Plausible Analytics

How we reached this

Read raw (curl, not WebFetch summary) 2026-10-20. Replaces the earlier one-line note. Controller: Plausible Insights OÜ, Tartu, Estonia (privacy policy). DPA at plausible.io/dpa (last updated September 2026): the customer is the data controller and Plausible the data processor for visitor data, and no separate signature is required; the text does not name Article 28. Hosting: all visitor data on Hetzner servers in Falkenstein, Germany; the policy says site data never leaves the EU. The only sub-processors that touch visitor data, per the policy: Hetzner (Germany; hosting), Bunny (Slovenia; CDN, DNS and DDoS protection) and UpCloud (Finland; database hosting and storage of data exports), all described as European-owned. For account data the policy lists Paddle (payment processing), Postmark (transactional emails and email reports), Gravatar and DuckDuckGo (proxied favicon and profile picture fetches) and, optionally, Google when Google Analytics data is imported or integrations are connected; the pages read do not state where these providers are established, so extraterritorialExposure stays UNKNOWN and is not read as a finding. Ownership: the About page says "We are self-funded and profitable, with no outside investors and no plans to sell"; founded by Uku Taht (December 2018), with Marko Saric from 2020. Data handling: raw IP addresses and User-Agent strings are not stored; a daily identifier is derived from a salted hash and the salt is rotated and deleted every 24 hours (data policy). No cookies. Pricing page: Starter EUR 9, Growth EUR 14 and Business EUR 19 a month at 10k monthly pageviews, with a 30-day free trial and no credit card; there is no free plan, so the pricing model is PAID, not freemium. sccInPlace false because no document names Standard Contractual Clauses and the policy says visitor data stays in the EU. Open questions for the vendor: where Postmark and Paddle process account data; whether the DPA relies on Article 28 wording.