The library records what it needs to run the service: your account details, what you borrowed and returned, and figures on which resources are used.
When you use the portal, a first-party visit cookie holds a random visit number for 30 minutes, so that one visit is counted once. It identifies the visit, not you. Your browser's user agent is read to tell the type of device (computer, phone or tablet), the browser family and the operating system; only those three are kept with usage records. Your network (IP) address is used to look up an approximate location — the country, and the region and city unless the library keeps less — and the address itself is not kept with usage records. A visit also records the site you came from (its address, never the page) and any campaign tags in the link you followed. To count how many different people visit in a day, a code is made from your address and browser with a key that is replaced every day and then discarded, so the code cannot be traced back to you afterwards.
When you are signed in, your searches, the resources you open or download, your portal visits and your sign-ins are linked to your account, together with your role, department, faculty and type of membership at the time. After the institution's retention period (30 days unless the library has set another) that link is removed: the record keeps its date, device, place and group, and no longer points to you or to your visit.
Your gender is recorded only while the institution has chosen to collect it. It is taken from your own profile, from the service you sign in with, or from the institution's member records, and is kept with your account for the library's usage reports. While collection is switched off, no gender is recorded.
One record is kept longer, on purpose. So that the library can count its active readers exactly over a year, it keeps a record of the days you were active — with your group, the resources you opened and how you signed in — for 400 days, just over a year, and then deletes it.
Security records — sign-ins, failed sign-in attempts and changes made by staff — keep the network (IP) address and the browser they came from, so that misuse of an account can be investigated. They are kept for the period set in the institution's agreement and then deleted.
Usage figures shared with publishers are counts, never lists of readers. Some reports do name individual readers. The list of accounts with their roles and last sign-in, and the results of updates from the directory, can be seen by library staff who may see the library's reports. Three reports go further: a ranking of the most active readers, a list of accounts with no recent activity, and a report on one reader's use of the portal. Only library staff whose role allows them to see member accounts, and the operators of the platform that runs the portal, can see those three, and each time a report on one reader is opened, an activity log records who opened it.