This page describes the measures VisitorStory actually has in place today. The contractual version is Annex 2 of our Data Processing Addendum.
1. Hidden form fields
Every form field is hidden by default: its contents are replaced with asterisks in the visitor’s browser, so replays show ******* rather than what was typed. Key presses inside a hidden field are not recorded. Password fields and fields marked for payment-card details (autocomplete="cc-…") stay hidden even if you switch the default off. You can hide any other part of a page with the data-vs-mask attribute or a selector in your settings, and leave elements out of recordings entirely with data-vs-block.
2. Consent
For each site you choose one of three modes. No banner: nothing is shown. Bottom bar: visitors can keep using the site; until they accept, only basic analytics (page views, clicks, scrolling) run and nothing is replayed. Full-screen pop-up: nothing is recorded or sent until the visitor chooses, and declining is as easy as accepting. A visitor’s choice is remembered for a year. You can also connect your own consent tool through the script’s consent API.
3. Privacy signals and identity
When a browser sends a Global Privacy Control signal, the script records nothing for that visitor (respected by default). We do not fingerprint devices: returning visitors are recognised only by a random ID in a cookie and browser storage. IP addresses are stored only as salted one-way hashes with session data.
4. Safe replays
Replays are rebuilt from the page structure, not filmed, and only cover the tab your site is open in. Your website’s own scripts are never captured or run again; recorded pages are replayed inside a sandboxed frame in the app.
5. Encryption in transit
visitorstory.com, app.visitorstory.com and the collection host i.visitorstory.com are served only over HTTPS. Browsers connect to our network provider with TLS 1.2 or newer, and the provider connects to our servers over TLS with a validated certificate. The app sends HSTS and a Content Security Policy, and its pages are marked not to be indexed by search engines.
6. Access control
- Data is separated by organisation and site; every request in the app checks your membership and role (owner, admin or member). Only owners and admins can change settings or create API keys.
- Optional two-step sign-in with an authenticator app, with recovery codes. Passwords and API keys are stored only as hashes, and API keys are shown once.
- Settings and API-key changes are recorded in an audit log.
- Our servers accept web traffic only from our network provider. Administrative access uses SSH keys, and the operator console is limited to allow-listed IP addresses and administrator accounts.
7. AI with minimal data
Weekly findings are written by an AI model from summary figures only, with page addresses stripped of query strings and personal-looking parts. The model never receives recordings, visitor IDs, IP addresses, page text or anything typed, and every number it writes is checked against our own data.
8. Retention, deletion and backups
- Recordings and events are deleted automatically by a daily job when they pass your plan’s retention: 7, 30, 90 or 180 days.
- You can delete a single visitor’s data through the API (
POST /api/v1/visitors/delete, by visitor ID or your own user ID) or a whole site from its settings. - The application database is backed up nightly (kept 14 days) and the event store weekly (kept 4 weeks). Every deployment passes health checks before it goes live and rolls back automatically if they fail.
9. Reporting a security issue
If you find a vulnerability, email support@visitorstory.com with the details. Please give us a reasonable time to fix it before disclosing it, and don’t access other people’s data or disrupt the service while testing.
Contact
[Company legal name], [Registered address]. Email support@visitorstory.com.