# Privacy & GDPR (/docs/privacy)

numbers runs for you as a processor: you decide which sites send to it, and the events belong to your Organization.

## What a visitor's event holds [#what-a-visitors-event-holds]

- A random visitor id from the first-party `obelism_visitor_id` cookie (30 days from the last visit), and whether they are new or recurring.
- The event's name, scope and, when you send them, value, currency and parameters.
- The page's path and the referrer, both **without query strings**, and the UTM tags.
- Device categories (device, browser, operating system, screen size, pointer), not the user agent.
- The country, from the request's network location.

## What it leaves out [#what-it-leaves-out]

- **IP addresses** are not stored with the events. One is used to rate limit, per minute. Like every request to a Cloudflare Worker, the request passes through Cloudflare and is kept in numbers' request logs (Workers Logs).
- **Query strings and fragments** never leave the browser: emails or tokens in a URL stay out.
- No fingerprinting, and no data shared with third parties or used for advertising.

## The cookie [#the-cookie]

`obelism_visitor_id` is a first-party cookie on your own domain, shared with Improve's SDK. During the rename the old `visitorId` cookie is still read and written, so there are two cookies for now: declare both in your cookie notice (or consent tool) until the old one is dropped, or a declaration that names only `visitorId` becomes incomplete. Whether it needs consent depends on your jurisdiction and use: in the EU, analytics cookies generally do. Load the script or create the SDK client after consent if your policy requires it.

A site that would rather not ask can count without a cookie. `data-storage="none"` (or `storage: 'none'`) stores nothing: a new id is made on every client. `data-storage="session"` keeps the id in sessionStorage for the tab — no cookie, but it is still storage on the visitor's device, which ePrivacy generally treats like a cookie; check whether your jurisdiction does before you rely on it as consent-free. Either way, unique visitors and sessions are less exact: `none` starts a new visitor (and a new session) on every load, so most page views count as bounces.

## Retention [#retention]

Events stay while your Organization exists. Deleting an Organization on www deletes its events 30 days later; from the deletion on, no new events are taken in.

An erasure request is per visitor: on the Events page, an admin or developer enters the visitor id from their cookie and deletes everything tied to it — every event and test exposure in the Space, in every environment and for all time, whatever range the dashboard shows. A deletion larger than one batch takes a few submits; the page says how many went and that more remain. Deleting a range instead removes only the selected environment's events in that range.

## Sub-processors & data residency [#sub-processors--data-residency]

| Service                | Used for                                                         | Where                                                            |
| ---------------------- | ---------------------------------------------------------------- | ---------------------------------------------------------------- |
| **Cloudflare Workers** | Takes events in and runs the dashboard; request logs             | Cloudflare's global network, at the location nearest the request |
| **Cloudflare Queues**  | Holds events for seconds between taking them in and storing them | Cloudflare's global network                                      |
| **PlanetScale**        | The PostgreSQL database the events are stored in                 | **Frankfurt, Germany (AWS `eu-central-1`)**                      |

numbers shares its database with Improve, Content and www.obelism.studio. For a signed DPA, contact us at [hello@obelism.studio](mailto:hello@obelism.studio).