Analytics that do not require a DPIA.
No cookies. No personal data. No cross-border transfers. EU-only infrastructure. SealMetrics is designed so that the privacy assessment is straightforward — because there is nothing problematic to assess.
Privacy by architecture
No cookies
SealMetrics does not set, read, or rely on cookies of any kind — first-party or third-party. This eliminates the primary trigger for consent requirements under ePrivacy and GDPR cookie guidance.
No personal data collection
No IP addresses stored, no device fingerprinting, no user IDs, no email hashes. The data SealMetrics collects is behavioral and aggregated. Individual visitors cannot be identified, re-identified, or tracked across sites.
EU-only infrastructure
All data processing, storage, and backup occurs within the European Union. No sub-processors outside the EU, no reliance on Standard Contractual Clauses, no dependency on US-EU adequacy framework decisions.
No consent dependency
Because SealMetrics does not collect personal data or use cookies, consent banner status does not affect data collection. This is not a workaround — it is a consequence of the architecture. No personal data means no consent requirement for analytics.
Regulatory alignment
GDPR (Regulation 2016/679)
Compliant by designNo personal data processing as defined under Article 4(1). No profiling, no automated individual decision-making, no data subject identification capability.
ePrivacy Directive (2002/58/EC)
No consent triggerNo terminal equipment access (no cookies, no local storage, no device fingerprinting). Article 5(3) consent requirement does not apply.
Schrems II / US-EU Data Transfers
Not applicableAll infrastructure within EU jurisdiction. No data transfers to third countries. No reliance on SCCs, BCRs, or adequacy decisions.
CNIL / French DPA guidance
AlignedConsistent with CNIL exemption criteria for audience measurement tools that do not require consent when properly configured.
DSK / German DPA guidance
AlignedMeets German DPA requirements for analytics without consent: no cross-site tracking, no personal data, EU-only processing.
Trust architecture
No cross-customer data sharing
Each client's data is isolated. There is no aggregation across clients, no shared models, no benchmarking that could leak competitive information.
Data portability
Clients own their data. Full export capability in standard formats at any time. No vendor lock-in through data access restrictions.
Transparent processing
We document exactly what data is collected, how it is processed, and where it is stored. No black-box algorithms, no opaque data flows.
DPA available
Standard Data Processing Agreement available for all plans. Custom DPA negotiation available on Enterprise tier. Security questionnaire responses provided on request.
Review the full privacy architecture.
We are happy to walk your privacy team through the technical architecture, data flows, and compliance documentation.
Book a Privacy Review