Privacy Kit
The data flow, retention periods, and an adaptable privacy notice for your website.
Working template, not legal advice. The appropriate legal basis and any consent requirement under Germany's Telecommunications Digital Services Data Protection Act (TDDDG) depend on your use. Have the completed notice legally reviewed before publishing.
Roles and agreements
You are the controller
You decide the purpose, legal basis, and integration on your website, and inform your visitors.
Windrose is the processor
Windrose processes analytics data under your instructions. A Data Processing Agreement (DPA) under Article 28 GDPR is required before production use.
DPA before production use
A separately signed DPA is required before production use. During the private beta, request the current draft by email.
Subprocessors
Hetzner Online GmbH, Germany, for hosting and the database. DB-IP runs locally and does not receive visitor data.
Data flow
| Stored | Timestamp, domain, page path, referrer domain, UTM values, event name, optional numeric event value and currency code, country, device class, browser class, daily rotating pseudonymous visitor identifier, and AI crawler classification. |
|---|---|
| Not in the analytics dataset | Raw visitor IP addresses, full referrer URLs, other URL query parameters, raw user-agent strings, cookies, or cross-device profiles. |
| IP processing | The IP address is used transiently for country lookup and daily visitor identification, then discarded. |
| Retention | Analytics events: 13 months. MCP usage telemetry: 90 days. Account and contract data: until deletion or according to statutory retention periods. |
| Hosting | Hetzner Online GmbH, Germany. |
Create your privacy notice
Fill in your details, review the legal basis, and copy the text into your website's privacy policy.
Changes only the generated notice. Your details and legal-basis selection are kept.
Before going live
- Sign a DPA with Windrose.
- Review the legal basis under the GDPR and any consent requirement under the TDDDG.
- Do not put names, email addresses, identifiers, or sensitive data in URL paths, UTM values, event names, or event values.
- Make the privacy notice accessible before loading the tracker.
- Provide an objection or consent-withdrawal process appropriate to the selected legal basis.