Privacy Policy | Overtracking

If you are reading this policy, it is because you care about your privacy and how we use your data on this website and in the tool we offer.

OVERTRACKING applies security, minimisation and pseudonymisation measures to protect the data it processes.

Applicable data protection legislation includes:

EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR)

Organic Law 3/2018 of December 5, on the Protection of Personal Data and guarantee of digital rights

This policy explains how your data is processed. Reading or accepting it does not by itself constitute consent to all processing. The lawful basis depends on each purpose: performance of a contract, legal obligations, legitimate interests where applicable or specific consent where required.

Who is the data controller?

Owner: Julio Rodríguez Cruz

Trade name: OVERTRACKING

NIF/DNI: 53194665N

Full address: Avenida Gregorio Espino, 36205 Vigo, Pontevedra.

Contact form: Contact form

Notice before purchasing our licenses

Before purchasing the software licenses offered on this platform, you must give your consent to the service contract, which includes clauses on the processing and confidentiality of your personal data.

Data collected on this website

The personal data collected and processed on this website is provided directly by users. Specifically, data is collected and processed through:

Registration form: https://app.overtracking.com/register
Google sign-in
Contact form: https://overtracking.com/contact

Legal basis for processing your data

To contact us through the contact form, you must consent to this privacy policy.

The legal basis for processing the data of people who make purchases on the OVERTRACKING website or purchase any licenses offered by Julio Rodríguez Cruz (OVERTRACKING) is the execution of the contract.

Privacy of the OVERTRACKING tool

You can configure measurement and request the exercise of your rights through the contact form. Closing an account does not by itself immediately erase all historical data and backups.

Our web analytics tool complies with the following requirements:

The visitor fingerprint is a hash derived from the IP address, website, browser and language and encoding headers, together with a secret key that changes every week. It is specific to each website and changes every week, so the same visitor cannot be recognised from one week to the next. It is a pseudonymous identifier, not a guarantee of anonymity.

The IP address is used for geolocation, exclusions and fingerprinting. It is included in plain text in processing queues and may remain in dead-letter queues. It is not included as a column in visit statistics. This does not mean that the IP address is never processed or temporarily stored.

The absence of cookies does not by itself establish GDPR compliance or exemption from consent. Each customer must determine the lawful basis, inform visitors and obtain consent where required by the enabled features and applicable law.

Cookieless analytics: the OVERTRACKING pixel does not set cookies on visitors’ devices.

Exclusive use of data: Data collected through OVERTRACKING is used exclusively to generate reports and analyses related to the website's performance and usability. We do not share or use data for any other purpose, unlike tools like Google Analytics that may use data for advertising purposes.

You can configure measurement and request the exercise of your rights through the contact form. Closing an account does not by itself immediately erase all historical data and backups.

Visitor log and profile deactivation: We provide the ability to deactivate visitor logging and user profiling in our web analytics tool. Users can opt out of having their behavior tracked and analyzed.

EU storage: Data collected is stored exclusively on servers located within the European Union, complying with EU data protection standards.

Data deletion: When a user requests data deletion, we can effectively and permanently delete visitor data stored in our web analytics tool.

Data collected by the OVERTRACKING tool

The web analytics tool collects the following data:

Country: The tool records the country of origin of website visitors, providing information about users' geographic location.

Browser: Information about the browser used by visitors (e.g., Chrome, Firefox, Safari, etc.) is collected, helping users understand which browsers are most popular among visitors and ensure website compatibility.

Screen resolution: The tool records visitors' screen resolution, helping to understand common screen sizes and formats among users and optimize website display across devices.

Referrer and visited URLs: The referrer URL, i.e., the site from which the visitor arrived, is recorded. Additionally, visited URLs within the website are tracked, helping users understand navigation paths.

Operating system: Information about the operating system used by visitors (Windows, macOS, iOS, Android, etc.) is collected, helping adapt the user experience accordingly.

Device: The tool identifies the type of device used by visitors (mobile, tablet, or PC), helping optimize design and functionality.

Browser language: The language set in the visitor's browser is recorded, allowing for a personalized user experience based on preferred language.

Page interaction: for each page view, the active time, the maximum scroll depth, the total distance travelled by the mouse (a single number, without the path or coordinates) and, on mobile, taps and swipe distance. Sessions are not recorded and nothing typed into forms is collected.

Heatmap: records the position of clicks on the pages the customer configures, together with a capture of the page, to show the areas of most interest in aggregate.

Errors, links and downloads: JavaScript errors (message, file, line and stack trace), clicks on links to other websites and file downloads. Visits from automated browsers are discarded.

Personal data categories required by this website

To contact us: name, email address and the message.

To purchase software licenses: Full name, address, email, payment transaction information (payment instrument used, transaction date and time, payment amount, expiration date of payment instrument, billing postal code, information, address, and other payment-related details).

Purpose of processing your personal data

Submitting personal data on this website is mandatory to contact us, subscribe to the website, or request any services offered by OVERTRACKING.

The required data is adequate and relevant for its communicated purpose.

Specifically, data collected through OVERTRACKING will be processed for the following purposes:

Process orders, requests, or any type of inquiry made by you as a user through available contact channels.
Send newsletters to users who wish to receive notifications, news, or promotions related to their subscription.
Analyze user behavior: our web analytics tool may collect and analyze data to understand visitor behavior on a website.
Optimize marketing campaigns: Web analytics allows tracking and measuring online marketing campaign performance.
Track conversions and goals: Analytics enables tracking conversions and set goals on a website.
Archive purchase history and management performed on the website.
Verify and update user registration.
Send messages, updates, and relevant notifications related to your user account.
Perform support and user assistance activities.
Maintain the contractual relationship established with the client.
Conduct fraud prevention, security incident analysis, and abuse detection.
Occasionally, image data from recordings may be used.
Send commercial communications via email, SMS, WhatsApp, social communities, or any electronic or physical means.

Promote OVERTRACKING's services. For example, if you leave your personal information in a contact form, OVERTRACKING may use that data to send you information about its website or software.

Provide information to OVERTRACKING partners who provide strictly necessary services for the development of OVERTRACKING's services.

What are your rights when you provide your data?

To help you ensure the protection and privacy of your personal data, the GDPR grants you several rights, allowing you to make specific requests and ensuring that your personal data provided on this website is not misused.

Access your personal data: You have the right to know whether your personal data is used on this website and how it is used.

Verify your personal data: You have the right to ensure that accurate and up-to-date information about you is used.

Delete your personal data: You have the right to request the deletion of data that is no longer needed for a specific purpose.

Limit the use of your personal data: You can ask us to limit the processing of your data to certain purposes.

Port your data to another company: You can request that we send the data you provided on this website to another company.

Withdraw your consent: When data processing is based on your consent, you have the right to withdraw it at any time.

File a complaint with local data protection authorities: If you are not satisfied with how your data is processed, you have the right to file a complaint.

How can you exercise your rights?

We are committed to making it easy for you to exercise your rights. Once we receive your request, we will ensure that we provide you with the corresponding form and all necessary information to complete it properly.

You can request the form to exercise your rights through our contact form, or use the templates provided by the Spanish Data Protection Agency.

Where to write to exercise your rights: Contact form

How long will we keep your data?

Personal data will be kept as long as you remain linked as a user or customer of the website and until the termination of the User Contract, for whatever reason.

Data will be kept as long as there are legal obligations for retention or until the user requests its deletion or withdraws previously given consent.

When data processing is based on user consent, such data will be kept until the right to withdraw consent is exercised.

Once you disconnect, personal data processed for each purpose will be kept for the periods established by law, including the period during which a judge or court may require them in relation to the limitation period for legal actions.

All information and communications related to the services provided will be kept while the commercial relationship lasts, to handle possible claims.

Who will your data be shared with?

Your data will not be transferred to third parties, except when legally required. Specifically, data will be communicated to the Spanish Tax Agency and banks or financial institutions to make payments, as well as to data processors necessary to execute the contract.

Additionally, data may be shared with service providers such as hosting services, IT system providers, and services for digital marketing automation and analytics.

It is important to mention that the company in charge of the development and maintenance of this website may also have access to the data. These companies have a signed service contract that requires them to maintain the same level of privacy and security that we apply to our data processing.

Panel and analytics hosting: Hetzner (Germany and Finland). Visit reception and processing: CubePath (Spain).

Account emails: MailShogun. Payments: Stripe Payments Europe. Google sign-in: Google. Anti-bot protection: Cloudflare. Heatmap snapshots: IDrive e2 (Frankfurt, Germany), with a temporary migration backup in Cloudflare R2 until deletion.

Analytics tools: Overtracking

Security of stored data

Data security is a priority at OVERTRACKING. The following security measures are implemented:

Analytics data is hosted in the European Union. Subprocessors and international transfer safeguards are detailed in the documents linked below.

Backups protect data availability and integrity.

These measures help protect data stored in the tool from threats and ensure confidentiality, integrity, and availability.

Security notifications and breach declarations

Julio Rodríguez Cruz (OVERTRACKING) takes reasonable and appropriate measures to protect personal information against loss, misuse, and unauthorized access, disclosure, alteration, or destruction. If OVERTRACKING determines that your data has been misused, exposed by a security breach, or improperly acquired by a third party, OVERTRACKING will immediately inform you.

Data accuracy

As a user, it is your responsibility to ensure the accuracy and correctness of the data you submit to OVERTRACKING. By doing so, you release OVERTRACKING from any responsibility regarding the accuracy and truthfulness of such data.

You must guarantee and always be responsible for the accuracy, currency, and authenticity of the personal data you provide, agreeing to keep it properly updated. By using the contact form, you agree to provide complete and accurate information.

Any consequence resulting from providing false, inaccurate, or outdated information is the sole responsibility of the user.

Applicable law and jurisdiction

The relationship between Julio Rodríguez Cruz (OVERTRACKING) and the User will be governed by current Spanish regulations, and any disputes will be submitted to the appropriate courts.

Changes to the privacy policy

OVERTRACKING reserves the right to modify this policy to adapt it to new legislation or case law, as well as industry practices. In such cases, Julio Rodríguez Cruz (OVERTRACKING) will announce the changes on this page sufficiently in advance.

Data processing and subprocessors

When OVERTRACKING processes visitor data on behalf of a customer, the data processing agreement applies. See also the list of subprocessors, their purposes and international transfer safeguards.

Measurement data minimisation

The pixel removes credentials, fragments and URL parameters except permitted UTM tags, and detects email addresses and common identifiers. Custom event values are limited to numbers. Heatmap snapshots mask text and remove links and non-permitted attributes; elements marked data-private, data-ovt-private or with the ovt-private class are blocked. These measures reduce risk but do not detect all personal data: avoid measuring private areas or sending sensitive content. They apply to new submissions and do not automatically erase previously stored data.