Privacy and analytics notice

What we collect

Analytics do not use a visitor-recognition analytics cookie, advertising identifier, or persistent ID. We process only the following event-level information:

• Visit time, page path, referring source category, and campaign tags
• Page views, active time, scroll milestones, CTA clicks, and form start, validation, and success states
• Browser, operating-system and device categories, Core Web Vitals, and normalized error types
• A country code derived from the IP address at request time, plus bot or security-scanner classification

We do not store full IP addresses, precise location, email addresses, or form contents in the analytics system.

Country-code lookup uses DB-IP Country Lite data (CC BY 4.0).

Email and enquiries

Landing-page links in emails from Tropis may include campaign tags so we can measure aggregate visits and conversions. We do not put a recipient’s email address or name in those links, and we do not use email-open pixels or individual session replay.

When you arrive through a Tropis campaign link, a signed campaign value may be passed briefly in the URL fragment without identifying the recipient. Fragments are not sent in server requests, referrers, or proxy logs and are removed from the address bar as soon as the landing page reads them. The value is valid for no more than 30 minutes, contains no email address, name, or recipient ID, and is not stored as an analytics cookie. We do not process it when GPC, DNT, or an analytics opt-out is active.

When analytics is allowed and collection starts, or when you open the buyer-scan form, Tropis may use an HttpOnly security cookie for the browser session to reject forged cross-site submissions. It is not used for behavioral measurement or returning-visitor recognition and expires with the browser session. We do not issue it for analytics when GPC, DNT, or an analytics opt-out is active.

If you submit a work email for a buyer scan or enquiry, it is handled separately from analytics to deliver and respond to the service you requested. You may ask us to delete it.

Retention

The signed email campaign attribution value becomes invalid after no more than 30 minutes. Individual analytics events are kept for up to 30 days, then deleted or reduced to daily anonymous statistics. Anonymous aggregates are kept for up to 25 months to compare service trends. Enquiry information is kept only as long as needed to handle the request and maintain necessary business records, then deleted or anonymized.

Opt out of analytics

You can turn off first-party aggregate analytics at any time below. Tropis also honors a browser Global Privacy Control (GPC) or Do Not Track (DNT) signal as an analytics opt-out.

Contact and your choices

For access, correction, deletion, or questions about this notice, email zoe@tropis.ai.