Trackboxx
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
German sole-proprietor cookieless analytics, B2B-only, with daily-rotating anonymisation and BunnyCDN script delivery.
Trackboxx is a European service hosted in Germany, with at most minor, transient US exposure under the CLOUD Act. It is listed under Web analytics.
Assessment notes
German sole-proprietor analytics product (Christian Pust, Halberstadt) with cookieless tracking, daily-rotating anonymisation, and named sub-processors disclosed in the privacy policy. A publicly downloadable AVV is published and its Anlage 3 names the hosting sub-processor, TK ENTERPRISES LTD (Cyprus-registered, data centre Frankfurt, Germany) — an EU data centre behind a Cypriot shell rather than a named German provider. The Imprint still omits HRB and USt-IdNr details, and AWS Simple Email Service (US-owned) is used for newsletter email, resulting in minor CLOUD Act exposure.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 3 · 0 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Not assessed
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Trackboxx
Trackboxx is a small German cookieless web analytics product operated by Christian Pust as a sole proprietorship (Humboldtstraße 9, 38820 Halberstadt; branch office at Dorfstr. 12, 22956 Grönwohld). The service is sold strictly business-to-business, the imprint explicitly states that "Unser Service richtet sich ausschließlich an Unternehmer" (our service is directed exclusively at commercial customers). Co-founders Christian and Ulrike split development, strategy, marketing, and social media duties.
The product runs cookieless analytics with rotating daily encryption codes for visitor anonymisation, marketing itself as "100% DSGVO-konform" with the Bitmi (Bundesverband IT-Mittelstand) member badge. The privacy policy is unusually transparent for a small vendor: the named sub-processors are Paddle (UK, payments / merchant of record), Amazon Web Services (Amazon Simple Email Service for newsletter delivery, the only US-owned sub-processor), Userlike (DE, chat), BunnyCDN (SI, script delivery), and TradeTracker (NL, affiliate tracking). The hosting sub-processor is disclosed too, but only inside the AVV: its Anlage 3 names TK ENTERPRISES LTD (Paphos, Cyprus) for the IT and server infrastructure, with the data centre in Frankfurt, Germany. So the analytics database sits in an EU data centre operated for Trackboxx by a Cyprus-registered company rather than by a named German provider, and because the Datenschutz page itself omits that entry, the privacy policy is an incomplete list on its own.
Pricing starts at €5 per month for up to 25,000 page views on a single website, billed monthly, with a 30-day trial that needs no payment details; there is no standalone pricing page any more, so the figure is quoted on the homepage and the full plan ladder sits behind the registration flow. A publicly downloadable AVV is linked and commits, in clause 4c, to performing the service exclusively within an EU member state or EEA contracting state; the imprint still omits a Handelsregister number and USt-IdNr, which is consistent with a sole-proprietor (Einzelunternehmen) structure but unusual for a vendor courting business buyers. Best fit: small German-speaking SMBs and e-commerce shops that want a low-friction Google Analytics replacement and accept a sole-proprietor counter-party. Buyers who need a corporate counter-party and a hosting provider named in the privacy policy itself should compare Pirsch, Plausible or Wide Angle Analytics in this category.
Sub-processor map · 3
-
BunnyWay d.o.o. EUSlovenia
CDN services (BunnyCDN)
-
Paddle.com Market Ltd. non-USUnited Kingdom
Payment processing
-
TK ENTERPRISES LTD EUCyprus
Hosting / IT-server infrastructure (datacenter Frankfurt, Germany)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| BunnyWay d.o.o. | Slovenia | CDN services (BunnyCDN) | EU |
| Paddle.com Market Ltd. | United Kingdom | Payment processing | non-US |
| TK ENTERPRISES LTD | Cyprus | Hosting / IT-server infrastructure (datacenter Frankfurt, Germany) | EU |
Source: the vendor’s published sub-processor list, read 26 Aug 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of Trackboxx
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
IrelandEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: Yes Open source: Yes -
-
New Zealand · €29/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: Yes -
-
Germany · $6/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
GoatCounter
Ireland
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: Yes
Open source: Yes
|
— |
Matomo
New Zealand
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
|
€29/mo |
Pirsch Analytics
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$6/mo |