Privacy Policy

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address
• Name (optional)
• Company name (optional)
• Payment information (processed by Stripe)

1.2 Session Recording Data

When you install our SDK on your website, we collect data from your end users' sessions, including:

• Page views and navigation paths
• Mouse movements, clicks, and scrolls
• Form interactions (with configurable masking)
• Console logs and JavaScript errors
• Network request metadata
• Device and browser information
• IP addresses (stored with session data — see below)

IP addresses are collected and stored together with session, event, and log records. We use them for security, abuse and fraud prevention, diagnostics, and to derive an approximate location. IP addresses are retained for the same period as the rest of your session recording data (see Section 5) and are removed by account deletion and by on-request erasure.

1.3 Usage Data

We automatically collect information about how you use the Sumidata dashboard:

• Features accessed
• Time spent in the application
• Actions taken (replays watched, filters applied, etc.)

2. Privacy by Default

Sumidata is designed with privacy as a core principle. Our SDK includes:

• Input masking on by default: All form inputs are masked by default. Recordings contain asterisks instead of the values end users type, and password fields are always masked.
• Simple on/off control: The website owner can turn input masking off in the SDK configuration. When masking is turned off, values typed by end users into non-password fields may be recorded.

3. How We Use Information

We use the collected information to:

• Provide and maintain the Service
• Process session recordings and generate analytics
• Improve and optimize the Service
• Communicate with you about your account
• Detect and prevent fraud or abuse
• Comply with legal obligations

4. Data Sharing

We share your information with the following sub-processors and parties:

• Stripe, Inc.: Our payment processor. Stripe processes all payment transactions and receives the billing information necessary to process payments.
• DigitalOcean, LLC: Cloud hosting and infrastructure.
• ClickHouse, Inc.: Analytics data storage and processing.
• Google LLC (Gemini): AI-powered page analysis.
• Anthropic, PBC (Claude): AI-powered page analysis.
• Legal requirements: We may disclose information if required by law or to protect our rights.

Our AI sub-processors (Google Gemini and Anthropic) receive a snapshot of the page that our own server captures by loading the public page once as an anonymous browser, together with the list of product event types present on the page — for example, page view or add to cart — so they can understand its structure. We send only the list of event types, never how many times each event occurred. This analysis runs from our infrastructure to understand the page itself; it is not a replay of your end users' sessions and is not tied to any individual end user, so this content does not contain your end users' personal data. We never send your recorded sessions, aggregated analytics, metrics, or numeric values to these sub-processors.

We do not sell your personal information or the data collected from your end users.

5. Data Retention

Session recording data is stored for up to 3 years from the date of collection, and the full 3-year history is viewable and queryable in the dashboard on every plan, including Free. Data older than 3 years is permanently deleted. You can request earlier deletion of your project's data at any time by contacting support@mail.sumidata.io; deletion requests are honored regardless of your plan.

If you cancel your subscription, your workspace moves to the Free plan: your data stays stored — and remains accessible — under the same 3-year retention period. You can request deletion of your data at any time, as described above.

Account information is retained for as long as your account is active and for a reasonable period thereafter for legal and business purposes.

Invoices and payment records are retained for a longer period as required to comply with our legal, accounting, and tax obligations, even after your account is deleted.

6. Local Storage and Tracking

Our SDK does not use cookies. Instead, it stores identifiers in the browser's storage on your website:

• Device identifier: a randomly generated ID kept in localStorage. It persists until the end user clears their browser storage and is used to recognize returning devices on your website.
• Session identifier: a randomly generated ID kept in sessionStorage, with a localStorage backup used to keep the session continuous across login redirects.
• User identifier: if you use the identify feature, the user ID you assign is kept in localStorage.

These identifiers do not track end users across different websites and are not used for advertising. Because the device identifier persists across visits, it may require end-user consent in some jurisdictions (such as under EU ePrivacy rules) in the same way cookies do; obtaining any required consent is your responsibility as the website owner.

The Sumidata dashboard stores authentication tokens in your browser's local storage and does not use advertising cookies.

7. Your Rights (GDPR/CCPA)

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data
• Portability: Request your data in a portable format
• Objection: Object to certain processing activities
• Restriction: Request restricted processing

To exercise these rights, contact us at support@mail.sumidata.io.

8. Your Responsibilities

As a Sumidata customer, you are responsible for:

• Obtaining appropriate consent from your end users before recording sessions
• Disclosing your use of session recording in your own privacy policy
• Keeping input masking enabled where sessions may capture sensitive data
• Responding to data subject requests from your end users
• Ensuring compliance with applicable data protection laws

9. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (TLS/HTTPS)
• Encryption at rest
• Access controls and authentication
• Regular security assessments

10. International Data Transfers

Your data may be processed in countries outside your own. We ensure appropriate safeguards are in place for any international transfers, including standard contractual clauses where required.

11. Children's Privacy

The Service is not intended for children under 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy and updating the "Last updated" date. Your continued use of the Service constitutes acceptance of the updated policy.