Privacy Policy

Privacy Policy - Pomelo Analytics

Last updated: November 13, 2026

The essentials

Our commitment. Pomelo measures a website’s audience, not people. This measurement is designed to meet the most demanding criteria set by European regulators. See sections 2 and 5.
What we measure. The pages viewed (with their title), where visits come from, the actions taken on the site, the device, country, region and city. See section 6.
What we do not do.
- No measurement cookie: the only possible cookie remembers a visitor’s objection.
- No tracking from one site to another, no visitor profile, no session replay.
- The IP address is not kept in measurement data.
Campaigns. The Campaigns option serves a marketing purpose and requires consent. See section 6.4.
Where and for how long. Data hosted in Europe, on AWS Europe (Stockholm). Reports do not show data older than 25 months. Our providers: AWS, Mailjet and Polar. See sections 8, 9 and 10.
Who decides, and your rights. The publisher of the site you visit is the controller; Pomelo is its processor. You can object to the measurement, write to us at privacy@pomeloanalytics.com or contact the CNIL. See sections 3, 12, 14 and 15.

This policy describes how Pomelo Analytics (“Pomelo”, “we”) processes data:

when you visit pomeloanalytics.com and its subdomains,
when you use the Pomelo Dashboard,
when you sign up to the waiting list,
when you browse a website or app that uses Pomelo Analytics to measure its audience.

1) Identity and contact

Pomelo Analytics, published by Fahed Toumi, in France.

SIRET: 53791846800027 Address: 94 RUE DU MONT CENIS, 75018 PARIS 18, France.

Privacy / data rights contact: privacy@pomeloanalytics.com Support: support@pomeloanalytics.com

2) What Pomelo does not do

No measurement cookie and no local storage for audience measurement. The only possible cookie remembers a visitor’s objection (Section 12).
No tracking from one site to another, no visitor profile, no session replay. Data is isolated per site.
The IP address is not kept in measurement data.
No targeted advertising, no sale of data.
Aggregated statistics; counts below ten are not broken down.
No automated decision with effects on individuals is made from this data.

3.1 Audience measurement for customer websites/apps (Pomelo as Processor)

When a website/app (the “Customer”) uses Pomelo:

the Customer is the Controller,
Pomelo is the Processor: processing is strictly limited to providing the audience measurement service, under the Customer’s instructions and our Data Processing Agreement (DPA).

Informing visitors is the Customer’s responsibility: it does so in its own privacy policy, with an opt-out link. Pomelo provides it with the text of that notice. The IP address is not kept in measurement data.

3.2 Account, Dashboard, waiting list, support, security, pomeloanalytics.com (Pomelo as Controller)

For account management, Dashboard access, the waiting list, support, security and audience measurement of its own sites, Pomelo acts as Controller.

3.3 Payment (Polar, separate controller)

Paid subscriptions are sold by Polar, which acts as Merchant of Record and processes payment data for its own purposes (Section 9).

4) Cookies, local storage, trackers

4.1 On websites/apps instrumented by Pomelo

Audience measurement uses no measurement cookie and no local storage. The only possible cookie is the opt-out cookie (Section 12). Pomelo does not use advertising identifiers (IDFA/AAID) and does not enable any retargeting mechanism.

4.2 On pomeloanalytics.com and the documentation

These sites are measured by Pomelo like any customer site, without a measurement cookie. The site writes no cookie, apart from the opt-out cookie. The documentation may remember in your browser the display theme you choose.

4.3 In the Dashboard

The Dashboard uses cookies and local storage that are necessary for it to work:

authentication: sign-in tokens from the authentication provider (Amazon Cognito) are stored in browser cookies;
selection: two cookies remember the selected workspace and site, for 90 days;
display preferences: browser local storage remembers, for example, the selected site and table settings.

No advertising tracker is used.

5) Audience measurement: how it works

5.1 Location (via CloudFront)

Country, region and city come from CloudFront geolocation headers. Audience measurement always collects these three items, whatever the Customer configuration. They are used only to produce aggregated statistics.

5.2 IP address

The IP address is not kept in measurement data.
When the request is received, it is used to determine country, region and city, then, truncated (IPv4: /24, IPv6: /48), to compute the visit identifier (Section 5.3).
The API firewall uses the full IP address to rate-limit requests.
In the event of an incident, logs containing the IP address can be enabled temporarily (Section 11).

5.3 Visit identifier

To count visits and compute sessions, Pomelo computes a visit identifier specific to one site and one day. Once the day is over, Pomelo can no longer recompute it.

It is computed with an HMAC from the truncated IP prefix, the browser family, the operating-system family, the site identifier and a random key specific to the day (UTC).
The day’s key is deleted when the next one is created: the identifier links neither two sites nor two days.
It is written to no device: no cookie, no local storage.
It is used only for statistics and de-duplication.

6) Data processed

6.1 Audience data (visitors of customer websites/apps)

Pomelo processes only audience measurement data:

page/screen viewed (URL/path without parameters, without form contents) and the page title (truncated),
timestamp and the site’s hostname,
referrer reduced to its domain, and entry page,
location: country, region and city,
technical categories (device type, browser, operating system), browser language, window width and height,
clicks captured automatically, with their destination and label, and the identifier of submitted forms (no typed contents),
time spent and scroll depth,
load time and Web Vitals performance indicators,
JavaScript errors (type, script and line),
the customer space of the page, where the Customer declares one,
configured events (conversion, click, etc.), with their name and label, without direct identifiers,
visit identifier (Section 5.3).

Screen size, time zone and connection type are not kept.

Not collected by design: name, email, phone number, typed content, sensitive data, advertising identifiers, session replay, keystroke recording.

Customer obligation: configure URLs, titles and events so as not to transmit personal data (e.g., URL parameters containing an email, a personal identifier, or the content of a form field).

6.2 Account data (Pomelo users)

email (account identifier),
workspace, roles, and settings,
subscription/billing information necessary to perform the contract,
security logs (authentication, security events).

6.3 Waiting list

email (required) and the page language,
an email asks you to confirm your sign-up; without confirmation, you are not added to the mailing list,
emails are sent by Mailjet (Section 9).

6.4 Campaigns (Customer option)

When the Customer enables the Campaigns option, the script also sends the campaign parameters of the visited address (utm_source or ref, utm_medium, utm_campaign, utm_content, utm_term), only for visitors who have given their consent. The Customer’s site passes that choice to the script; the script does not store it. For these visitors, Pomelo keeps these parameters, the arrival channel derived from them and the consent given. Declining Campaigns does not stop audience measurement, which follows its own rules.

6.5 Support

support exchanges and associated metadata.

7) Purposes, legal bases and whether data is mandatory

7.1 Customer-site audience (Pomelo as Processor)

Purpose: audience and performance analytics and technical diagnostics, exclusively for the Customer. Legal basis: determined by the Customer. Visitors have no data to provide to Pomelo; measurement is automatic, and they can object to it (Section 12).

7.2 Pomelo as Controller

Purpose	Legal basis	Mandatory data?
Account and Dashboard: provide the service, manage the subscription	Contract performance	Yes: without an email, no account
Billing and accounting	Legal obligation	Yes, for a paid subscription
Security, abuse prevention, reliability	Legitimate interest	Automatic technical logs
Audience measurement of pomeloanalytics.com and the documentation	Legitimate interest: knowing how our sites are used	No data to provide; objection possible
Waiting list	Consent, confirmed by email; you can withdraw it at any time	Only the email is required

None of these purposes relies on automated decision-making or profiling.

8) Retention periods

Visit identifier: the day’s key is deleted when the next one is created (at the end of the UTC day). The same visitor cannot be linked from one day to the next. The identifier itself is kept with raw audience data.
Audience data (raw and aggregated): reports and the API do not show data older than 25 months, and the database automatically deletes detailed visit data after 25 months, give or take a week (it deletes in 7-day slices). The raw event journal (S3), used only to replay imports, expires automatically 90 days after it is written; earlier versions of an object are deleted at most one day later. There is no targeted deletion inside this journal: data disappears from it when the 90 days expire.
Account data: for the duration of the contractual relationship and as long as legal obligations require. To request erasure, write to privacy@pomeloanalytics.com.
Waiting list: until you ask for deletion at privacy@pomeloanalytics.com.
Technical logs: kept as long as needed for security and diagnosis. The incident access logs (Section 11) are configured to expire after 7 days.
Support exchanges: kept as long as needed to handle your request.

Backup copies follow a separate rotation: the database is backed up in full copies, each kept about 7 days; data deleted from the database may remain in those copies, and in their storage history, for up to about four weeks. The history available through your plan or the API is distinct from this policy and may be shorter.

9) Recipients and providers

Pomelo does not sell data and does not share it for advertising purposes.

Amazon Web Services (AWS) - Europe Purposes: storage and processing of audience data (EU, Sweden/Stockholm), CDN (CloudFront), DNS (Route 53), authentication (Amazon Cognito), transactional emails (Amazon SES), and required infrastructure services. Entity: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg.
Mailjet Purpose: sending the waiting-list emails (confirmation, then launch information) to people who signed up. Address: 43 rue de Dunkerque, 75010 Paris, France.
Polar (payments) Purposes: sale and payment of subscriptions. Polar is Merchant of Record: it processes payment data as a separate controller, under its own terms. Pomelo sends it the account email, a customer and plan identifier, and the number of events and active members needed for usage-based billing. This volume is counted during ingestion, in a per-workspace, per-day counter that holds no visit data; it is never read back from the audience data. (Contractual details are described in the Terms / Subscription Terms and Polar’s terms.)

10) International data transfers outside the EU/EEA

Source audience data and the report-serving database are hosted on AWS in Sweden (Stockholm). Pomelo operates the TimescaleDB reporting engine on that European AWS infrastructure; no separate Tiger Cloud service is used for reporting.

Some transfers outside the EU/EEA do exist, however:

At the edge. Collection requests and the site go through the CloudFront network. A request, IP address included, is processed at the point of presence closest to the visitor, which may be outside the EU/EEA: no geographic restriction is configured. The API firewall is managed from the AWS us-east-1 region (United States).
Payment. Polar is a company established in the United States: the data needed for the subscription is sent to it outside the EU/EEA.

Transfers to AWS are governed by recognized mechanisms:

an adequacy decision where applicable (e.g., the EU-US Data Privacy Framework for certified entities), and/or
the European Commission’s Standard Contractual Clauses (SCCs).

Polar, as a separate controller, applies its own safeguards, described in its policy.

AWS provides a GDPR DPA including SCCs (2021/914) and indicates Data Privacy Framework coverage via Amazon.com, Inc. Information on applicable safeguards can be requested at privacy@pomeloanalytics.com.

11) Infrastructure and security logging

Audience dataset: no IP address, no raw user-agent, aggregation-oriented.
Security logs: used only to protect the service (abuse, attacks, fraud) and investigate incidents.

By default, Pomelo writes no CloudFront access logs, which would contain visitors’ IP addresses. Security relies on metrics, alerts and firewall rules (rate limiting per IP address).

The API firewall rate-limits per IP address, in memory. It writes no request sample: outside an incident, no IP address is kept. Only the emergency logs described below contain the IP address.

In the event of an incident, Pomelo can switch on an emergency (“break-glass”) mechanism at deployment. It enables CloudFront access logs of the collection API, which contain the IP address, user-agent, referrer and requested address. They are written to restricted-access storage and configured to expire after 7 days.

12) Opt-out

Visitors can opt out of audience measurement via an opt-out mechanism provided by the Customer (a link/button in the Customer’s privacy policy). The opt-out is remembered by a first-party opt-out cookie (one year) and results in a complete stop of collection on that website/app.

13) Security

Pomelo implements appropriate technical and organizational measures, including:

TLS encryption in transit,
strict access control (least privilege) and auditability,
logical tenant separation,
secure secrets management,
monitoring and alerting,
incident response procedures.

14) Your rights

14.1 Pomelo users, waiting-list members and visitors of pomeloanalytics.com

You may exercise the applicable rights: access, rectification, erasure, restriction, objection, portability where applicable. Where processing relies on your consent (waiting list), you can withdraw it at any time. Contact: privacy@pomeloanalytics.com.

14.2 Visitors of a customer website/app

The Controller is the website/app you visited (the Customer). Its visitors are informed by its own notice and should address requests to it first. Pomelo assists the Customer under the DPA where needed.

15) Contact and complaints

Privacy / data rights: privacy@pomeloanalytics.com You may also lodge a complaint with the competent supervisory authority (e.g., the CNIL in France).

16) Changes

Any update to this policy is published with its “last updated” date. Material changes are communicated in the Dashboard when they affect how processing is understood.