What to write in your privacy notice

Insights Orbit keeps no personal data about anonymous visitors, but the law still asks you to tell visitors that you count visits, whether or not you ask for consent. Add a short section to your website's privacy notice before the script goes live. This is guidance, not legal advice: check the final text with your own adviser.

Who is responsible

For your website, your organisation is the controller: it decides to count visits and what for. Bifröst Orbit is your processor, under the data processing agreement that comes with your organisation's terms. The providers Insights Orbit uses are listed on the sub-processors page.

What to cover

• That you count visits, and with what: Insights Orbit, provided by Bifröst Orbit.
• What the script reads and sends: the page address, the page that linked to it, the window's width and the browser's language. It also checks Do Not Track, Global Privacy Control and the visitor's own opt-out.
• What the server does with the IP address and browser description: uses them for a moment to find the country, region and device, and to recognise a visitor for one day with a secret that changes every night, then discards them.
• What is kept: pages without their query, the referring website, campaign tags, country, region, device, browser, system, screen-size group and main language, and the events your website sends. Nothing that links to a person or from one day to the next.
• Why, and on what basis: to learn which pages help people. Many organisations rely on their legitimate interest, because nothing identifies the visitor. Your adviser decides.
• How long: as long as your plan keeps data: 13 months on Starter, 3 years on Growth, up to 5 years on Enterprise.
• That nothing is stored in the browser, except the visitor's own choice not to be counted, and only when they make it.
• How to opt out: a link to your opt-out page, and that Do Not Track and Global Privacy Control are honoured.

If you use known users, say so separately: you send your own user id for signed-in people, so their visits are linked across days and devices. That is personal data, with its own legal basis.

An example

Adapt this to your website and plan. Northwilds would write:

Visit statistics: We count visits to northwilds.com with Insights Orbit, provided by Bifröst Orbit on our behalf. When you open a page, a small script sends its address, the page that linked to it, your window width and your browser's language. Insights Orbit uses your IP address and browser description for a moment to find your country, region and device, and to recognise repeat visits on the same day with a secret that changes every night. It then discards them and keeps only statistics that cannot be linked to you or to your visits on other days, for 13 months. No cookies are used, and nothing is stored in your browser unless you ask not to be counted. We do this in our legitimate interest in understanding which pages help our guests plan their trips (Art. 6(1)(f) GDPR). Browsers with Do Not Track or Global Privacy Control switched on are never counted, and you can stop being counted at any time on our opt-out page.

Add the opt-out link

1. Open the site, then Site settings.
2. Under Let visitors opt out, copy the opt-out page's address, such as https://api.bifrostorbit.com/insights/v1/opt-out?site=SITE_KEY, and use it as the link in your notice.
3. Or copy the buttons and paste them into your privacy page, so visitors can choose there.

The opt-out page explains what is counted in plain words and sends the visitor back to your website to confirm. The choice is kept in their browser for your website only.

A cookie notice

If your website has a cookie notice, list the one entry Insights Orbit can leave: insights:off in local storage, which remembers that the visitor asked not to be counted, or that a browser is your team's. It is set only when someone asks for it, and stays until they ask to be counted again or clear the website's data.

Do you need consent?

Insights Orbit is built to count without a consent banner, and many websites in Europe count this way. The law isn't settled everywhere: German regulators, for example, see visit counting as generally not strictly necessary, while France's CNIL lets audience measurement like this run without consent under conditions, one of them keeping data for at most 25 months. How visits are counted without cookies sets out the facts your adviser needs.

If you decide to ask for consent, your developers add data-consent="wait" to the script, and it reads and sends nothing until your consent banner says the visitor agreed. See The script.