1. Who we are and what this policy covers
[Company legal name], [Registered address] (“VisitorStory”, “we”, “us”) provides VisitorStory, a session-replay and website-analytics service. This policy explains how we handle personal data in two different roles:
- As a controller for people who visit visitorstory.com, sign up for an account, use the app, or contact us (“customers”).
- As a processor / service provider for the visitors to our customers’ websites that our customers choose to record (“visitors”). In that role our customer is the controller (or “business”), decides what is recorded and why, and is responsible for informing visitors and obtaining any consent required. Our processing is governed by our Data Processing Addendum.
2. Customers: what we collect and why
| Data | Why we use it | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Account details: email address, password (stored only as a salted hash), optional two-step sign-in secrets and recovery codes | Create and secure your account, sign you in | Contract |
| Organisation, team members, roles and invitations (including an invitee’s email address) | Let you work with your team | Contract; legitimate interests |
| Your sites and their settings, goals, funnels, saved segments, API keys (stored only as a hash) | Provide the service | Contract |
| Public pages of your website that we read when you add a site (home page and up to two more) | Fill in your settings for you | Contract; legitimate interests |
| Plan, usage counts and, once online payment is enabled, payment-provider customer and subscription identifiers (never card numbers) | Billing, plan limits | Contract; legal obligation |
| Audit log of settings and key changes, sign-in records, server logs (IP address, user agent, time, requested path) | Security, fraud prevention, troubleshooting | Legitimate interests; legal obligation |
| Messages you send us | Answer you, support | Contract; legitimate interests |
| Service emails (invitations, sign-in codes, weekly report summaries) | Run the service | Contract |
visitorstory.com does not use advertising or third-party analytics cookies, and we do not record visitors to visitorstory.com with VisitorStory. We do not send marketing email without your consent, and you can opt out at any time.
3. Visitors to our customers’ websites
When a customer installs the VisitorStory script, it can collect, for that customer:
- How the page looks and changes: a copy of the page structure and styles, and later changes to it, so the visit can be replayed. This can include text shown on the page. Customers must hide any part of a page that shows sensitive information (see our Acceptable Use Policy).
- Interactions: mouse movement, clicks, taps, scrolling, page changes, time on page, whether the tab is visible, key-press timing outside hidden fields, copy and paste events, errors and page-load performance.
- Form fields: by default the contents of every form field are replaced with asterisks in the visitor’s browser before anything is sent. Password fields and card-number fields are always replaced, whatever the customer’s settings. Key presses inside hidden fields are not recorded.
- Device and visit information: browser and operating system, screen and window size, language, time zone, device type, referring page and campaign parameters, and the pages viewed.
- Identifiers: a random visitor ID (in a cookie set by i.visitorstory.com and in the browser’s local storage), a random tab and session ID, and, if the customer chooses to send them, the customerand, if the customer chooses to send it, the customer’s own user ID for a signed-in visitor.rsquo;s own user ID for a signed-in visitor and any attributes (and, if the customer chooses to send it, the customer’s own user ID for a signed-in visitor.ldquo;traitsand, if the customer chooses to send it, the customer’s own user ID for a signed-in visitor.rdquo;) it attaches.
- IP address: used when the data arrives to compute a salted, one-way hash, which is what we store with the session. We do not store the raw IP address with session data. If location lookup is enabled, the IP is used to derive country, region, city and network, and then discarded. Our web server logs, which include IP addresses, are kept for about 14 days for security and troubleshooting.
We do not use device fingerprinting, and we do not combine visitor data across different customers or use it for advertising. When a browser sends a Global Privacy Control signal, the script records nothing by default. If the customer uses our consent banner, recording is limited or blocked until the visitor agrees, depending on the customer’s chosen mode. Details of the cookies and storage the script uses are in our Cookie Policy.
If you are a visitor and want to access or delete data about you, please contact the website you visited; they control the data. We will help them respond, and we can delete all sessions linked to a visitor ID or customer user ID on their instruction. If you contact us directly, we will forward your request to the right customer where we can identify them.
4. AI processing
Weekly findings and reports are written with the help of an AI model provided by Anthropic. The model is sent a compact summary of figures for a site (for example drop-off rates, scroll reach and counts), page addresses with query strings and personal-looking segments removed, and redacted element names. It is not sent recordings, visitor IDs, IP addresses, page titles or text, error messages or anything a visitor typed. When a customer adds a site, we send the text of up to three of that site’s public pages to the model so it can suggest the site’s description and goals. These requests are made under Anthropic’s commercial API terms.
5. Who we share data with
We share personal data only with the service providers that help us run VisitorStory, listed on our Subprocessors page, under contracts that require them to protect it; with professional advisers; with authorities where the law requires; and with a successor if our business is sold or merged, under the same commitments. We do not sell personal data and we do not “share” it for cross-context behavioural advertising, as those terms are defined in the CCPA/CPRA.
6. How long we keep data
- Visitor recordings and events: for the retention period of the customer’s plan, then deleted automatically by a daily job: Free 7 days, Starter 30 days, Growth 90 days, Pro 180 days. Customers can delete a site or a single visitor’s data earlier.
- Weekly reports and findings (summary figures and text, no recordings): for as long as the site exists in the customer’s account.
- Customer account data: for as long as the account is open, then deleted within 30 days of closure, except where we must keep records (for example invoices) for legal or tax reasons.
- Server logs: about 14 days.
- Backups: database backups are kept for up to 14 days (account data) and up to 4 weeks (event data), so deleted data can remain in a backup until it is overwritten. Backups are not used for any other purpose.
7. Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict processing, to withdraw consent, and not to be discriminated against for using these rights. Under the GDPR and UK GDPR you may also complain to your data protection authority. Under the CCPA/CPRA and other US state privacy laws (including those of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others), you can request to know, delete or correct, and opt out of sale, sharing, targeted advertising and profiling; we do not sell or share personal data or use it for targeted advertising or profiling with legal effects.
Customers can make requests to support@visitorstory.com. We will verify your identity and reply within 30 days (45 days where US law allows), and you may use an authorised agent where the law permits. Visitors should contact the website they visited first (see section 3).
8. International transfers
Our servers are in the United States (Hillsboro, Oregon), and our subprocessors may process data in the United States and other countries. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum), together with the safeguards described in our DPA, or on the EU–US Data Privacy Framework where a recipient is certified.
9. Security
We protect data with encryption in transit, access controls, hashing of passwords, API keys and IP addresses, masking by default, and backups. Read more on our Security page. No system is perfectly secure; if a breach affects your data we will tell you as the law and our DPA require.
10. Children
VisitorStory is a business service and is not directed at children under 16. We do not knowingly collect personal data from children under 16 for our own purposes, and our Acceptable Use Policy does not allow customers to use VisitorStory on websites directed at children under 16. If you believe a child has given us personal data, contact us and we will delete it.
11. Changes to this policy
We will post any changes on this page and update the date above. If a change is material, we will tell customers by email or in the app before it takes effect.
Contact
[Company legal name], [Registered address]. Email support@visitorstory.com.