GDPR and CCPA

No cookie, no consent wall

The tracker sets no cookies and stores no identifier in localStorage. The IP is not retained. Unique visitors are a daily hash. That is the same class of processing cookieless analytics tools have used to avoid a cookie banner — plus an actor field.

Roles

• Self-host — you are the controller. Vector 5 is software you run.
• Hosted — you are the controller of your site's analytics; Vector 5 processes it on your instructions. A DPA will ship with hosted accounts.

Access requests

Because there is no persistent identity, there is no row to retrieve for "all data about Jane." You can export aggregates and confirm the manifest. You cannot reconstruct a person from a visitor hash after the salt rotates.

Do not put emails or user ids in event props. If you do, you have created personal data Vector 5 did not design for.