1. Two roles
Seentics processes personal data in two different capacities, and which one applies decides who answers for it.
Seentics as controller — your account
When you sign up for and use Seentics, we decide why and how your account data is processed. This notice covers that processing in full.
Seentics as processor — your visitors
When you install Seentics on your website or app, it collects data about your visitors on your behalf: page views, events, session recordings, heatmaps, errors. For that data, you are the controller and we are your processor: we handle it only on your instructions, under our Data Processing Agreement. If you are a visitor to a website that uses Seentics, that website's owner is the one to ask about your data; we will help them answer you.
2. What we process about account holders
- Account: name, email address, a hash of your password (never the password), or the identity Google or GitHub returns if you sign in with them.
- Teams: the teams you belong to, your role, and invitations you send or receive.
- Billing: your plan and subscription status. Payment details are collected and held by our payment provider, Lemon Squeezy, not by us.
- Configuration: the websites and settings you create.
- Support: messages you send us.
- Security and operations: sign-in events, IP addresses of requests to our API, and service logs, used to keep the service secure and working.
- AI Mode: the questions you ask it.
3. Why, and on what legal basis
- To provide the service you signed up for — running your account, your dashboards and your alerts: performance of a contract (Art. 6(1)(b) GDPR).
- To bill you, and keep the records tax law requires: performance of a contract and legal obligation (Art. 6(1)(b) and (c)).
- To keep the service secure — preventing abuse, fraud and attacks, and investigating incidents: our legitimate interest in a secure service (Art. 6(1)(f)).
- To tell you about the service — security notices, usage limits, changes to these terms: performance of a contract and legitimate interest.
We do not sell personal data, use it for advertising, or train AI models on it.
4. Visitor data we process for our customers
How much a customer's installation collects is under their control: each feature — session recording, heatmaps, funnels, automations, error tracking — can be switched off, limited to certain pages, or sampled. By default the tracker:
- counts visits anonymously until the visitor consents: no cookie, nothing stored in the browser, and an identifier derived from a salt that changes every day and is then destroyed, so one day's visits cannot be linked to the next;
- records sessions and heatmaps only after consent, with everything typed into forms masked in the browser before it is sent, and all text masked on pages that usually show personal details (account, settings, checkout and the like);
- uses the visitor's IP address only in memory, to look up a coarse location (country, region, city) in a database on our own servers — the address itself is never stored.
Customers can export or erase everything held about one visitor, and erase a whole website's data, at any time from their dashboard.
5. How long we keep it
- Account data: for as long as your account exists. Deleting your account erases it, with every website, recording and setting in it, at once.
- Visitor data: for the retention period of the customer's plan, after which it is deleted automatically, or sooner when the customer deletes it.
- Backups: encrypted, and kept for 30 days. Data you delete leaves the backups when they expire.
- Billing records: kept by Lemon Squeezy for as long as tax law requires.
6. Who else handles it
Our servers are in the European Union. A small number of service providers process data for us — hosting, storage, email, SMS alerts and payments. Each is bound by a data processing agreement, and the full list, with what each one does and where, is on our subprocessors page.
Where a provider is outside the European Economic Area, transfers rely on an adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission's Standard Contractual Clauses.
7. Security
- All traffic to and from Seentics is encrypted in transit (TLS).
- Backups are encrypted with a key that is not stored on our servers.
- Passwords are stored only as salted hashes; sessions can be revoked, and changing your password ends every other session.
- Access to customer data is limited to what running the service requires, and every dashboard request is checked against the team permissions you set.
8. Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we process it, and to receive it in a portable format. Much of this you can do yourself: change your details in your profile, export your data from the privacy settings, and delete your account under Profile → Delete account.
For anything else, email privacy@seentics.com. We answer within one month. You also have the right to complain to a data protection supervisory authority, in particular the one where you live or work.
9. Contact
Questions about this notice or your data: privacy@seentics.com.
When this notice changes in a way that matters, we tell account holders by email before the change takes effect.