Privacy model

The Oriflux measurement script sets no cookies or persistent anonymous browser identifiers. This alone does not automatically exempt a deployment from consent requirements: the operator must assess purpose, configuration and applicable rules. See the CNIL audience measurement conditions.

• IP addresses are used for geography and a daily project-specific hash, then excluded from stored events. Infrastructure and proxy logs may still contain IP addresses; configure their retention separately.
• Daily salt expires. Multi-day totals represent visit-days, not unique people. Anonymous identity is not persisted across days.
• identify() accepts pseudonymous identifiers and rejects common email/phone forms. Pseudonymous identifiers may still be personal data; validation cannot detect all PII. Never include PII in URLs, event names or properties.
• Multi-day funnels and retention require identified users. Anonymous funnels remain session/day scoped. DNT and GPC are honored.
• The authenticated dashboard uses an HttpOnly/SameSite Strict session cookie and local preferences. This is separate from visitor measurement.
• Raw data: 13 months; additive daily archives: five years. Pseudonymous accounting state used by MRR persists to retain active subscriptions; include this state in administrative purges.
• Residency depends on your hosting. Built-in AI uses SPT Models on aggregates. MCP sends results to the selected agent client and model provider; their residency, retention and confidentiality policies apply.