Skip to main content
Version: current (0.10)

Privacy and Compliance

ClickInsights is designed with security and regulatory compliance at its core, ensuring your user data remains protected while enabling accurate attribution and analytics.

Key Privacy Principles​


• End-to-end encryption: All PII (emails, wallet addresses) is encrypted both in transit and at rest.

• Blind computation with Nillion: Analytics are executed on encrypted data ensuring no raw data exposure.

• Zero data leakage: ClickInsights does not share any data with third parties.

• GDPR and CCPA compliance: Fully aligned with international privacy standards.

• Decentralized authentication and access control: Implements DIDs and permission tokens to safeguard access.

How It Works​


• We securely store user emails in an encrypted database.

• These are hashed for attribution matching and never shared with third parties.

•Our system is designed for compliance with GDPR, CCPA, and similar frameworks allowing you to link marketing activity to verified users without exposing sensitive data externally.”

Why It Matters​


You can safely track identifiers and measure marketing performance with complete confidence in our platform’s security and compliance guarantees.

Consent & GDPR integration​

If you operate under GDPR, CCPA, or similar regimes, you control when Lucia starts collecting. The pattern is simple: don't auto-initialize — initialize only after the visitor consents.

Instead of the auto-init data-api-key attribute, load the SDK without it and call init() from your consent handler, so nothing is collected until the visitor opts in:

<!-- Load the SDK, but do NOT auto-initialize (no data-api-key) -->
<script src="https://cdn.luciaprotocol.com/lucia-sdk-latest.min.js"></script>
<script>
  // Call this only after the visitor accepts analytics cookies
  function onConsentGranted() {
    LuciaSDK.init({ apiKey: 'YOUR_API_KEY' });
  }

  // If consent was already stored from a previous visit, initialize on load
  if (localStorage.getItem('lucia-consent') === 'granted') {
    onConsentGranted();
  }
</script>

Wire onConsentGranted() to your cookie-banner's "Accept" button, and persist the choice (e.g. in localStorage) so returning visitors are initialized automatically.

Respect Do Not Track​

To honor the browser's Do Not Track signal, check it before initializing:

if (navigator.doNotTrack !== '1') {
  LuciaSDK.init({ apiKey: 'YOUR_API_KEY' });
}

Handling opt-out​

Because the SDK is only initialized after consent, opting out is a matter of not initializing (and clearing your stored consent flag). If a visitor withdraws consent mid-session, stop making tracking calls and don't initialize on their next visit.

What's never collected

Automated click tracking skips password and credit-card fields and filters sensitive text, and respects the data-lucia-ignore attribute on any element you don't want tracked. See Button Click for the details.