VisitorStory
Start free
Legal

Data Processing Addendum

Effective 27 October 2026 · Last updated 27 October 2026

The short version

  • You (the customer) control your visitors’ data; we process it only to provide VisitorStory and only on your instructions.
  • We keep it confidential, protect it with the measures in Annex 2, and use only the subprocessors we list.
  • We tell you without undue delay, and within 48 hours of confirming, if a breach affects your data.
  • We help you answer data subject requests, including with our visitor deletion API, and delete your data when you leave.
  • International transfers use the EU Standard Contractual Clauses and the UK Addendum. We never sell or share your data.

1. Scope and parties

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between the customer (“Customer”) and [Company legal name] (“VisitorStory”). It applies when VisitorStory processes Personal Data on Customer’s behalf in providing the Service, and it takes effect when Customer accepts the Terms. If this DPA conflicts with the Terms, this DPA prevails for the processing of Personal Data.

“Data Protection Laws” means all laws that apply to the processing, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the GDPR as retained in UK law and the UK Data Protection Act 2018 (“UK GDPR”), the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the CPRA (“CCPA”), and other US state consumer privacy laws. “Personal Data”, “controller”, “processor”, “data subject”, “personal data breach” and “processing” have the meanings given in the GDPR; “business”, “service provider”, “sell” and “share” have the meanings given in the CCPA.

2. Roles and instructions

Customer is the controller (or business) and VisitorStory is the processor (or service provider) for Personal Data collected through the VisitorStory script on Customer’s websites. VisitorStory will process that Personal Data only on Customer’s documented instructions, which are the Terms, this DPA, and Customer’s configuration of the Service (for example consent mode, masking, sample rate and retention), unless the law requires otherwise, in which case VisitorStory will inform Customer unless the law prohibits it. VisitorStory will tell Customer if it believes an instruction infringes Data Protection Laws.

Customer is responsible for the lawfulness of the processing it instructs, including having a legal basis, giving visitors notice, and obtaining any consent required before recording.

3. Details of processing (Annex 1)

Subject matter and purposeProviding the Service: recording visitor interactions on Customer’s websites, rebuilding replays, computing analytics, heatmaps, funnels, findings and reports, and supporting Customer.
DurationThe term of the Terms plus the deletion period in section 10.
Data subjectsVisitors to Customer’s websites; Customer’s authorised users.
Categories of dataPage structure and content as displayed (with form fields masked by default), interaction events, device and browser attributes, referrer and page URLs, random visitor, tab and session identifiers, salted hashes of IP addresses, optional derived location, optional Customer-supplied user IDs and traits, consent choices; user account data.
Special categoriesNone intended. Customer must not use the Service to record special category data or other sensitive data (see the Acceptable Use Policy).
FrequencyContinuous, while the script is installed.
RetentionThe retention period of Customer’s plan (7, 30, 90 or 180 days), after which data is deleted automatically.

4. US state law terms

VisitorStory will not: sell or share Personal Data; retain, use or disclose it for any purpose other than the business purposes of providing the Service specified in the Terms; retain, use or disclose it outside the direct business relationship with Customer; or combine it with personal data received from other sources or other customers, except as the CCPA permits for service providers. VisitorStory will comply with the CCPA and provide the same level of privacy protection it requires, will notify Customer if it can no longer meet these obligations, and permits Customer to take reasonable steps to stop and remediate unauthorised use. VisitorStory certifies that it understands these restrictions.

5. Confidentiality

VisitorStory will ensure that everyone it authorises to process Personal Data is bound by confidentiality obligations and has access only as needed to provide the Service.

6. Security

VisitorStory will implement and maintain the technical and organisational measures in Annex 2, which are designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. VisitorStory may update these measures provided it does not reduce the overall level of protection.

7. Subprocessors

Customer gives general authorisation for VisitorStory to engage the subprocessors listed on our Subprocessors page. VisitorStory will impose data protection terms on each subprocessor that are no less protective than this DPA, and remains liable for its subprocessors. VisitorStory will give at least 30 days’ notice of a new subprocessor by updating that page and notifying Customer by email; Customer may object on reasonable data protection grounds within that period, and if the parties cannot resolve the objection, Customer may terminate the affected Service and receive a refund of prepaid fees for the unused period.

8. Data subject requests and assistance

VisitorStory will promptly forward to Customer any request it receives from a data subject about Customer’s Personal Data and will not respond except to direct the person to Customer, unless Customer instructs otherwise. The Service lets Customer delete all data for a visitor ID or Customer-supplied user ID through the visitor deletion API (POST /api/v1/visitors/delete with a site API key), delete an entire site, and choose retention. VisitorStory will provide reasonable further assistance with data subject requests, data protection impact assessments and prior consultations, taking into account the nature of the processing and the information available to it.

9. Personal data breaches

VisitorStory will notify Customer without undue delay, and in any event within 48 hours after confirming a personal data breach affecting Customer’s Personal Data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. VisitorStory will take reasonable steps to contain and remediate the breach and will provide updates as more information becomes available. Notification is not an admission of fault.

10. Deletion and return

During the term, Customer can delete data at any time as described in section 8, and data is deleted automatically at the end of the plan’s retention period. On termination, VisitorStory will delete Customer’s Personal Data within 30 days, unless the law requires it to be kept. Before termination Customer may save its reports. Deleted data may remain in backups for up to 4 weeks until overwritten; backups are protected by this DPA and are not used for any other purpose.

11. Audits

VisitorStory will make available the information reasonably necessary to demonstrate compliance with this DPA, including written answers to reasonable security questionnaires. If that is not sufficient, or a supervisory authority requires it, Customer may audit VisitorStory’s compliance no more than once a year, on at least 30 days’ notice, during business hours, at Customer’s expense, under confidentiality obligations, and in a way that does not compromise other customers’ data or VisitorStory’s security.

12. International transfers

VisitorStory hosts the Service in the United States. Where Personal Data subject to the GDPR is transferred to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (“SCCs”), Module Two (controller to processor), which are incorporated by reference, with: clause 7 (docking) applying; option 2 (general authorisation, 30 days’ notice) in clause 9; the optional language in clause 11 not applying; clauses 17 and 18 governed by the law and courts of Ireland; Annex I completed by section 3 of this DPA; and Annex II completed by Annex 2 below. For transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the SCCs applies; for Swiss transfers, the SCCs apply with references read as references to Swiss law and the Swiss FDPIC. Where a recipient is certified under the EU–US Data Privacy Framework (and its UK and Swiss extensions), that framework may be relied on instead. VisitorStory will resist, to the extent lawful, requests from public authorities for Customer’s Personal Data and will inform Customer of them where the law allows.

13. Liability

Each party’s liability under this DPA is subject to the limitations in the Terms, except where Data Protection Laws do not permit them.

Annex 2: Technical and organisational measures

  • Data minimisation at source. Form-field contents are masked in the visitor’s browser by default before transmission; password and payment-card fields are always masked; key presses inside masked fields are not recorded; customers can hide or exclude any element; Global Privacy Control is honoured by default; no device fingerprinting.
  • Consent controls. Optional bottom-bar or full-screen consent modes that limit or block recording until the visitor agrees; choices stored in the _vsc cookie.
  • Encryption in transit. All traffic to visitorstory.com, app.visitorstory.com and i.visitorstory.com uses TLS 1.2 or higher between the browser and our network provider, and TLS with a validated certificate between the network provider and our servers.
  • Pseudonymisation. IP addresses are stored only as salted one-way hashes with session data; visitor, tab and session identifiers are random; passwords and API keys are stored only as hashes.
  • Access control. Customer data is separated by organisation and site, and every app request checks membership and role (owner, admin, member). Optional two-step sign-in for users. Administrative access to production is limited to authorised personnel, uses SSH keys, and the operator console is restricted to allow-listed IP addresses and superuser accounts. Web traffic to our servers is accepted only from our network provider.
  • Isolation of replay data. Recorded pages are replayed in a sandboxed frame; the client website’s own scripts are never captured or re-run.
  • AI minimisation. Only summary figures and redacted page and element names are sent to the AI provider; never recordings, identifiers, IP addresses, page text or typed input.
  • Availability and backups. Nightly database backups kept 14 days and weekly event-store backups kept 4 weeks; health checks before each deployment, with automatic rollback.
  • Retention and deletion. Automatic daily deletion past each site’s retention period; deletion APIs and tools for visitors and sites.
  • Logging and monitoring. Audit log of settings and API-key changes; server logs kept about 14 days; service health monitoring.
  • Personnel. Confidentiality obligations for anyone with access to Personal Data.

Contact

[Company legal name], [Registered address]. Email support@visitorstory.com.