Privacy policy

Updated 9 November 2026.

This notice explains how IntentTrail handles information from account holders, visitors to this website and websites that use the IntentTrail tracking script.

Who is responsible?

IntentTrail is operated by Haijja AB, registered in Sweden under company number 559575-0703.

Haijja AB handles account administration, billing and support. When a customer uses IntentTrail on their website, that customer decides why website activity is measured and is responsible for the applicable visitor information, lawful basis and consent. We handle that measurement data to provide the customer’s reports. Visitors to a customer website should contact that website’s operator first about its use of analytics.

Account, payment and support information

We use your email address, authentication and account identifiers, site name and domain, and subscription and payment references to provide access, manage billing and answer requests. Authentication is handled by Supabase. Stripe hosts checkout and processes card information; card details are entered on Stripe’s page, not in IntentTrail.

Account and subscription administration are necessary to provide the service. Billing records may also be needed to meet legal obligations. Support messages and limited operational logs help us answer questions and protect the service. Where a contact person represents a business, we use their business contact details for that relationship.

Activity measured on customer websites

The tracking script sends a public tracking key, a browser-tab session key, page URLs, event names and times, landing page and referrer information, ad parameters such as UTMs and oppref, and outbound-click events. Reports show sessions, page views, recorded conversions and the pages reached within a session.

Session storage keeps a visit associated with the current browser tab. It is not a persistent cross-site visitor profile. A landing-URL ad signal is evidence visible on the customer’s website; it does not authenticate the visitor or prove that a click reference was issued by OpenAI. Missing signals remain unknown.

IntentTrail does not use fingerprinting, session replay, keystroke capture or cross-site tracking. It does not collect ChatGPT conversation content or ChatGPT user identities. Customers should not put names, email addresses, secrets or sensitive information in page URLs, event names or campaign tags because those fields can appear in reports.

Optional OpenAI Ads connection

A customer can optionally connect an OpenAI Ads account for read-only reporting. The supplied credential and synced campaign, ad and performance data are used for that connection. Disconnecting the account deletes the stored connection credential and synced OpenAI reporting records. It does not delete IntentTrail’s separate website sessions.

Visitors to this website

This website includes Vercel Web Analytics for site usage information. Hosting and infrastructure providers also receive request information needed to deliver and secure the website. Signing in uses authentication cookies. These functions are separate from the tracking script customers install on their own websites.

Providers and processing locations

We use Supabase for database and authentication services, Vercel for hosting and website analytics, and Stripe for payments and subscription management. The IntentTrail Supabase project is configured in the EU region eu-west-1. That database setting is not a promise that every hosting, payment, support or logging operation takes place only in the EU.

Providers may process information in other countries. Their current privacy and data-processing information explains their roles and transfer safeguards: Supabase, Vercel and Stripe. Contact us for information about processing arrangements relevant to your account.

Storage and deletion

Account and measurement records remain associated with the account or site until they are deleted. Cancelling a subscription stops renewal but does not itself delete these records. There is currently no automatic age-based purge of website measurement records.

To request deletion of an account or site’s measurement data, contact us using the account’s email address and identify the site. We may need to verify your authority before acting. Backups and provider-held records follow the relevant provider’s lifecycle; deletion from the live application is not a promise of immediate removal from every backup.

Billing records needed for accounting, legal obligations or an unresolved payment dispute may need to be retained separately. This retention is distinct from website analytics records.

Your rights and requests

Where applicable, you can request access, correction, deletion, restriction or portability of your personal information, and object to processing based on legitimate interests. You can withdraw consent where processing relies on it. Contact privacy@complifai.se and include “IntentTrail” in your request. We may ask for information needed to verify your identity. Requests are handled within the applicable statutory time limits.

You can complain to the Swedish Authority for Privacy Protection, IMY, or the relevant authority where you live. Providing an account email and payment information is necessary to create and maintain a paid account. This notice does not describe automated decisions that determine employment, credit, insurance or similar eligibility.

See also our subscription and service terms.