Privacy Policy

Last updated: September 28, 2026

This Privacy Policy explains how SimpleRUM ("SimpleRUM", "we", "us") collects and uses information in connection with getvisitor.info (the "Service"). It covers two different kinds of data: information about you as our customer, and the IP addresses/user-agents your application submits to the Service for enrichment ("Lookup Data").

1. Information We Collect About You (the Customer)

• Account information: the email address you sign in with, and a public key used for passwordless authentication. We don't collect or store a password.
• Billing information: we do not store your payment card details ourselves. Payments and subscription management are handled by our payment processor, which collects and processes billing details under its own privacy policy.
• Usage data: aggregate counters of your API activity (successful/failed lookups, response status codes, per day) tied to your account, used for quota enforcement, billing, and your dashboard's usage history. These are counts, not a log of individual requests.
• Support communications: anything you send us at support@getvisitor.info or similar channels.

2. Lookup Data (IPs and User-Agents Submitted to the API)

The core of the Service is stateless: you send an IP address and a user-agent string, and the Service returns derived enrichment data (location, network, device, language, currency, purchasing-power indicators) computed against our reference datasets. The Service does not persist a record of individual Lookup Data submissions — only aggregate, anonymous counts of how many lookups succeeded or failed are retained, tied to your account for billing and quota purposes, not to the underlying IP/user-agent values themselves.

Standard infrastructure-level logs (for example, web server or load-balancer access logs used for security, abuse detection, and troubleshooting) may incidentally and briefly include request metadata such as source IP addresses. These logs are operational in nature, access to them is restricted, and they are not used to build profiles of your end visitors.

You, not SimpleRUM, are the party submitting Lookup Data to us. If the individuals behind that IP/user-agent data are located somewhere with data protection requirements (for example the EU/UK GDPR or similar laws), you are responsible for having a lawful basis for that submission and for your own disclosures to those individuals — see Section 6 of our Terms of Service.

3. How We Use Information

• To provide, operate, and maintain the Service, including authentication, issuing and validating API keys, and returning enrichment results;
• To calculate usage against your plan, process billing, and enforce quotas and rate limits;
• To communicate with you about your account, the Service, or changes to these policies;
• To detect, investigate, and prevent fraud, abuse, and violations of our Terms of Service;
• To comply with legal obligations.

We do not sell your personal information, and we do not use Lookup Data submitted through the API to build advertising profiles.

4. Third-Party Reference Data and Processors

Enrichment results are computed using licensed and third-party reference datasets, including IP geolocation data from MaxMind. These datasets are static reference tables we host and query ourselves — submitting a lookup does not send your data back to the original dataset provider.

We use service providers to operate the Service, including a payment/subscription processor for billing and infrastructure providers for hosting. These providers process data only as necessary to perform their function for us and under their own applicable privacy and security commitments.

5. Website Analytics, Advertising, and Your Choices

On our website (not the API), we use two third-party tools:

• PostHog for product analytics: which pages are visited and how the site is used, including your approximate location derived from your IP address. PostHog processes this data on servers in the United States.
• The Reddit Pixel to measure how well our ads on Reddit work. When it runs, Reddit receives information about your visit, such as the page, your IP address, and browser details, and may use its own identifiers to connect the visit to an ad you clicked. Under some US state laws this may count as "sharing" personal information for advertising.

Whether these tools run depends on the privacy law that applies where you are:

• Opt-in laws (for example GDPR in the EU/EEA, UK GDPR, and Brazil's LGPD): they run only after you click Accept.
• Opt-out laws (for example California's CCPA/CPRA and other US state privacy laws): they run by default, and you can stop them with "Do Not Share My Personal Information" in the footer. We treat a Global Privacy Control signal from your browser as an opt-out.
• Elsewhere: they run by default, and you can still turn them off.

We determine which law applies by looking up your IP address with our own service; this lookup is not shared with PostHog or Reddit. Your choice and the detected law are stored in your browser, not on our servers. If the law that applies to you changes, for example because you are browsing from a different country, we ask again. You can change your choice at any time with "Privacy choices" in the footer.

6. Data Retention

• Account data: retained while your account is active, and for a reasonable period afterward to comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements.
• Usage counters: retained in aggregate form for as long as needed to support billing history and your dashboard's usage history.
• Lookup Data (IP/user-agent submitted per request): not retained as individual records by the Service beyond the lifetime of the request itself, as described in Section 2.

7. Your Rights

Depending on where you are located, you may have rights to access, correct, delete, or export your personal information, or to object to or restrict certain processing. You can update your account email or delete your account by contacting us at support@getvisitor.info; we will respond within a reasonable time and any timeframe required by applicable law.

If our processing of your information relies on your consent, you may withdraw it at any time; this will not affect processing that already took place.

8. Security

We use reasonable technical and organizational measures designed to protect information against unauthorized access, alteration, or loss, including passwordless (public-key) authentication for accounts rather than storing passwords. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. International Transfers

We are based in the United States, and information we process may be stored and processed in the United States or other countries where our service providers operate. Where required, we rely on appropriate safeguards for such transfers.

10. Children's Privacy

The Service is intended for business and developer use and is not directed to children. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date on this page, and for significant changes we will make reasonable efforts to notify account holders directly.

12. Contact

Questions about this Privacy Policy or requests regarding your personal information can be sent to support@getvisitor.info.