Privacy

Last updated 26 July 2026.

This is the operator’s own summary of how the service handles data. Have a lawyer review it against your jurisdiction before you rely on it commercially.

Two kinds of people

Popkit handles data about account holders (you, the person who signs in) and visitors to the websites where you install the script. The two are treated differently and are never mixed.

If you hold an account

We store your email address and a hashed password so you can sign in, plus the sites, widgets and settings you create. Integration credentials — an Ecomail API key, a webhook signing secret — are encrypted with AES-256-GCM before being written to the database and are never shown back to you or sent to the browser. Deleting your account deletes all of it.

If you are a visitor

When a widget is shown, Popkit records that it appeared: the widget, the page URL, a random session identifier and a timestamp. There is no cross-site tracking, no advertising identifier, no fingerprinting and no cookies — the session identifier lives in the browser’s own sessionStorage and is gone when the tab closes.

If you submit a form, whatever you typed is stored, along with the page you were on, the referring URL and your browser’s user-agent string. That data belongs to the site owner who installed the widget, not to Popkit. They decide how long to keep it, and they are your point of contact for access or deletion requests.

Who else sees it

Data is stored with Supabase in the EU (eu-west-1) and the application runs on Vercel. If a site owner enables an integration, submitted leads are forwarded to that destination only — an Ecomail list, or the exact webhook URL they configured. Nothing is sold, and nothing is shared with anyone else.

Your rights

Under the GDPR you can ask for a copy of your data, ask for it to be corrected or deleted, and object to processing. Account holders can do most of this themselves: leads export to CSV in one click, individual leads and whole sites can be deleted from the dashboard, and deleting a site removes its widgets, leads and statistics immediately.

Getting in touch

Write to the address listed on the account you signed up through. If you are a visitor asking about a form you filled in, contact the website that showed you the form — they hold that record.