Matomo is a self-hostable, GPLv3-licensed web analytics platform originally created by Matthieu Aubry in 2007 as an open-source alternative to Google Analytics, now developed and operated by InnoCraft Limited, a New Zealand-registered company (NZBN 6106769) offering both Matomo On-Premise (self-hosted) and Matomo Cloud (InnoCraft-hosted). InnoCraft's own marketing page states that customer analytics data is never used by Matomo/InnoCraft for its own purposes and that Matomo supports first-party cookies by default, IP anonymization, and has been approved by France's CNIL as one of a select few analytics tools usable without visitor tracking consent. Its combined privacy policy discloses that even the self-hosted On-Premise product phones home certain licensing metadata (hosting server IP, installed version, PHP/MySQL versions, number of tracked websites) for billing and support purposes, and mentions an unnamed 'bug bounty programme' among its security measures. No named-firm audit, breach disclosure, or regulator action was found in this research.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
7 ON FILE
COLLECTION
InnoCraft's privacy policy states that even when a customer downloads and self-hosts Matomo On-Premise, InnoCraft collects and stores license-related metadata — the IP address of the hosting server, installed Matomo version, PHP/MySQL versions, database version, time zone, number of websites tracked and number of licensed users — for licensing, billing and customer support, not for analyzing the self-hosted instance's visitor data.
InnoCraft's privacy policy identifies the operating entity as InnoCraft Limited, a New Zealand registered company with NZBN 6106769, established by the creators of Matomo Analytics, with a registered office in Wellington, New Zealand.
Matomo's own team page names Matthieu Aubry as the person who formed Matomo in 2007 as an open-source alternative to Google Analytics, motivated by questions about where visitor data was stored and who owned it.
Matomo's source code is published on GitHub under the GNU General Public License, Version 3, a verifiable open-source (copyleft) license file included in the repository.
The same page states as a core product commitment that Matomo will never use a customer's collected analytics data for InnoCraft's own purposes or any purpose other than serving that customer, contrasting this with Google Analytics' use of data for 'own purpose uses'; it also states Matomo Cloud data is stored in Europe with no transfer to the US, while On-Premise customers choose their own hosting country.
InnoCraft's privacy policy lists 'bug bounty programme' among the security measures it applies to protect personal data, alongside secure cloud infrastructure, access controls, encryption in-transit and at-rest, and security risk monitoring; no bounty platform, published scope, or payout history was found in this research to corroborate the program's scale.
InnoCraft's own GDPR marketing page states Matomo uses first-party cookies by default and offers IP anonymization, and that Matomo has been approved by France's CNIL data protection authority as one of the select few web analytics tools that can be used to collect data without requiring visitor tracking consent.