifier, or our authentication security fingerprint. The identifier is derived from an internal account value using a versioned one-way hash. A hash is still an identifier for this processing; it does not make the data anonymous.
3. What we collect and do not send
Optional analytics is limited to selected page views and product events, with their timestamps and the pseudonymous stable analytics identifier for a consented signed-in user. The collector also receives standard transport metadata, including IP address and user agent, to derive its server-side session identifier using a rotating salt; its default salt rotation is monthly.
We do not send your raw account UUID, name, email address, organisation identifier, authentication or security fingerprint, raw search query, free text, exact coordinates, parcel or property identifier, full dynamic URL, URL fragment, title, or raw referrer to Umami for this purpose. We do not use analytics cookies or browser storage for this measurement.
4. Purpose, access and sharing
We use this optional measurement to understand how the Service is used and to improve it. It is based on your consent where consent is required. The account-to-analytics-identifier mapping remains within Emvadon and is available only through restricted operator tools. Umami does not receive names, email addresses, or organisation identifiers for this measurement.
Analytics records in our self-hosted Umami instance have no automatic expiry under the current configuration. You may use the contact route in section 6 to make an applicable data-protection rights request. There is no current automatic deletion schedule for analytics records.
5. Your choice
Optional analytics is not used until you choose it. You can reject it or withdraw it at any time in Cookie Settings in the site or signed-in app footer. Withdrawal stops future optional analytics collection; it does not affect the lawfulness of processing before withdrawal and does not itself promise deletion of analytics records already collected.
This preference does not affect essential cookies needed for login, security, or remembering your privacy choice. It also does not control the separate security technologies described in the prior notice.
6. Contact and rights
Applicable rights include access, rectification, erasure, restriction, Data portability, objection and Withdraw consent. For questions about this processing or to exercise applicable data-protection rights, contact . Use Cookie Settings to withdraw optional analytics consent. The prior notice's retention terms, including up to 12 months for security, login and operational logs and up to 7 years for contract, acceptance, withdrawal, invoice, tax, refund and dispute evidence, continue to apply.