Website analytics privacy

Who is responsible

Y CORP AS (Norwegian registration number 932 195 321) operates Fikamail and is the controller for these website analytics. Contact support@fikamail.com for privacy requests and questions.

Optional analytics and your consent

We measure which public pages attract visitors and lead to access requests, and how visitors move between our website and access form. The legal basis is your consent under GDPR Article 6(1)(a). We collect these browser events only after you select “Accept analytics”. Declining has no effect on access requests or use of Fikamail. You can withdraw consent at any time using “Analytics preferences”; this stops future collection and removes the visitor and session cookies. Withdrawal does not affect the lawfulness of earlier collection.

What is collected

PostHog receives a random visitor identifier, a random session identifier, event times, public page categories and canonical page URLs without queries or fragments, coarse traffic-source categories, known public referring domains, allowlisted traffic-source names, browser and device-type categories, page visits and exits, time spent on a page, access-button positions and access-request success or failure. The same visitor identifier connects consenting visits on fikamail.com and app.fikamail.com. We do not connect it to your account, email address or store records.

We exclude form contents, email addresses, private page paths, campaign content, complete referring URLs and query parameters. We do not capture session recordings, arbitrary clicks, precise location or create person profiles. Requests necessarily use your IP address for network delivery; PostHog is configured to discard client IP data and our events disable GeoIP enrichment. Random identifiers are pseudonymous data, not a claim that every event is anonymous.

Cookies

• fika_analytics_choice: remembers acceptance or refusal for 180 days. This preference is stored to respect your choice.
• fika_visitor: a random identifier created only after acceptance, lasting 90 days from creation.
• fika_session: a random identifier created only after acceptance, expiring after 30 minutes without a captured event.

Cookies are shared across Fikamail subdomains. The visitor cookie's expiry does not delete events already collected. No analytics cookies are sent to PostHog.

Provider, location and transfers

Our analytics processor is PostHog, Inc., using PostHog Cloud EU, with analytics storage in Frankfurt, Germany. PostHog uses subprocessors to operate its service; EU hosting does not mean every support or operational activity is confined to the EU. PostHog's data processing agreement provides the contractual safeguards, including standard contractual clauses for applicable international transfers. See its subprocessor list. We do not sell visitor analytics or use these events for automated decisions with legal or similarly significant effects.

Retention and deletion

We use a rolling twelve months of visitor events to compare acquisition performance across seasons. The current PostHog Free plan provides a one-year event analysis window. This window limits access in reports; it is not an automatic physical deletion deadline. We review continued need quarterly and arrange separate deletion of visitor data that is no longer needed, including data beyond the twelve-month analysis period. Deletion requests are processed separately through PostHog and may run asynchronously. We do not promise that raw events are physically erased when a cookie expires or exactly on day 365.

Your rights

You can request access, correction, erasure, restriction or portability where applicable, and withdraw consent. Contact support@fikamail.com. For a request about browser events, your random visitor identifier helps us locate the records: it is the value of the fika_visitor cookie. Contact us before clearing it if you want existing events located; you can always decline future tracking immediately. We will explain if we cannot identify your records without additional information. You may complain to Datatilsynet or your local data protection authority.

This notice covers optional website analytics. The separate service privacy document covers account, store and campaign processing and currently remains a draft.