Privacy Policy

Last updated: August 2026

This policy explains how Pixelized.ch Sagl ("we"), the operator of the AlpStats.ch web-analytics service (alpstats.ch), processes personal data. It is written to comply with the Swiss Federal Act on Data Protection (nFADP/nLPD) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Controller

Pixelized.ch Sagl, Via Pier Francesco Mola 9, 6900 Lugano, Switzerland — CHE-112.187.897. Contact for data-protection matters: info@pixelized.ch.

2. Who this concerns

This policy covers two distinct groups: (a) our customers, i.e. people who create an AlpStats.ch account to measure their own websites; and (b) the visitors of those customer websites, whose activity AlpStats.ch measures on the customer's behalf. For group (b), the customer is the data controller and Pixelized.ch Sagl acts as processor (see our Data Processing Agreement).

3. Account data (customers)

When you open an account we process: name, e-mail address, password (stored only as a secure hash), the sites you add (name, domain, keys), your language and notification preferences, and billing data handled through our payment provider. Purpose: to provide and secure the service, manage your subscription and send service-related e-mails. Legal basis: performance of the contract with you (and our legitimate interest in operating and securing the service). Retention: for the life of the account; billing records are kept as required by law. Payment-card data is handled by Stripe and never reaches our servers.

4. Analytics data (website visitors)

AlpStats.ch is cookieless and privacy-first. On a page view the tracking snippet sends: the page path (without query string by default), the referrer domain, screen size, and optionally the browser language. On our server we derive the country (local GeoIP database), and the device type, browser and operating system from the user-agent. We then compute an anonymous daily visitor count.

• No cookies, no local storage, no persistent identifiers, no fingerprinting.
• The IP address is never stored. It is used only in memory, for a moment, to derive the country and to compute the anonymous visitor hash, then discarded.
• Visitors are counted with a daily rotating salt that is deleted within 48 hours. The hash identifies a visitor only within the same day and the same site — never across days or across sites.
• The raw user-agent is not stored; only the classified device/browser/OS is kept.
• Bots are excluded from the statistics.

Retention: raw events are kept for 30 days and then deleted; only anonymous aggregates are kept longer. Do Not Track / GPC: because the service is already anonymous and cookieless there is no tracking to opt out of; a customer may nonetheless enable a "respect DNT/GPC" option for their site.

This website (alpstats.ch) also uses AlpStats.ch to measure its own usage statistics, in the same anonymous, cookieless way described above.

5. Cookies

The public tracking never sets cookies. The only cookie we use is a technical session cookie set when you log in to the dashboard, strictly necessary to keep you signed in. No advertising or profiling cookies are used.

6. Recipients and sub-processors

We share data only with providers strictly needed to run the service: Infomaniak (hosting and e-mail delivery, in Switzerland) and Stripe (payment processing). GeoIP look-ups use a local database (MaxMind GeoLite2): no visitor data is sent to any external party for geolocation. We never sell personal data.

7. Where your data is stored

Service data is hosted in Switzerland (Infomaniak). Some providers, such as Stripe, may process billing data abroad under appropriate safeguards (e.g. EU standard contractual clauses / recognised adequacy).

8. Your rights

Subject to applicable law, you may request access to your data, its rectification or erasure, restriction or objection to processing, and data portability. Write to info@pixelized.ch. You also have the right to lodge a complaint with the competent authority (in Switzerland, the Federal Data Protection and Information Commissioner; in the EU, your local supervisory authority). Requests about a visitor's data on a specific customer site are handled together with that customer, who is the controller.

9. Security

We apply appropriate technical and organisational measures: HTTPS everywhere, hashed passwords and read tokens, access limited to what each account owns, data minimisation (no IP, no raw user-agent) and regular backups.

10. Changes

We may update this policy; the "last updated" date above always reflects the current version. Material changes will be communicated through the service.