Foresite Privacy Policy
Effective date: 7 October 2026
Foresite is operated by Devon Theriault, a sole proprietor carrying on business as Devs Industries in Nova Scotia, Canada ("Foresite", "we", "us"). This policy explains what personal information we handle and why. It covers two very different groups of people:
- Part A: Visitors to websites that use Foresite. For this data, the website owner is in control and we process it on their behalf.
- Part B: Customers who sign up for Foresite, and people who receive Foresite email reports. For this data, we are responsible.
Part A: Visitors to websites that use Foresite
What we do not do
- We do not set cookies.
- We do not store anything on your device: no localStorage, sessionStorage, IndexedDB or similar.
- We do not store your IP address or your full browser identification string (User-Agent).
- We do not track you across websites or across days, build a profile of you, or sell or share your data.
What we process, and how
When you load a page on a website that uses Foresite, the Foresite script sends us the following. The script is open source, so you can read exactly what it sends.
| Data | What happens to it |
|---|---|
| Page address, referring website, UTM campaign tags | Stored as part of the event, after removing anything that looks like personal data |
| IP address | Held in memory only for a moment and used for two things: (1) looking up your country and region, never your city; (2) computing the daily visitor hash below. It is then discarded and never written to disk. |
| User-Agent (browser identification string) | Held in memory only and used to determine browser, operating system and device type (desktop/mobile/tablet), and to compute the daily visitor hash. It is then discarded and never written to disk. |
| Custom events | If the website owner has set them up, the event name (e.g. "signup"), plus any properties and amounts. Values that look like personal data are automatically discarded. |
| Automatic events | If the website owner has switched them on: clicks on links to other websites, file downloads, and visits to pages that don't exist (404s). We never record form submissions automatically. |
Daily visitor hash. To count unique visitors without identifying anyone, we compute a one-way hash from your IP address, User-Agent, the website, and a random secret ("salt") that changes daily. Each day's salt is permanently destroyed after that day ends in the website's time zone. After that, nobody, including us, can recompute the hash or link your visits on different days or on different websites.
Who controls this data
The owner of the website you visited decides to use Foresite and controls this data. We process it only on their instructions, under our Data Processing Agreement. If you have questions or want to exercise your privacy rights, contact the website owner first. Because we hold no data that identifies you, we usually cannot single out "your" data, but we will help website owners respond to any request.
How long it is kept
Event data is kept as long as the website owner keeps an active Foresite subscription. It is deleted 30 days after their subscription ends, or within 24 hours if they delete their account (and from backups within 30 days).
Part B: Customers and email report recipients
What we collect
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email address; name and profile picture if you sign in with Google | Creating and securing your account, signing you in, service emails | Contract |
| Websites you add, settings, brand logos and names you upload | Providing the Service | Contract |
| Subscription status, tier and billing country (from Paddle) | Managing your subscription | Contract |
| Email addresses of report recipients you add, and their confirmation and unsubscribe status | Sending reports that recipients have confirmed they want | Consent of the recipient |
| Support emails you send us | Answering you | Contract / legitimate interest |
| IP address and browser details in dashboard security logs | Security and abuse prevention; deleted after 14 days | Legitimate interest |
Payments. Paddle.com, our reseller and Merchant of Record, processes your payment details. We never see or store your full card number.
Cookies on our own sites
- app.foresite.dev (the dashboard) uses one strictly necessary cookie to keep you signed in, for up to 30 days. If you open the "Don't count my visits" link for one of your own Sites, a flag is stored in your browser for that Site, at your request. It's never set for anyone else.
- foresite.dev (our marketing site) uses Foresite itself, with no cookies.
Emails we send
We send service emails about your account, such as sign-in links, trial and billing notices, usage notices and security alerts. We send marketing emails only if you've opted in, and every marketing email includes an unsubscribe link, as required by Canada's Anti-Spam Legislation (CASL).
How long we keep it
We keep your account data while your account exists. After cancellation, it is deleted along with your Sites' data at the end of the 30-day read-only period. If you delete your account yourself, it's removed within 24 hours, and from backups within 30 days. We may keep billing records longer where tax law requires; Paddle holds most of these.
Service providers and where data is stored
Analytics data is stored in the European Union. We use a small number of service providers, listed with their purpose and location on our Subprocessors page. Canada is recognised by the European Commission as providing adequate protection for personal data. Where data moves to a country without that recognition, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.
Your rights
Depending on where you live (for example under Canada's PIPEDA, the EU/UK GDPR, or US state privacy laws), you may have the right to access, correct, delete or export your personal information, to object to or restrict its processing, and to withdraw consent. Customers can export and delete their data directly from the dashboard. For anything else, email privacy@foresite.dev. We'll respond within 30 days.
You can also complain to a regulator: in Canada, the Office of the Privacy Commissioner of Canada (priv.gc.ca); in the EU or UK, your local data protection authority.
Security
Data is encrypted in transit (TLS) and at rest. Access to production systems is limited to the operator and protected by multi-factor authentication. See Annex 2 of the DPA for details.
Children
Foresite is a business service, not directed at children. We don't knowingly collect children's personal information as a controller.
Changes
We'll post changes to this policy here and email Customers about material changes at least 30 days before they take effect.
Contact
Privacy questions: privacy@foresite.dev Devon Theriault, carrying on business as Devs Industries, 5660 Cabot Street, Halifax, Nova Scotia B3K 2J8, Canada