Privacy Policy

Uplink Analytics is a privacy-focused website analytics service operated by Uplink Sites (“we”, “us”, “our”). Our registered contact address and data protection enquiries email is privacy@uplinksites.net.

This policy describes what personal data we process, why, and what rights you have. It applies to the Uplink Analytics service accessible at analytics.uplinksites.net, the marketing pages at uplinksites.net/analytics, and our tracking script embedded on customer websites.

Uplink Analytics operates in two distinct data-protection roles, and it is important to understand which applies to you:

• Controller — when you create an Uplink Analytics account with us, we decide how your account data (email, password hash, billing details, usage) is used. You are our customer and we are the controller of that data.
• Processor — when you are a visitor to a website that has installed our tracking script, the website operator (our customer) decides what data is collected and why. We process that data on their instructions only. Questions about that data should be directed to the operator of the site you visited, not to us.

If you manage a sports club website through our ClubKit platform, Uplink Analytics automatically collects the same anonymous, cookieless visitor metrics described in section 4 below — on your behalf, for your club's website.

In this context, your club is the data controller of your website visitors' (aggregate, anonymous) analytics data, and Uplink Sites is the processor. No personal data about your visitors is collected. No cookies are placed on visitors' browsers. Because the data is genuinely anonymous, no cookie consent banner is required solely for this tracking.

Elite plan ClubKit customers can view their analytics data in the Analytics tab of their admin dashboard. All ClubKit operators are automatically enrolled in this tracking to keep the platform running smoothly.

When you sign up for Uplink Analytics we collect and process:

• Account data: email address, username, password hash, account creation date.
• Billing data (paid tiers only): name, billing address, and a Stripe customer ID. We do not see or store card numbers — Stripe handles payment data directly.
• Service usage: which dashboards you access, websites you add, and API keys you generate, so the service functions.
• Communications: support emails you send us, kept for as long as needed to resolve the matter plus a reasonable record.

Our tracking script runs on our customers' websites. For each pageview we process the following, in aggregate and without persistent identifiers:

• Page URL and page title
• Referrer (where the visitor came from, if available)
• Browser and operating system, derived from the User-Agent header
• Device type (desktop, tablet, mobile)
• Country and region, derived from the IP address — the IP itself is discarded
• Event name and anonymous event data (for custom events explicitly configured by the customer)

We do not collect or store:

• Cookies or any other device-storage identifiers
• IP addresses (used transiently to derive country, then discarded)
• Persistent cross-site identifiers or visitor fingerprints
• Personal information such as names, email addresses, or account identifiers — our terms prohibit customers from sending us such data

We are an Australian company. Personal information we collect, hold, use, and disclose is handled in accordance with the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles (APPs). Where we serve customers and visitors in the UK or EEA, the additional requirements of the UK GDPR and EU GDPR also apply. Our lawful bases under Article 6 of the UK/EU GDPR (relevant to UK and EU data subjects) are:

• Contract (Art. 6(1)(b)): processing your account and billing data to provide the service you have subscribed to.
• Legitimate interests (Art. 6(1)(f)): limited aggregate visitor analytics on behalf of our customers, product security and abuse prevention, and our own service-usage data. Our interests are balanced against your rights — you can object at any time.
• Legal obligation (Art. 6(1)(c)): retaining invoices and tax records for the period required by applicable law.
• Consent (Art. 6(1)(a)): optional marketing emails only, which you can withdraw at any time by clicking the unsubscribe link in any such email.

For Australian data subjects we collect personal information by lawful and fair means, primarily through your direct interactions with the Service (account creation, billing, support correspondence). We use it only for the purposes for which it was collected and related secondary purposes you would reasonably expect.

• Account data: for as long as your account is active, plus up to 90 days after closure for backup rotation.
• Billing and tax records: at least five years from the end of the relevant financial year, as required by the Australian Taxation Office, and longer where required by UK or EU tax law for transactions in those jurisdictions.
• Aggregate visitor analytics: retained indefinitely in aggregate, pruned per customer tier (see your plan for the applicable raw-event retention window).
• Support correspondence: up to 24 months after your last interaction.
• Marketing site server logs: up to 30 days, used for security and debugging only.

We use a small number of carefully chosen third parties to run the service. We have a written data-processing agreement with each of them and will give 30 days' prior notice of any change.

• OVHcloud (hosting infrastructure, servers located in Singapore)
• Google (Google Drive — storage for nightly server backups)
• Stripe (payment processing — paid tiers only)
• Cloudflare (authoritative DNS only — we do not proxy customer traffic through Cloudflare)
• Amazon SES (transactional email: account verification, billing, password resets)

To request a current sub-processor list or object to a proposed change, write to privacy@uplinksites.net.

Our primary servers are located in Singapore, and nightly backups are stored in Google Drive. For Australian customers and visitors this is a disclosure of personal information outside Australia. For UK and EU customers and visitors, this is a cross-border transfer outside the UK and EEA — where this happens we rely on the UK International Data Transfer Addendum and/or EU Standard Contractual Clauses as the transfer mechanism, supplemented by our technical and organisational security measures. We take reasonable steps consistent with Australian Privacy Principle 8 before disclosing personal information to overseas recipients.

Australian residents — under the Privacy Act 1988 (Cth) and the Australian Privacy Principles you have the right to:

• request access to the personal information we hold about you (APP 12)
• request correction of inaccurate, out-of-date, or incomplete information (APP 13)
• opt out of direct marketing
• complain to us about how we have handled your personal information; if you are not satisfied with our response you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC)

UK and EU residents — under the UK GDPR / EU GDPR you additionally have the right to:

• have your data erased in certain circumstances
• restrict or object to processing
• receive your data in a portable format
• withdraw consent where consent is the lawful basis
• lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or your local supervisory authority in the EU

To exercise any of these rights, email privacy@uplinksites.net. We will respond within a reasonable time, and in any case within thirty days for Australian requests and within one month for UK/EU requests.

If you are a California resident, the California Consumer Privacy Act (CCPA/CPRA) gives you the right to know what personal information we collect, the right to delete it, the right to correct it, the right to opt out of sale or sharing, the right to limit use of sensitive personal information, and the right not to be discriminated against for exercising these rights.

We do not sell or share personal information as those terms are defined by the CCPA/CPRA. We do not use visitor data for cross-context behavioural advertising.

To exercise your California rights, email privacy@uplinksites.net with “California Privacy Request” in the subject line.

Data is transmitted over TLS 1.2+ and stored encrypted at rest. Access to production systems is limited to a small number of authorised staff, protected by SSH keys and multi-factor authentication. We take daily backups and run regular patching and security review. No system is perfectly secure, but these measures reflect current good practice for a service of our scale.

The marketing pages at uplinksites.net/analytics use a small number of strictly-necessary cookies (session, CSRF) and no advertising or third-party tracking cookies. Uplink Analytics itself, when embedded on customer sites, sets no cookies at all.

Uplink Analytics is not directed at children under 16. We do not knowingly create accounts for minors. If you believe a child has provided us with personal data, contact us and we will delete it.

We will update this policy from time to time. The “last updated” date at the top reflects the most recent change. Material changes will be communicated to account holders by email at least 30 days before taking effect. Your continued use of the service after the effective date constitutes acceptance of the updated policy.

Email privacy@uplinksites.net for any privacy-related questions, requests, or complaints.