Most SaaS dashboards still treat Google Analytics 4 as the default. That choice has legal side effects: a first-party _ga cookie, a consent banner on every European landing page, and a privacy policy that has to explain Google LLC as a processor. If you sell to EU companies, procurement will ask. If you sell to Australian companies, so will theirs.
Privacy-first analytics is not a slogan. For SiteLine it means a specific tracking model: no first-party analytics cookie, collect requests that omit credentials, a visitor identifier that is a daily hash of a truncated IP and user agent, and a hostname allowlist so a public site id cannot be flooded from an unrelated domain. It does not mean “no data leaves the browser,” “GDPR compliant,” or “hosted only in the EU.” Events still go to SiteLine servers operated by Aglet Technologies.
This is a description of how the product works, not legal advice. Your counsel owns the legal basis for your site. The binding policy for SiteLine accounts is at /privacy. The product model is summarised on /docs/privacy.
What “privacy-first” actually changes in a SaaS stack
A typical SaaS marketing site plus app loads three classes of measurement:
- Marketing analytics (Google Analytics 4, ads pixels, session replay). These almost always set cookies or fingerprint in a way that European ePrivacy rules treat as requiring consent.
- Product analytics (Mixpanel, Amplitude, PostHog with identified users). These are usually tied to an account id after sign-in. That is a different problem: you have a contract with the user.
- Anonymous on-site analytics for the marketing site and unauthenticated docs: pageviews, referrers, UTM campaigns, funnel steps before signup.
SiteLine is built for (3), plus Google Search Console history so SEO and on-site behaviour sit in one product. It is not a replacement for identified product analytics inside a logged-in app, and it is not a session-replay vendor.
The tracker you install on your domain does not set an analytics cookie. Collect uses fetch with credentials: 'omit', so the visitor’s SiteLine session cookie — which only exists if they are logged into siteline.tools — is not sent with the beacon. Unique visitors are derived on the server: IPv4 truncated to /24, IPv6 truncated to /48, then hashed with the user agent and a daily rotating salt customers cannot see. The hash resets each UTC day. The raw IP is not stored on the event.
That is cookieless tracking, not “anonymous.” A truncated IP plus user agent plus a same-day salt is still a processing activity under the EU General Data Protection Regulation (GDPR). It is designed so you are not dropping an analytics cookie that the ePrivacy Directive treats as requiring prior consent.
What still goes to SiteLine
Honesty is the whole product. When a pageview fires:
- The browser posts URL, path, hostname, referrer, event name, optional properties you send, and UTM parameters.
- Coarse device, browser, and OS hints are derived from the user agent on ingest.
- Country is stored when request geography is available.
- The request hits SiteLine’s collect endpoint, unless you proxy it first-party — in which case it still lands on SiteLine servers, just via your reverse proxy. There is no managed CNAME in v1.
Bots are filtered before they count toward quota. Hostnames not on the allowlist are rejected.
Aglet Technologies is the controller of SiteLine account data. Subprocessors include Stripe (billing) and Cloudflare (transactional email, and often DNS/TLS in front of the app). Hosting can move; SiteLine is not sold as an EU-only region product. If a customer’s transfer assessment needs the current compute location, they email [email protected]. See EU analytics after Schrems.
What to put in the SaaS privacy notice
Do not paste “we use privacy-first analytics so we don’t need a policy.” You still need to name the tool.
A notice that matches the product looks like this, in your own words:
- SiteLine (Aglet Technologies) records pageviews and events without setting an analytics cookie.
- Visitor identifiers are daily hashes of truncated IP and user agent; we do not get a cross-day cookie id.
- Events are sent to SiteLine’s servers. Stripe and Cloudflare process some account and delivery data.
- You can point readers at SiteLine’s /privacy for the vendor’s own processing, and keep your legal basis, retention story, and other trackers (Intercom, Stripe Checkout, ads) in your policy.
If you also run Google Analytics 4, HubSpot, or Meta Pixel, those still need their own disclosures and, in the EEA/UK, typically a consent banner. Consent-free analytics means this tracker’s cookie model, not a licence to skip consent for everything else on the page.
Pricing and retention, because procurement will ask
Plans are $4.99 / $19.99 / $99.99 USD per month (Starter, Growth, Scale) with a 7-day trial. Analytics events and rollups are kept while the subscription (or complimentary access) is active, then 30 days of grace, then purge. Imported Search Console data is kept while the account exists — that is how SiteLine outlives Google’s 16-month window. Account deletion removes analytics sites, events, and GSC imports and revokes Google access.
App cookies on siteline.tools are session, CSRF, and theme/sidebar preference only. That is the app, not your marketing site.
FAQ
Does privacy-first SiteLine analytics mean we can skip a DPA?
No. You still process visitor data through a vendor. SiteLine publishes how that processing works at /privacy and /docs/privacy. Whether you need a data processing agreement, and which clauses, is a question for your counsel — not a badge on a pricing page.
Will this replace Mixpanel for logged-in product usage?
Not as a like-for-like. SiteLine’s visitor hash resets daily and is not an account id. After signup you already know the user; identified product analytics is a different layer. Use SiteLine for the public site, docs, and pre-signup funnels.
Do we still need a cookie banner on the marketing site?
Not for this tracker’s analytics cookie, because there isn’t one. You may still need a banner for other cookies and similar technologies you set. Read Do I need a cookie banner for analytics? and GDPR analytics without a consent banner.