GDPR-compliant website visitor identification

Last updated 2026-11-01 · by Venu Gopal Reddy Muvva, founder

VisitorCompanyFinder works in strict mode to store nothing on a visitor's device before they consent. It identifies companies, not people, and never stores raw IP addresses. You handle data-subject requests directly in the app.

Steps

Create account. Sign up with your work email. No credit card is needed to start.
Select strict mode. Choose strict mode when adding your site. This ensures no data is stored on the device before consent.
Install pixel. Paste the script tag on your website. It respects Global Privacy Control and consent settings.
Check the match rate. Open the overview. The match-rate meter shows how many visits were tied to a company; raw IP addresses are never stored.
Manage requests. Use the app to handle access, withdrawal, or erasure requests for data subjects.

Privacy and consent settings (demo data).

How strict mode works

Strict mode is designed for teams selling into Europe or India. When a visitor arrives, the pixel checks for consent signals. If no consent is given, the pixel stores nothing on the visitor's device. It does not set cookies or track behavior until the visitor explicitly agrees. This approach helps you stay aligned with GDPR and the DPDP Act without complex legal setups.

Company-level identification only

We identify the organization behind a visit, not the individual person. This is by design. We do not offer person-level identification for anonymous visitors. If a visitor fills out a form or chats with you, they can opt in to share their name and email. We store this consent record so you know exactly who agreed to be contacted.

Data storage and privacy

We never store raw IP addresses. Instead, we use a daily salted hash to protect visitor privacy. This means we cannot reverse-engineer who a visitor is from our database. You, the customer, are the data controller. You are responsible for writing your own privacy notice. We provide the tools to manage data, but we do not provide legal advice.

Handling data-subject requests

Visitors have the right to access, withdraw, or erase their data. You can handle these requests directly in the VisitorCompanyFinder app. You can also use our API to automate this process. When a visitor withdraws consent, we stop processing their data. When they request erasure, we delete their records. This keeps your compliance process simple and transparent.

When VisitorCompanyFinder is not the right tool

If you need to identify individual people without their consent, this tool is not for you: we do not offer person-level identification of anonymous visitors. If your plan depends on retargeting specific people, look at RB2B or Vector, which offer person-level data for US visitors, and check how their model fits your EU and Indian visitors. If you need legal advice, talk to a lawyer; this page is not legal advice.

Questions

Do you store raw IP addresses?

No. We never store raw IP addresses. We use a daily salted hash to protect visitor privacy. This ensures we cannot identify individual people from our database.

Can I identify individual visitors?

Only if they opt in. We identify companies by default. If a visitor fills out a form or chats with you, they can choose to share their personal details. We never identify anonymous individuals.

Is VisitorCompanyFinder GDPR compliant?

We provide tools to help you comply, such as strict mode and data-subject request handling. However, you are the data controller. You must write your own privacy notice and ensure your overall process meets GDPR requirements.

How do I handle data-subject requests?

You can manage access, withdrawal, and erasure requests directly in the app. You can also use our API to automate these actions. When a visitor withdraws consent, we stop processing their data.

Start free — 3 months on us

No card needed. Questions? Ask our assistant (bottom right).