Privacy policy

1. Who is responsible

MediaLytics is operated by (not filled in yet), (not filled in yet). For any question about your personal data, write to (not filled in yet).

2. What MediaLytics is

MediaLytics is a private analytics and comparison service for news portals and digital publishers in Bosnia and Herzegovina. It is not a public website: only people invited by a participating portal or by the platform administrator have an account, and nothing is shown to visitors who are not signed in, apart from this page and the terms of use.

3. Personal data we process

About the people who use MediaLytics: - Account: your email address, your password (stored only as a secure hash, never readable), two-factor authentication and passkey settings, your chosen language and colour theme, and the portal you last selected. - Team: the portals you belong to and your role (owner or editor), and invitations sent to your email address. - Activity: a log of security-relevant and administrative actions (for example sign-in methods changed, team changes, Google Analytics connected or disconnected), with who did it and when; your notifications; and the history of reports you exported. - Support requests: what you write in the support form is emailed to the platform administrator together with your email address. It is not stored in MediaLytics.

We do not use your data for advertising and we do not sell it.

4. Google Analytics data of portals

A participating portal connects its own Google Analytics 4 property. MediaLytics then imports aggregated figures from it in the background: page views, sessions and active users per day, views per article (with the article's title and address), and active users per city and country.

These are totals reported by Google, not information about individual readers. MediaLytics does not receive readers' names, email addresses, IP addresses or other identifiers. To keep the connection, MediaLytics stores an access key from Google in encrypted form; it is never shown, logged or shared.

5. Why we process data

• To provide the service agreed with the participating portal: accounts, team access, analytics, comparisons and exports.
• To keep the service secure: sign-in protection, two-factor authentication, access checks, rate limits and the activity log.
• To meet legal obligations, for example for invoicing.
• To answer your support requests.

6. Who can see what

• A portal's private analytics (traffic, traffic sources, audience by location, its own articles in detail) are visible only to that portal's team.
• Other participating portals see only shared figures: page views, sessions, summed active users, article titles and views, views by category and the estimate of new articles. They never see a portal's traffic sources, audience locations, team or settings.
• The platform administrator can see account and portal settings to run the service, but is not a member of any portal's team.
• Your email address is visible to the other members of your portal's team.

7. Service providers

• Hosting: MediaLytics runs on a server in a data centre in the European Union.
• Email: messages (invitations, password resets, support requests) are sent through an email delivery provider.
• Google: the source of the analytics data, through the Google Analytics Data API, under Google's own terms.
• Backups: encrypted copies of the database are kept in separate storage, so data can be restored after a failure.

Pages load nothing from other websites: fonts and scripts come from MediaLytics itself, so your browser does not contact third parties while you use it.

8. Cookies

MediaLytics uses only cookies that it needs to work: - sign-in, to keep you signed in; - security, to protect forms against forged requests; - your language and colour theme; - short-lived cookies while a portal connects Google Analytics, and for one-time messages.

There are no analytics, advertising or tracking cookies.

9. How long we keep data

• Your account: until it is deleted.
• Activity log: 730 days.
• Report history: 365 days (the exported files themselves expire after a few days).
• Notifications: 90 days after you read them, and 365 days at most.
• Finished invitations (accepted, revoked or expired): 90 days.
• Google Analytics data of a portal: while the portal stays connected. Disconnecting Google Analytics deletes the imported data.

Backups contain older data until they are replaced, for a limited time.

10. Your rights

• Access: download everything stored about you under Account settings → Personal data.
• Correction: change your email address and password in your account settings.
• Deletion: delete your account under Account settings → Personal data. If you are the only owner of a portal, another owner must be added first.
• Objection, restriction and other questions: write to (not filled in yet).

You can also complain to the Personal Data Protection Agency of Bosnia and Herzegovina.

11. Security and changes

All connections use HTTPS. Access to each portal's data is checked on the server for every request, administrators must use two-factor authentication, and Google access keys are encrypted.

If this policy changes, the date at the top is updated and signed-in users are informed of important changes.