Privacy Policy

Last updated: August 14, 2026

Overview

Triumph Interactive, Inc. ("Triumph," "we," "us," or "our") offers the Triumph Analytics product and operates the triumphanalytics.com website and the Triumph Analytics platform. This page informs you of our policies regarding the collection, use, and disclosure of personal information when you use our Service.

We act as a service provider to our clients under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). We process personal information solely on behalf of and under the instructions of our clients. We do not sell, retain, use, or disclose personal information for any purpose other than providing the analytics service specified in our agreements with clients.

Each customer is solely responsible for its own websites, visitors, and legal obligations. Customers must determine whether their tracking is lawful, provide every required privacy notice, consent, opt-out, and preference mechanism, configure Triumph Analytics to meet their obligations, decide what data to send, and respond to consumer requests directed at their businesses. Triumph Analytics' compliance-oriented features, including GPC handling, do not provide legal advice or make Triumph the customer's privacy counsel, DPO, or business under privacy law.

Categories of Personal Information Collected

Account Information: When you create an account, we collect your name, email address, company name, and website domain. We use this information to provide and manage your account.

Identifiers: Visitor ID (first-party cookie), IP address, and email hash (only if explicitly provided by the website operator via the identify API). We use IP addresses for geolocation and rate limiting. Analytics event records retain IP-derived geolocation fields and, unless GPC is active or IP anonymization is enabled, a server fingerprint derived from the IP address, browser details, and language. Raw IP addresses may be present in rate-limit keys and operational access logs, subject to configured retention. We do not store raw IP addresses in analytics event records.

Internet Activity: Pages visited, referrer URLs, search terms used on-site, events (clicks, form submissions, downloads), scroll depth, and outbound link clicks.

Geolocation: Country, country code, region, region code, city, postal code, latitude, longitude, and timezone derived from IP address. We do not collect device GPS coordinates.

Device Information: Browser type, operating system, screen resolution, device type (desktop/mobile/tablet), and browser language.

Cookies: We use first-party cookies only. Our tracker sets a first-party cookie on your website's domain to identify returning visitors and maintain session continuity. We do not use third-party cookies or participate in cross-site tracking.

Categories of Sources

All analytics data is collected directly from the website visitor's browser via our JavaScript tracker. We do not purchase data from third-party sources, data brokers, or other companies.

Business Purpose for Collection

We collect and process personal information solely to provide web analytics services to our clients. This includes generating aggregate reports on website traffic, visitor behavior, acquisition sources, and conversion metrics. We do not use personal information for advertising, profiling, or any purpose beyond analytics.

How We Use Your Information

  • To provide and maintain the analytics platform on behalf of our clients
  • To manage your account and process payments
  • To send service-related communications (scheduled reports, alerts, account notices)
  • To improve our platform and fix issues

Do Not Sell or Share My Personal Information

We do not sell personal information. We do not share personal information with third parties for cross-context behavioral advertising or any other purpose. We do not disclose personal information to third parties in exchange for monetary or other valuable consideration. This has been our policy since Triumph Interactive, Inc. was founded and will remain so.

Data Ownership and Export

All analytics data collected through your tracking code belongs to you. You can request export of available analytics data through supported features while the account and data remain accessible, subject to plan restrictions and the 100,000-row cap on raw JSON export. For an expired trial that does not convert to a paid subscription, analytics-data cleanup runs after 30 days. For a payment-suspended or cancelled account, analytics-data cleanup runs after 90 days. The cleanup submits row-level deletion operations for events and visitor identities; its outcome against compressed data has not been verified. Account configuration may be retained for reactivation.

California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to:

  • Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you
  • Right to Delete: Request deletion of your personal information
  • Right to Correct: Request correction of inaccurate personal information
  • Right to Opt-Out of Sale/Sharing: We do not sell or share personal information, so this right is automatically satisfied
  • Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

For website visitors: If you visited a website that uses Triumph Analytics and wish to exercise your CCPA rights, please contact the website operator directly. As their service provider, we will cooperate with your request.

For our clients: You can exercise your rights by contacting us at our contact form. We will respond within 45 days as required by law.

Authorized agents: You may use an authorized agent to submit a request to know, delete, or correct on your behalf. We may require the agent to provide proof of your written permission and may require you to verify your own identity directly with us.

Global Privacy Control (GPC)

We honor Global Privacy Control (GPC) signals as required by the CCPA. When your browser sends a GPC signal, we automatically apply the following privacy protections:

  • Device fingerprinting is suppressed - no canvas, WebGL, audio, or font signals are collected
  • Identity linking is disabled - your customer ID or email will not be associated with your visitor ID
  • Cookie lifetime is reduced from 2 years to 24 hours
  • Cross-domain tracking is disabled - your visitor ID is not shared between websites
  • Server-side fingerprinting is skipped - no IP + User-Agent hashing
  • IP addresses are used for geolocation and rate limiting. Analytics event records retain IP-derived geolocation fields, while raw IP addresses may be present in rate-limit keys and operational access logs, subject to configured retention

Basic analytics (page views, events, scroll tracking) continue to function, allowing website operators to understand aggregate traffic patterns without persistent visitor tracking. GPC is supported in browsers including Brave, Firefox, and via browser extensions.

Service Provider Obligations

Triumph Interactive, Inc. operates as a "service provider" under the CCPA. This means:

  • We process personal information solely on behalf of our clients and under their instructions
  • We do not retain, use, or disclose personal information for any purpose other than providing analytics services
  • We do not combine personal information from different clients
  • We cooperate with our clients' obligations to honor consumer rights requests
  • We provide our clients with a Data Processing Agreement documenting these obligations

Our hosting environment is self-hosted infrastructure on Amazon Web Services in US regions, including the Triumph-managed TimescaleDB analytics deployment.

Data Security

We use industry-standard security measures to protect your data, including encryption in transit (TLS), encrypted database storage, and regular security audits. Our infrastructure is hosted on AWS with automated backups, high-availability configurations, and network isolation via VPC security groups.

Data Retention

Analytics data retention settings are limited by your plan's retention period: 14 months for Starter, 26 months for Growth, and 38 months for Pro and Business. Enterprise plans include unlimited retention. Website operators can configure a shorter retention period in the Privacy section of Settings. When the system verifies that deletion is safe, it removes events older than each website's effective retention setting. If it cannot verify safety, it retains those events and reports the condition. Account information is retained as long as your account is active. The account-cleanup timelines and limitations are described in Data Ownership and Export above.

Children's Privacy

The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16. We do not sell or share the personal information of consumers we know to be under 16 years of age. If you believe a child has provided us personal information, please contact us and we will delete it.

Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your California privacy rights, please contact us at our contact form, or by mail:

Triumph Interactive, Inc.
6805 Dwight Rowland Rd, Suite 431
Willow Spring, NC 27592