VisitorStory
Start free
Legal

Acceptable Use Policy

Effective 27 October 2026 · Last updated 27 October 2026

The short version

  • Only record websites you run, and tell your visitors you do it. Ask for consent where the law requires it.
  • Keep form masking on, and hide anything sensitive: health, finances, account pages, children’s data.
  • Never record payment fields or passwords (we hide them anyway; do not work around it).
  • Don’t use VisitorStory to identify, track or profile people across other sites, or on sites made for children.

This policy is part of our Terms of Service. It applies to every customer and every user of VisitorStory. If you breach it we may suspend or end your account, as the Terms describe.

1. Notice and consent

  • Install the VisitorStory script only on websites you own or are authorised to operate.
  • Tell your visitors, in a privacy notice that is easy to find, that you record how they use your website for analytics and improvement, and what you do with the data.
  • Obtain consent before recording where the law requires it (for example in the EU, the UK, and under wiretap and invasion-of-privacy laws such as the California Invasion of Privacy Act). Use our bottom-bar or full-screen consent modes, or your own consent tool connected through the script’s consent API.
  • Honour visitors’ choices, opt-outs and Global Privacy Control signals, and respond to their rights requests.

2. Sensitive information

You must not use VisitorStory to collect, and must hide (with form masking, the data-vs-mask or data-vs-block attributes, or masked selectors in your settings) any part of a page that shows:

  • special categories of personal data, such as health, medical or genetic information, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, sex life or sexual orientation, or biometric data;
  • government identifiers (such as social security, passport or driving licence numbers), precise geolocation, or account credentials;
  • financial account details, payment-card data, bank details or full billing information;
  • the content of private messages, or criminal-record information;
  • personal data of children under 16.

Password fields and fields marked for payment-card details are always hidden by VisitorStory. You must not disable, work around or defeat masking for these fields, or put payment or password inputs in elements that are not recognised as such in order to record them.

3. Prohibited uses

  • Websites or services directed at children under 16.
  • Recording pages behind sign-in that display other people’s personal data (for example administration panels) without hiding that data.
  • Identifying, re-identifying or tracking individual visitors across websites, building profiles for advertising, or selling or sharing visitor data.
  • Using VisitorStory to make decisions with legal or similarly significant effects on individuals, such as credit, employment, housing or insurance decisions.
  • Using recordings to harass, discriminate against, or surveil people, or for any unlawful purpose.
  • Installing the script on websites you do not control, or sending false data to our collection endpoints.
  • Attempting to break, overload, probe or bypass the security of the Service, accessing other customers’ data, or scraping the Service.
  • Reselling or white-labelling the Service without our written agreement.

4. Reporting a problem

If you believe VisitorStory is being used in breach of this policy, email support@visitorstory.com with the website concerned and what you saw.

Contact

[Company legal name], [Registered address]. Email support@visitorstory.com.