Privacy Policy

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address
• Name (optional)
• Company name (optional)
• Payment information (processed by Stripe)

1.2 Session Recording Data

When you install our SDK on your website, we collect data from your end users' sessions, including:

• Page views and navigation paths
• Mouse movements, clicks, and scrolls
• Form interactions (with configurable masking)
• Console logs and JavaScript errors
• Network request metadata
• Device and browser information
• IP addresses (used for geolocation, then discarded or anonymized)

1.3 Usage Data

We automatically collect information about how you use the Sumidata dashboard:

• Features accessed
• Time spent in the application
• Actions taken (replays watched, filters applied, etc.)

2. Privacy by Default

Sumidata is designed with privacy as a core principle. Our SDK includes:

• Automatic input masking: All form inputs are masked by default. Text inputs show asterisks instead of actual values.
• Three masking levels: Choose from Light (mask passwords only), Standard (mask all inputs), or Strict (mask all text content).
• No keystroke logging: We record the fact that typing occurred, not the actual keystrokes.
• Configurable exclusions: Mark specific elements or pages to exclude from recording entirely.

3. How We Use Information

We use the collected information to:

• Provide and maintain the Service
• Process session recordings and generate analytics
• Improve and optimize the Service
• Communicate with you about your account
• Detect and prevent fraud or abuse
• Comply with legal obligations

4. Data Sharing

We share your information with:

• Stripe, Inc.: Our payment processor. Stripe processes all payment transactions and receives the billing information necessary to process payments.
• Infrastructure providers: We use cloud services to host and process data securely.
• Legal requirements: We may disclose information if required by law or to protect our rights.

We do not sell your personal information or the data collected from your end users.

5. Data Retention

Session recording data is retained based on your subscription plan:

• Free plan: 14 days
• Growth plan: 3 months
• Scale plan: 6-12 months

Account information is retained for as long as your account is active and for a reasonable period thereafter for legal and business purposes.

6. Cookies and Tracking

Our SDK uses a first-party cookie to maintain session continuity. This cookie:

• Contains only a random session identifier
• Does not track users across different websites
• Is not used for advertising purposes

The Sumidata dashboard uses essential cookies for authentication and functionality.

7. Your Rights (GDPR/CCPA)

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data
• Portability: Request your data in a portable format
• Objection: Object to certain processing activities
• Restriction: Request restricted processing

To exercise these rights, contact us at support@mail.sumidata.io.

8. Your Responsibilities

As a Sumidata customer, you are responsible for:

• Obtaining appropriate consent from your end users before recording sessions
• Disclosing your use of session recording in your own privacy policy
• Configuring appropriate masking levels for sensitive data
• Responding to data subject requests from your end users
• Ensuring compliance with applicable data protection laws

9. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (TLS/HTTPS)
• Encryption at rest
• Access controls and authentication
• Regular security assessments

10. International Data Transfers

Your data may be processed in countries outside your own. We ensure appropriate safeguards are in place for any international transfers, including standard contractual clauses where required.

11. Children's Privacy

The Service is not intended for children under 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy and updating the "Last updated" date. Your continued use of the Service constitutes acceptance of the updated policy.