Who we are
Invoker Analytics (“Invoker”, “we”, “us”) is a web analytics service operated by Hence Media Inc., a company incorporated in Ontario, Canada, doing business as Invoker App, through the websites invoker.app and invokerapp.com.
We provide a lightweight tracking script that website owners add to their sites, an API that receives the data, and a dashboard at invoker.app where our customers view their statistics.
You can contact us about anything in this policy at support@invoker.app.
Summary
We deal with two groups of people, and our role is different for each:
- Visitors to our customers' websites. When a website uses Invoker, the website owner decides to collect analytics and is the controller. We process that data on their behalf as a processor, under our Data Processing Agreement.
- Our customers and dashboard users. For account, billing and support data, we are the controller.
Across both groups:
- We do not use third-party cookies and do not track people across websites.
- We do not run advertising, build advertising profiles, or sell or share data for advertising.
- We do not sell customer data, and we do not use it to train machine-learning models.
Data about website visitors
This section applies if you visit a website that uses Invoker. The owner of that website is responsible for the data collected about your visit. If you have questions or want to exercise your rights, please contact the website owner first. We will help them respond.
What the tracking script collects
The script is served from https://cdn.invoker.app/script.js and loads asynchronously. Depending on how the website owner has configured it, it sends:
- the page URL and path, page title and referrer
- UTM and similar campaign parameters in the URL
- browser, operating system, device type, screen size and language
- approximate location (country, region, city), derived from your IP address
- outbound link clicks, file downloads and 404 (page not found) visits
- session timing and engagement, such as how long a visit lasts
- custom events, goals and revenue values that the website owner chooses to send
Identifiers stored on your device
To count unique visitors and sessions, the script stores a random first-party identifier and a session identifier in your browser's local storage. Our API may also set first-party cookies where the request is same-site. If local storage is not available, the script falls back to a hash computed from browser characteristics. Full details, including names and durations, are in our Cookie Policy.
IP addresses
Your IP address is processed only transiently, while a request is handled: it is used to look up an approximate location and to apply the website owner's IP and country blocks, and is then discarded. We never store visitor IP addresses, in full, truncated or hashed. Location lookups use a geolocation database (DB-IP Lite) hosted on our own servers, so your IP address is not sent to a third-party geolocation service.
Controls available to website owners
- honour the browser's Do Not Track signal (an option per site, not on by default)
- block traffic from specific IP addresses or countries
- set how long data is kept for their site
Website owners must not send us personal information such as names, email addresses or account numbers in URLs or custom events. Our Terms of Service prohibit it.
Data about our customers
If you have an Invoker account, or someone has invited you to one, we hold the following.
| Category | Examples |
|---|---|
| Account | Name, email address, password (stored only as a hash), or your Google or GitHub identity if you use social login. An avatar, if you upload one. |
| Teams | Team memberships and roles, and the email addresses of people you invite. |
| Sites and settings | Sites and domains you add, site and account settings, API keys, annotations, scheduled-report recipients, and alert destinations (email addresses, Slack or Discord webhook URLs). |
| Integrations | If you connect Google Search Console, the OAuth tokens needed to fetch your Search Console data. |
| Billing | Your plan and subscription status. Payments are handled by Stripe; we do not receive or store card numbers. |
| Support | Emails and messages you send us, and our replies. |
| Security and logs | IP address, user agent and timestamps in server and security logs, error reports, and the result of a Cloudflare Turnstile bot-protection check when you register. |
The dashboard stores your sign-in token and profile in your browser's local storage, along with your theme preference. It does not run third-party advertising trackers. See the Cookie Policy for details.
How we use data
- to provide the service: collect, process and display analytics for our customers' websites
- to create and manage accounts, teams and invitations
- to send transactional emails: account emails, invitations, password resets, scheduled reports and alerts
- to take payments and manage subscriptions
- to provide support and answer questions
- to keep the service secure, prevent abuse and fraudulent sign-ups, and fix errors
- to enforce our Terms and plan limits
- to meet legal, tax and accounting obligations
We do not use any of this data for advertising, and we do not sell it.
Legal bases
Where the GDPR or UK GDPR applies, we rely on the following legal bases for the data we control. For visitor analytics, the website owner chooses the legal basis as controller.
- Contract — to provide your account, the service and billing you have signed up for.
- Legitimate interests — to keep the service secure, prevent abuse, fix errors, improve the product and answer support requests. We balance these interests against your rights.
- Consent — where the law requires it, for example optional integrations you choose to connect. You can withdraw consent at any time.
- Legal obligation — to keep tax and accounting records and respond to lawful requests.
Service providers
We use the following providers to run Invoker. Each receives only the data it needs for its task. Our Data Processing Agreement lists the sub-processors that handle visitor analytics data.
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Hosting of the website and dashboard frontend | Global edge network |
| Laravel Cloud (on Amazon Web Services) | API, database, queues and storage of analytics data | USA (AWS us-east-1) |
| Resend | Transactional email: account emails, invitations, password resets, scheduled reports, alerts | [region] |
| Stripe | Payments and subscription billing, via Stripe-hosted checkout and billing portal | [region] |
| [Error-monitoring provider] | Error tracking for the frontend and API (Sentry SDK) | [region] |
| Cloudflare | Turnstile bot protection on sign-up | [region] |
| Google, GitHub | Social login, only if you choose it. Google also for the optional Search Console integration. | [region] |
| Mapbox | Map tiles for the locations map in the dashboard (dashboard users only) | [region] |
If you set up alerts to Slack or Discord, we send alert messages to the webhook URLs you provide. These are recipients you choose, not providers we engage.
Location lookups use a local copy of the DB-IP Lite database. DB-IP does not receive any data from us. IP Geolocation by DB-IP.
International transfers
Our API, database and analytics data are hosted in the USA (AWS us-east-1). Some providers above may process data in other countries.
When we transfer personal data from the EEA, the UK or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and, where a provider is certified, the EU-US Data Privacy Framework (and its UK and Swiss extensions). You can ask us for a copy of the relevant safeguards at support@invoker.app.
How long we keep data
Analytics data
Analytics data is kept according to the customer's plan, and each site can also set its own shorter retention period:
| Plan | Retention |
|---|---|
| Free | 30 days |
| Starter | 1 year |
| Growth | 3 years |
| Business | Unlimited — until the customer deletes it or closes their account |
See pricing for current plans.
Account data
We keep account data while your account is active. When you close your account, we delete your account data and your sites' analytics data within [30] days. Copies in backups are overwritten within a further [35] days.
We keep billing records for as long as tax and accounting laws require, and server logs for [period]. We may keep data longer where needed to resolve a dispute or comply with a legal obligation.
Security
- All traffic to our website, dashboard and API is encrypted with TLS.
- Passwords are stored only as salted hashes.
- Access to production systems is limited to staff who need it, and protected by access controls.
- Team roles let customers control who can see and change each site.
- Visitor IP addresses are never stored; they are used transiently for location lookup and blocking.
- Sign-up is protected against bots with Cloudflare Turnstile.
No system is perfectly secure. If you believe you have found a security issue, please email support@invoker.app.
Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and get a copy
- correct inaccurate data
- delete your data
- receive your data in a portable format
- object to processing based on legitimate interests
- restrict processing in certain cases
- withdraw consent where we rely on it
- complain to your data protection supervisory authority
Under the GDPR and UK GDPR, these rights are set out in Articles 15–22. In the UK you can complain to the Information Commissioner's Office; in the EEA, to the authority in your country.
California residents
Under the CCPA as amended by the CPRA, you can ask to know, access, correct and delete your personal information. We do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you. We will not treat you differently for exercising your rights.
How to make a request
If you are a website visitor, please contact the owner of the website first. They control the data and can identify your records. We will assist them.
If you are a customer, you can update most account data in the dashboard, or email support@invoker.app. We may need to verify your identity. We aim to respond within one month.
Children
Invoker is a business tool and is not directed at children. You must be at least 16 (or the age of digital consent where you live) to create an account. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We may update this policy as the product or the law changes. We will update the date at the top of this page, and for significant changes we will tell customers by email or in the dashboard before they take effect.
Contact
Hence Media Inc. (Invoker App)
Ontario, Canada
Email: support@invoker.app
Related documents: Terms of Service, Data Processing Agreement, Cookie Policy.