Does it write anything to the database as soon as it is installed?
No. Session capture works straight away, but visit logging and lead attribution ship turned off.
Does it use cookies?
It creates no cookies of its own. It reuses the Joomla session and, if you configure it, reads your banner cookie so that it logs only visitors who accepted.
What happens to visits after 90 days?
The daily purge adds them to anonymous monthly counters and deletes the detail. The period is a setting.
Can I read the data from outside the admin panel?
Yes. There is a read-only REST API and tools for evoMCP. None of them returns the full IP.
Which legal basis do I need?
Each installation decides that with its own adviser. The documentation describes which data is processed and for how long, without taking a position on the legal basis.