Privacy Policy

Effective date: 15 October 2026

1. Who we are and our role

nTrackr is a web analytics and fraud detection service operated by Engin Özdal in Istanbul, Türkiye. For visitor data collected on our customers' websites we act as a processor under the GDPR and KVKK; for customer account data we are the controller. Our customers are responsible for informing their visitors and for having a legal basis (including consent where required) for the tracking.

2. Data the tracking script collects (visitors)

• Browser and device characteristics (browser, OS, screen, language, time zone, graphics/audio properties) and a fingerprint value derived from them
• IP address and the approximate location, ISP and network type derived from it. If the customer enables IP anonymization, IPs are stored shortened.
• Pages visited, referrer, ad click parameters (e.g. gclid, utm), session duration
• Clicks, mouse movement and scroll depth; session recordings if the customer enables them. Typed text is masked by default; password and payment fields are never recorded.
• Form interactions: which field was used, when, and how long filling took. Field values are not collected.
• Custom events and user information sent by the customer (identify: user ID, email, name, extra fields)

This data is processed to provide the customer with visitor analytics and fraud/bot detection. It is not sold, not used for advertising and not shared between customers. In "minimal tracking" mode detailed device data, recordings, heatmaps and form analytics are not collected; on sites using consent mode nothing is collected until the visitor consents.

3. Customer account data

Name, email address, a hash of your password, subscription and payment transaction records. Card details never reach our systems; payments are processed by the nPay payment platform.

4. Service providers

• Our server hosting provider (infrastructure where data is stored)
• Cloudflare (network, security and traffic routing)
• nPay (payment processing)
• The MaxMind GeoLite2 database runs on our own servers; IP addresses are not sent to MaxMind.

5. Retention and deletion

Visitor data is kept while the customer's account and the related domain are active. When a customer deletes a domain, all visitors, sessions, recordings and events of that domain are deleted. To delete an account entirely, contact us.

6. Your rights

Under the GDPR and KVKK you may request access to, correction or deletion of your data, and object to or restrict its processing. If you visited a website that uses nTrackr, please contact that website first; we will work with our customer to help.

7. Security

Data is transmitted over encrypted connections (HTTPS); customers' data is separated by authorization checks and access is limited to the account owner.

8. Contact and changes

Questions: [email protected]. When we update this policy we change the effective date.