Stormly vs Tinylytics

Compare Stormly and Tinylytics on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Google Analytics

Stormly

Netherlands· Web Analytics

Needs review

Shortlist Stormly when you need Dutch-contracted, e-commerce-first product analytics: SKU-aware report packs, Shopify/Adobe-oriented setup, inbox-style AI anomaly narratives, and a public DPA. Skip when you need cookieless privacy web stats only (consider Plausible, Simple Analytics, or Pirsch), open-source self-hosting, verified ISO/SOC on a public cert page, or a subprocessor chain free of US-group cloud and Azure OpenAI.

E-commerce product analyticsSKU-aware reportsAI anomaly insightsShopify / Adobe CommerceNL entity + public DPASaaS (not self-host)

View listing Visit Website

Tinylytics

United Kingdom· Web Analytics

Needs review

Shortlist Tinylytics when you want cookieless page analytics plus bundled uptime/SSL/content checks for a handful of small sites, with primary data on Hetzner in Germany and founder support. Skip when you need self-host/open source, formal ISO/SOC packs, or enterprise multi-tenant governance—consider Plausible Analytics or Simple Analytics instead.

Cookieless analyticsPrimary host: Hetzner DEUptime + SSL monitoringBroken-link crawlsSaaS only (no self-host)Solo-founder UK

View listing Visit Website

Highlighted rows differ between the two products.

Stormly vs Tinylytics: Snapshot
Feature	Stormly	Tinylytics
Country of origin	Netherlands	United Kingdom
Category	Web Analytics	Web Analytics
Open source	No	No
Self-hosted	No	No
Headquarters	Netherlands	United Kingdom
Legal entity	Monon B.V. (Lutmastraat 1-3, 1072 JL Amsterdam; KvK 76248747 per Terms)	Vincent Ritter Consulting (service brand; terms state not separately incorporated yet)
Governing law	Netherlands (Dutch law; Amsterdam courts)	Not clearly stated as a single governing-law clause on the public terms page; confirm contractually
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Medium
Hosting / residency	Client analytics subprocessors (Security Architecture): Hetzner (EU); Amazon AWS (US company, vendor states EU regions only for encrypted analytics backups); Vultr (US company); Microsoft Azure OpenAI (US company, vendor states EU Azure region). Plans market EU data residency. Controller privacy policy also references Vultr/AWS for account data, AuthSMTP EU + Amazon SES USA for email, Stripe for payments; marketing site uses Google Analytics and Hotjar.	Primary analytics storage: Hetzner Falkenstein (Germany). CDN/security: Cloudflare. Error monitoring: Sentry.io. Payments: Paddle and Lemon Squeezy (Stripe company). Optional: IPinfo geo fallback for API hits; opt-in AI Insights via xAI and Google Gemini. No public backup-provider detail beyond that stack.
Summary	Dutch SaaS product analytics for e-commerce teams: SKU-aware reports, AI-assisted anomaly and root-cause insights, and Shopify/Adobe Commerce/Segment/GTM-oriented connections under Monon B.V. (Amsterdam).	Privacy-first cookieless web analytics for small sites, with bundled uptime/SSL checks, content monitoring, events, and founder support—hosted primarily on Hetzner in Germany.
Tags	analytics gdpr e-commerce product-analytics ai shopify	analytics gdpr privacy cookie-free uptime-monitoring indie api

At a glance: Stormly vs Tinylytics
At a glance	Stormly	Tinylytics
HQ / entity	Monon B.V., Amsterdam, Netherlands	Not listed
Category	E-commerce product analytics (SaaS)	Not listed
Hosting (public)	Hetzner; AWS EU-region backups; Vultr; Azure OpenAI EU region (vendor docs)	Not listed
Open source	No	Not listed
Self-host	No	Not listed
Commercial model	Free tier + monthly plan + custom; trial path on paid	Paid site-count plans; short trial; no permanent free tier
Governing law	Dutch law; Amsterdam courts	Not listed
HQ / operator	Not listed	Vincent Ritter Consulting, United Kingdom
Launched	Not listed	12 June 2023 (live counters on homepage)
Primary hosting	Not listed	Hetzner, Falkenstein, Germany
Deployment	Not listed	Managed SaaS only (not open source, not self-hosted)
Differentiators	Not listed	Analytics + uptime/SSL/content monitoring + widgets

Key capabilities: Stormly vs Tinylytics
Key capabilities	Stormly	Tinylytics
E-commerce product analytics	Yes	Not listed
SKU-aware reports	Yes	Not listed
AI anomaly insights	Yes	Not listed
Shopify / Adobe Commerce	Yes	Not listed
NL entity + public DPA	Yes	Not listed
SaaS (not self-host)	Yes	Yes
Cookieless analytics	Not listed	Yes
Primary host: Hetzner DE	Not listed	Yes
Uptime + SSL monitoring	Not listed	Yes
Broken-link crawls	Not listed	Yes
Solo-founder UK	Not listed	Yes

Stormly

AI agent for trends, anomalies, and root-cause style digs
Stormly positions an AI agent that watches connected e-commerce data for trends and anomalies (for example conversion drops or product spikes), then delivers plain-language findings—often to the inbox—with root-cause style exploration for questions like mobile conversion drops or regional return spikes. AI assistant access is plan-dependent; the public DPA documents Azure OpenAI (Microsoft) handling of assistant queries with a 30-day retention window and property stripping rules. Best for merchandising and growth leads who want narrative answers without waiting on a data team.
SKU-aware e-commerce report library (plus custom builds)
Ready reports target commerce questions: New Arrivals Performance (early SKU winners/laggards), Unviewed & Unsold Products, cart abandonment and revenue contribution by product/category, Conversion Journey and funnels by device/region, A/B test insights, Aha Moment Discovery, cross-selling analysis, and broader library items (retention, CLV, forecasting, SQL report, and more). Vendor materials state custom reports are included without a separate fee when a needed view is missing—useful for mid-market retailers that outgrow generic event charts.
Shopify, Adobe Commerce, Segment, and GTM-oriented connections
Homepage setup emphasizes linking Shopify, Adobe Commerce, or Segment quickly, with Google Tag Manager also listed among integrations. The DPA describes additional programmatic paths (JS library, import, custom endpoints, third-party sources). Fits stores already on common commerce stacks; teams on exotic storefronts should validate event coverage and product-feed depth in a pilot before replacing an existing analytics stack.
End-user tracking with IP anonymization defaults
Per the DPA, IP addresses for end-user analytics are not stored in full: the last octet is removed and geo/timezone are derived from the anonymized value. Web integrations automatically capture first-party cookie user ids, page/referrer/UTM context, and device metadata; app properties depend on client or CDP configuration. This is still full product analytics (not cookieless aggregate-only web stats)—clients remain responsible for consent banners and lawful basis for shopper tracking.
Public DPA, security architecture, and Dutch contracting
B2B buyers can download a Data Processing Agreement (effective 2023-09-06) and a Security Architecture page listing subprocessors, encryption expectations, backup retention (analytics backups up to six months), and logical tenant isolation. Contracts and DPA are governed by Dutch law with Amsterdam courts. Useful for EU procurement packages—but US-group subprocessors (AWS, Vultr, Azure OpenAI) still require transfer and CLOUD Act diligence.

Tinylytics

Cookie-free unique hits with rotating salts
Page views and unique hits without tracking cookies or fingerprinting. Uniques combine truncated request signals with a 12-hour rotating salt and one-way hash, reset daily at midnight UTC; visitor IPs are not stored in hits. Suited to indie sites that want trendable uniques without consent banners for analytics cookies.
Thunder Clap uptime, SSL, and domain alerts
In-house multi-region health checks (default every 10 minutes) confirm downtime before emailing, plus SSL expiry notices and domain monitoring. Ultra can shorten intervals. Replaces a separate uptime tool for small fleets—but false downs can occur if WAFs block the Tinylytics monitor user-agent.
Daily content crawl for broken links and mixed content
Subscribed sites can crawl up to 50 pages (two levels deep) on a daily cadence, flagging broken links and mixed HTTP assets on HTTPS pages, with ignore lists and re-check. Ultra adds optional AI spell-check on visible copy—keep it off if AI subprocessors are out of policy.
Attribute-based event tracking (beta)
Enable events on the embed script and mark elements with data-tinylytics-event using category.action names (optional values for downloads). No GTM required; beacon mode helps navigations. Still beta—expect API/schema changes and incomplete capture under aggressive blockers.
Public stats, kudos, hit counters, API, and webhooks
Share passcode-protected public stats, embed hit counters and kudos buttons, export CSV, call the documented API, and push signed webhooks for visits, events, and monitoring. Built for transparent blogs and light automation rather than enterprise BI warehouses.

Assurance & compliance: Stormly vs Tinylytics
Assurance & compliance	Stormly	Tinylytics
Independent security / no-logs audit	Not found Security Architecture describes encryption, monitoring, isolation, and vulnerability contact (security@stormly.com); no public third-party audit PDF found.	Not found No public third-party security or no-logs audit report found on official docs.
ISO 27001	Not found No public ISO 27001 certificate located on official legal/security pages reviewed.	Not found No ISO 27001 claim found on privacy, compliance, or hosting pages.
SOC 2 / SOC 3	Not found No public SOC 2/3 report located on official pages reviewed.	Not found No SOC 2/3 report or claim found on public site.
GDPR / EU data protection	Vendor claimed NL entity; public privacy policy and DPA (GDPR-oriented); IP last-octet anonymization for end-user analytics; SCCs language for restricted transfers in DPA.	Vendor claimed Vendor documents GDPR-oriented design (cookieless, data minimisation, EU primary host, deletion). Not independent certification.
US CLOUD Act exposure (indicative)	Partial EU entity / no known US parent, but public client subprocessors include AWS, Vultr, and Microsoft Azure OpenAI (US-group companies). Account path historically also lists Amazon SES and Stripe. Residency claims do not remove US-group legal exposure. Indicative only—not legal advice.	Partial UK operator, no known US parent, primary host Hetzner DE; partial exposure via Cloudflare, Sentry, Lemon Squeezy/Paddle, optional IPinfo and opt-in US AI APIs. Not legal advice.
Data processing agreement (B2B)	Vendor claimed Downloadable DPA PDF linked from stormly.com/dpa (effective 6 September 2023); audit rights and subprocessor notice described; Security Architecture lists subprocessors.	Not found No public DPA/downloadable processor agreement found; ask the vendor before B2B rollout.
EU AI Act	Partial Product includes an AI assistant via Azure OpenAI; not positioned as a high-risk AI system marketing claim. Buyers should map AI assistant use to their own AI Act / internal AI policy—vendor does not publish a full AI Act conformity package on the pages reviewed.	Not applicable Core product is analytics/monitoring; optional AI insights are secondary and opt-in.

Considerations & known limitations: Stormly vs Tinylytics
Considerations & known limitations	Stormly	Tinylytics
US-group cloud and AI subprocessors	Medium Despite Dutch HQ and EU residency marketing, client data paths publicly include AWS, Vultr, and Microsoft Azure OpenAI. Transfer tooling (SCCs) and encryption of backups are documented, but CLOUD Act / US legal process risk remains a diligence item for sovereignty-sensitive buyers.	Not listed
No public ISO/SOC or independent audit	Medium Enterprise security questionnaires may stall without ISO 27001/SOC 2 packs. DPA offers information/audit rights—plan time for NDA evidence requests.	Not listed
Azure OpenAI retains assistant context 30 days	Medium AI queries and aggregate report results are stored on Microsoft Azure OpenAI for 30 days per DPA. Property stripping reduces some identifiers, but misconfigured event properties could still expose sensitive content—govern AI use and property hygiene.	Not listed
Controller privacy policy vs security architecture drift	Low Privacy policy (controller, effective 2019) still emphasizes Vultr USA wording in places, while Security Architecture (client data) lists Hetzner/AWS/Vultr/Azure. Ask for a single current subprocessor and region matrix at contract time.	Not listed
Not a privacy web-analytics substitute	Low Full product analytics with cookies/identifiers for web integrations—not a cookieless aggregate counter. Consent UX remains on the client.	Not listed
US-group subprocessors on the data path	Not listed	Medium Cloudflare, Sentry, payment processors (incl. Lemon Squeezy/Stripe group), optional IPinfo and opt-in xAI/Gemini mean the stack is not EU-only end-to-end despite Hetzner primary storage.
Solo-founder operational concentration	Not listed	Medium Service is provided by Vincent Ritter Consulting / a solo developer. Support is personal and fast for indies, but bus-factor and formal SLA expectations differ from larger vendors.
No public ISO/SOC/audit or DPA pack	Not listed	Medium Enterprise security questionnaires will hit gaps until the vendor supplies audits and a B2B DPA under NDA or email.
Scale and feature boundaries	Not listed	Low Content crawls are depth/page limited; event tracking is beta; fair-usage applies to extreme hit volumes; no self-host escape hatch.
Optional AI shares aggregated analytics	Not listed	Low AI Insights and related AI spell-check are opt-in and send aggregated (not visitor PII per vendor) data to third-party AI providers—leave disabled under strict AI policies.

Fit

Stormly

Best fit when

Merchandising, product, UX, and growth teams on Shopify or Adobe Commerce who need SKU, cart, and assortment analytics without a dedicated data science org
Retail brands that want ready e-commerce report templates (new arrivals, unviewed/unsold, funnels, A/B, aha moments) plus vendor-built custom reports
EU buyers who want a Dutch legal entity, Amsterdam courts, and a downloadable DPA/Security Architecture package
Teams that value AI-generated trend/anomaly narratives delivered to the inbox more than building every chart from a blank event schema
Stacks already using Segment or Google Tag Manager as the event pipe into analytics

Poor fit when

Publishers or marketing sites that only need lightweight privacy-friendly page analytics (not product/SKU depth)
Orgs that require open-source self-hosting or full control of a private analytics warehouse as the default
Procurement policies that forbid US-group subprocessors (AWS, Vultr, Microsoft Azure OpenAI) even when EU regions are claimed
Assurance programs that require public ISO 27001/SOC 2 evidence before pilot (not found on vendor pages reviewed)
Companies operating blockchain products/services—restricted by Stormly’s terms

Consider instead when

When: You only need privacy-oriented website metrics (pageviews, sources) rather than SKU-level product analytics
Consider: Plausible Analytics, Simple Analytics, or Pirsch Analytics
EU web-analytics peers; different category from e-commerce product analytics
When: You need deep general-purpose product analytics, large ecosystem, and mature multi-product SaaS event modeling
Consider: Mixpanel or Amplitude
US incumbents; stronger breadth, different jurisdiction and commercial model
When: You primarily need free/universal marketing acquisition reporting already embedded in the stack
Consider: Google Analytics (incumbent) or dual-run GA for marketing + Stormly for product/merch
GA is not SKU-first product analytics; Stormly is not a GA replacement for every report

Tinylytics

Best fit when

Indie blogs, portfolios, and side projects that want simple cookieless stats without Google Analytics
Small sites that also want uptime, SSL expiry, and broken-link checks in the same tool
Operators who prefer founder-answered support and lightweight embeds over enterprise marketing stacks
Teams OK with managed EU primary hosting and willing to review named US-group subprocessors (CDN, payments, optional AI)
Agencies managing a modest number of client sites with public stats or kudos-style engagement widgets

Poor fit when

Orgs that require self-hosted collectors or open-source audit of the full analytics stack
Procurement needing published ISO 27001, SOC 2, independent audits, or a downloadable DPA out of the box
Very high-traffic properties needing contractual capacity/SLA commitments beyond fair-usage conversation
Policies that ban Cloudflare/Sentry/US payment or optional US AI APIs on any data path
Teams that need session replay, heatmaps, or deep advertising attribution (Clarity/GA territory)

Consider instead when

When: You need open-source and optional self-hosting of the analytics stack
Consider: Plausible Analytics
Estonian product with Cloud plus Community Edition self-host; less bundling of uptime/content monitors.
When: You want European cookieless analytics with a simpler analytics-only scope
Consider: Simple Analytics
Strong privacy positioning; compare feature depth and monitoring separately.
When: You need free-at-scale marketing analytics, ads integrations, or attribution depth
Consider: Google Analytics (incumbent) — or stay on a privacy tool if GA is disallowed
Different privacy and sovereignty profile entirely.
When: You need session replay or heatmaps and accept that privacy model
Consider: Microsoft Clarity or specialised replay tools
Tinylytics deliberately avoids fingerprinting-style session products.

Open questions for due diligence

Stormly

Can Stormly provide a current region map (which data classes live on Hetzner vs Vultr vs AWS) under NDA for our DPIA?
Are ISO 27001, SOC 2, or penetration-test summaries available on request for enterprise security review?
Which event properties from our Shopify/Adobe feed are excluded from Azure OpenAI prompts by default in our tenant?
Do custom report builds and SQL access sit only on the custom tier, and what SLAs apply?
Has the 2019 controller privacy policy been superseded for hosting wording relative to the Security Architecture list?

Tinylytics

Will Vincent Ritter Consulting sign a GDPR Article 28 DPA and provide a current subprocessor list under contract?
Are backups/DR and email delivery fully covered by the named providers, or are there additional hosts?
Is there any roadmap for independent security review, SOC 2, or ISO 27001?
What contractual terms apply for accounts consistently above the fair-usage hit threshold?
For AI Insights: exact retention, regions, and processor terms at xAI and Google for the paid API plans used?