A Swedish hosting provider — 11 requests, 2 domains. Simple Analytics, cookieless and without PII — the policy explicitly confirms: no data is collected, stored, or transmitted. BunnyCDN's node is in Finland. The policy is exemplary in structure.
Timeline of the leak
Declared versus actual
Detected trackers
- Simple Analytics (scripts.simpleanalyticscdn.com)
Context
statichost.eu is a Swedish static hosting provider, operated by Variable Object Assignment (Stockholm, Sweden). It hosts static sites on European infrastructure. The HAR was recorded on the privacy policy page. 11 requests, 2 domains.
Simple Analytics — privacy-first, cookieless
scripts.simpleanalyticscdn.com/latest.js (+47 ms) — Simple Analytics, a Dutch analytics platform positioning itself as a GDPR-compliant alternative to Google Analytics. Key characteristics: it sets no cookies, collects no IP addresses, doesn’t use fingerprinting, and doesn’t transmit data to third parties. It counts only aggregated pageviews.
Statichost.eu’s policy explicitly confirms: “we collect anonymous website usage statistics. This is done without processing any personal data.” A consent banner isn’t needed when the data is genuinely anonymous and cookies aren’t used — this is consistent with the EDPB’s position on anonymous data.
BunnyCDN — a European CDN
server: BunnyCDN-FI1-1208 — BunnyCDN, a Slovenian CDN provider, node FI1 (Finland). Visitor data is processed on European infrastructure. Neither Cloudflare (US) nor Fastly (US).
The policy — exemplary in structure
Statichost.eu’s privacy policy is structured by usage scenario: site visitor, hosting user, customer. For each scenario: purpose, legal basis, retention period, processors, recipients, third-country transfers, cookies. “None” is explicitly stated for each item with respect to site visitors. This is exactly the format GDPR Art. 13 recommends.
The one omission: Simple Analytics is mentioned only indirectly (“anonymous statistics”), without naming the provider or linking to its policy — though given the absence of PII, this is a minor note.
Conclusion
statichost.eu is one of the most thoughtfully built examples in the series: Simple Analytics instead of Google Analytics, BunnyCDN instead of Cloudflare, a policy structured per GDPR Art. 13. The absence of a consent banner is justified — Simple Analytics doesn’t process personal data.