Everything about Creo Analytics — from integration to data protection.

Creo Analytics measures how your website is used — page views, visitors, sources, countries, devices, heatmaps and more — without cookies and without a cookie banner. The first numbers are in place in three steps:

1. Create an account (self-registration with an e-mail code) or sign in via SSO as an existing hosting customer.
2. Add the website and embed the script line — sites hosted with us receive it automatically.
3. A few minutes after the first page view the numbers appear in the overview.

An onboarding checklist at the bottom left accompanies the setup (create website, embed snippet, first goal, report) and ticks off completed items — you land on the platform immediately, even if details are still missing.

One line before the closing </head> tag is enough. The measurement ID (data-creo) and the matching snippets are ready to copy in the Settings of the website — depending on the operating mode and the hosting, up to four variants to copy.

<!-- Cookieless (default) -->
<script defer data-creo="YOUR-ID"
        src="https://analytics.creodigital.de/m.js"></script>

The script is about 2 KB in size and does not slow the page down (defer). Three scripts are delivered: m.js (cookieless), v.js (full, with a consent interface) and r.js (recorder, loaded by v.js only after consent has been given).

Hosted with us? Then the measurement is embedded automatically via your own domain (first-party) — no ad blocker interferes, and you do not have to set anything up. A cache marker (?m=c or ?m=v) makes sure that a change of operating mode immediately delivers the right script.

The licence applies per website — different websites in one account may be set differently.

Which mode does what?

Dual tag with & without cookies

A website may carry both tags at the same time: the cookieless tag (m.js) on most pages, the cookie tag (v.js) only on pages with a consent banner — one tag per page, not both on the same page. The mode then depends on the individual beacon, the cookie capability on the website. That way you measure the bulk of your site without a banner and enable replay/recognition only where consent is obtained.

You enable "full" mode for the website in its Settings behind a deliberate gate: three confirmations (cookie banner in place, privacy policy amended, responsibility understood) and the domain to type out. The step is logged. After that the dashboard offers the v.js snippet.

The way back (downgrade to cookieless) is possible at any time and it cleans up: it discards the consent pseudonyms and deletes all session recordings of this website. The plain daily aggregates are retained.

In “full” mode your cookie banner controls consent through the global creo.push interface. Creo never sets a cookie by itself — only your opt-in click does that.

window.creo = window.creo || [];
creo.push(['einwilligung']);  // → v.js sets _creo_id + starts the recorder
creo.push(['widerruf']);      // → cookie removed, recordings deleted, back to cookieless
creo.push(['einwilligung', 'abgelehnt']);  // = rejection: acts like a withdrawal, NEVER grants consent

Under DNT/GPC the script measures nothing — creo.push(['widerruf']) still works there, and an existing consent cookie counts as withdrawn. A withdrawal counts as a right: it fails at no filter (rate limit, bot detection, blocked account).

From when may the cookie be set? Only after active consent — never before. The first-party cookie _creo_id (32 characters, 180 days, SameSite=Lax) is at the same time the proof of consent; its presence controls whether v.js sends the identifier along.

Ready-made banner template to copy

Insert before </body>. It sets nothing itself — it only calls creo.push:

<div id="creo-consent" hidden role="dialog" aria-label="Analytics consent">
  <p>We measure anonymously and without cookies. With your consent we recognise returning visits (first-party cookie) and record sessions in masked form. Revocable at any time.</p>
  <div class="creo-consent__row">
    <button type="button" id="creo-decline">Anonymous only</button>
    <button type="button" id="creo-accept">Consent</button>
  </div>
</div>
<style>
  #creo-consent{position:fixed;left:1rem;right:1rem;bottom:1rem;max-width:420px;
    margin-inline:auto;background:#fff;color:#1a1a1f;border:1px solid #e2e0da;
    border-radius:14px;padding:16px 18px;box-shadow:0 12px 40px rgba(0,0,0,.16);
    font:14px/1.5 system-ui,sans-serif;z-index:9999}
  #creo-consent p{margin:0 0 12px}
  .creo-consent__row{display:flex;gap:8px;justify-content:flex-end}
  .creo-consent__row button{border-radius:9px;padding:8px 14px;font-weight:600;
    cursor:pointer;border:1px solid #e2e0da;background:#f4f2ee;color:#1a1a1f}
  #creo-accept{background:#2855db;border-color:#2855db;color:#fff}
</style>
<script>
(function () {
  var KEY = 'creo_consent';
  window.creo = window.creo || [];            // queue: no matter whether v.js is loaded yet
  var box = document.getElementById('creo-consent');
  var wahl = null; try { wahl = localStorage.getItem(KEY); } catch (e) {}
  if (wahl === 'yes') { creo.push(['einwilligung']); }   // carry over an earlier consent
  else if (wahl !== 'no') { box.hidden = false; }        // no decision yet → ask
  function merken(w){ try { localStorage.setItem(KEY, w); } catch(e){} }
  document.getElementById('creo-accept').onclick = function () {
    creo.push(['einwilligung']); merken('yes'); box.hidden = true;
  };
  document.getElementById('creo-decline').onclick = function () {
    merken('no'); box.hidden = true;           // stays cookieless — measurement keeps running
  };
  window.creoWiderruf = function () { creo.push(['widerruf']); merken('no'); };
})();
</script>

Withdrawal link in the footer: <a href="#" onclick="creoWiderruf();return false">Withdraw consent</a>. The withdrawal immediately deletes the cookie and every server-side recording of that person.

Every website has its own tabs. The most important ones:

Overview with & without cookies

Page views, visitors, sessions, bounce rate and Ø time on page — each with a trend against the comparison period, plus the trend curve, the realtime tile (last 30 minutes) as well as the most-visited pages and sources. The date range can be chosen freely (1–730 days), the comparison is either the previous period or the previous year.

Pages & Sources with & without cookies

Pages shows the most-visited paths including entries and exits. Sources shows where the visitors come from — referrers and UTM campaigns; “Direct” are visits without a referrer (bookmark, address bar).

Audience & Tech with & without cookies

Audience breaks the figures down by country of origin (derived from the IP at the moment of the request — the address itself is not stored), device class, browser and operating system. Tech shows Core Web Vitals (load time, interactivity, layout stability) for sites hosted with us.

New vs. returning visitors full mode only

How many visitors are here for the first time and how many come back — this requires cross-day recognition and is therefore only available in “full” mode after consent. In cookieless mode this distinction deliberately does not exist.

The click map shows what people click on, the scroll depth, how far people read — per page and device class. Both are pure aggregates (cells and 10% steps respectively), not a reconstruction of individual people. A page selector lists the most active pages.

Session replay records real sessions as a masked DOM film — no video, no media file, but a compact recording of structure, layout and interaction (cursor, scroll, clicks, input). In the player (tab Recordings) you can scrub, pause and vary the playback speed; playback runs in an isolated sandbox.

• Masking is the default: all text, all input and all attributes (URLs sanitised, free text/data-/aria masked) are replaced — only the structure remains. Password fields and recognisably sensitive fields are never captured. Only an element marked with data-creo-unmask shows real text.
• Mobile/touch is captured (viewport, touch movement).
• Fixed retention of 30 days, then automatic deletion (file overwritten and removed).
• Revocation and cancellation/downgrade delete the recordings immediately.
• No IP address, no video storage — you do not have to take care of any external video storage.

In every list (countries, devices, browsers, operating systems, sources, pages), a click on an entry removes it from the view: the row is greyed out, and the remaining bars or the ring are recalculated. Another click brings it back; “show all” resets the view.

This is purely a view filter — handy, e. g. to hide your own country and see the rest more clearly. Nothing is deleted; your browser remembers the selection per website and dimension. In the Overview, hiding a source even recalculates key figures, the trend chart and the page list live (from the raw data, therefore only as far back as the raw data reaches).

For permanent exclusion (for everyone, already at measurement time) there are the exclusion rules.

Custom actions — a click, a completed form, a download — are reported via the global creo.push interface. This works cookieless: with & without cookies

// Trigger a goal (e.g. after a form has been submitted)
creo.push(['ziel', 'newsletter']);

// An event with properties
creo.push(['ereignis', 'download', { datei: 'preisliste.pdf' }]);

A goal can be assigned a monetary value (e.g. 49 € per conversion), so that the analysis shows a revenue contribution. Properties are limited to flat values (max. 20 keys) — do not store anything personal there. For campaigns, append UTM parameters to your links (?utm_source=…&utm_medium=…&utm_campaign=…); they appear under Sources.

Funnels measure how many visitors run through a sequence of steps (e. g. home page → form → completion) and where they drop off — 2 to 8 steps per funnel. Because the order matters here, the funnel is computed from the raw events and therefore only reaches back as far as their retention.

Segments break every metric down by a dimension (country, device, source, page …) and compare time ranges. Both run cookieless. with & without cookies

Creo Analytics generates PDF reports with key figures, a trend curve, top lists, a heatmap summary (most active pages by clicks) and — in “full” mode — the replay averages (count, Ø duration, Ø interactions).

• Automatic delivery in four cadences: weekly (Mondays), monthly (on the 1st), quarterly (1 Jan/Apr/Jul/Oct) or annually (1 January) — to any recipients you like.
• Instant download in the Reports tab: weekly, monthly, quarterly and annual report as a PDF, independently of the scheduled delivery.
• Multilingual (de/en/es) following the organisation's language; the e-mail carries a short HTML summary, the PDF the full report.
• Contains aggregates only, no personal data — safe to pass on. The methodology footnote adapts to the mode; the mandatory attribution “IP Geolocation by DB-IP” appears on every last page.

To keep your numbers clean, you exclude certain traffic in the settings permanently — by four criteria: IP address (your own office IP; exact, IPv4 range or prefix), referrer domain (referral spam), path (internal test pages) and User-Agent (additional bots).

These rules take effect already at measurement time (the event is not counted in the first place) and apply to everyone — unlike the view filter. A built-in bot detection keeps known crawlers out in any case; an effectiveness check shows how many hits the rules had most recently.

Several people share one account (one organisation). There are three role templates — Admin, Account Manager and Read only — plus granular individual permissions (read, write, billing, members, create/delete websites, settings).

You invite members by e-mail under Organisation; they receive a start password and replace it at their first sign-in. Existing hosting customers sign in via SSO. The organisation language (de/en/es) controls the interface and the language of the reports.

Registration: with an email address and a confirmation code (PIN) sent by email as the first step, followed by acceptance of the terms and conditions (recorded as proof). Existing hosting customers use SSO.

• 7-day trial per website, no payment details — it measures and shows figures right away.
• Activation via Stripe; a customer portal manages the subscription and the payment method. After expiry or non-payment a paywall takes effect (the figures stay untouched, they are merely hidden).
• Licence per website: Basis 10 €/month (cookieless), Pro 25 €/month (full).
• During the free beta bookings are active immediately; the website limit is 5 per account.

In the danger zone of the account settings, account admins delete things themselves:

• The entire account — the organisation including all websites, measurement data, recordings, subscriptions and memberships — confirmed by typing out the account name.
• Individual websites — confirmed by typing out the domain. The measurement file is overwritten and removed, snippet/proxy are dismantled.

This covers the commitment given in the terms and conditions and the GDPR right to erasure — no support ticket required.

• No IP storage. The IP address is used only transiently in memory for counting and country assignment — never on disk.
• Legal basis: cookieless without consent (nothing is stored on or read from the device → §25 TDDDG does not apply; processing based on legitimate interest, Art. 6 (1) f). Cookie/replay only with consent (§25 TDDDG + Art. 6 (1) a).
• Two hash spaces that cannot be linked: the cookieless daily hash and the consent-based k-pseudonym are deliberately not linkable; no cross-site profile.
• Retention: raw events 14 days (configurable up to 30), daily aggregates 26 months, session recordings fixed at 30 days, consent cookie 180 days.
• DNT & GPC are honoured server-side.
• Server location Germany (IT Systeme Flores UG), no third-country transfer, no sharing with advertising networks.
• Documents included (drafts): data processing agreement, DPIA template and a privacy-policy text block for "full" — as PDFs in the Documents area.

Publicly accessible without login is the objection page (de/en/es), which explains to visitors what happens — and what does not.