Privacy Policy
What we collect, why, where it is stored and how long we keep it. Written to be read, not skipped.
In short: we collect as little as we can. We never sell data and never share it with advertising networks. SessionInsight is hosted in France and Switzerland. When you track your own website with SessionInsight, you decide what is collected, and we process that data on your behalf.
1. Who we are
SessionInsight is operated by SEINSIGHTS SARL, a French limited company registered under SIREN 814 695 326, with its registered office at 14 Chemin du Planschewasen, 68470 Fellering, France ("SessionInsight", "we", "us").
For any question about your data, write to privacy@sessioninsight.com.
2. Controller and processor
We handle personal data in two different capacities:
- As controller for data about visitors to sessioninsight.com and about our customers: your account, your settings and how you use the dashboard. Sections 3 and 4 cover this.
- As processor for the data our tracking script collects on your websites. You are the controller of that data: you choose which sites to track, which mode to use and what to record, and we process it only to provide the service to you. Section 5 covers this, and our Terms of Service set out the processing terms.
3. Visiting sessioninsight.com
Our website and blog use no advertising trackers or social media pixels.
- SessionInsight analytics. We measure our own site with SessionInsight, the same way our customers do. It records the pages you view, the referrer, your device, browser and approximate location, and how you use the pages: clicks, scrolls and session replays, with form inputs masked. It stores an anonymous visitor identifier and a session identifier in your browser's local storage. This data stays in our own SessionInsight account, hosted in France and Switzerland. It only loads if you click "Accept" in the notice shown on your first visit; if you decline, nothing is loaded or stored. We keep your choice in your browser's local storage so we don't ask again. You can change it at any time in the cookie settings; withdrawing your consent deletes the identifiers already stored.
- Server logs. Like any website, our host's servers record technical information about each request: IP address, browser, page requested, date and time. These logs are used only to run and secure the site, and are kept for a short period.
- Fonts. Our pages load fonts from Google Fonts. Your browser connects to Google's servers, which receive your IP address and browser information. Google LLC may process this data in the United States under the EU–U.S. Data Privacy Framework.
The legal basis for analytics is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time. For server logs and fonts, it is our legitimate interest in running a secure, working website (Article 6(1)(f) GDPR).
4. Your SessionInsight account
When you create and use an account on dashboard.sessioninsight.com, we process:
- Account data: your email address, your name if you provide it, and your password.
- Service data: the websites you add, your settings, goals, heatmaps, saved filters and shared links, and the team members you invite.
- Security logs: IP address, browser, and the time of logins and important account actions.
- Billing data, once paid plans are available: billing name and address, VAT number if any, and invoices. Card details are handled by the payment provider and never stored by us.
- Messages you send us.
We use this data:
- to provide the service and send the emails it needs, such as account confirmation, password resets and the reports you schedule (performance of our contract, Article 6(1)(b) GDPR);
- to secure accounts and prevent abuse (legitimate interest, Article 6(1)(f));
- to keep invoices as French accounting law requires (legal obligation, Article 6(1)(c)).
We send product news only if you opt in, and you can unsubscribe at any time. The dashboard uses strictly necessary cookies to keep you logged in and your session secure. It uses no advertising cookies.
SessionInsight is not intended for children under 16.
5. Data we collect on your websites for you
What our script collects depends on the mode you choose for each website.
Lightweight mode
Pages viewed, referrer and UTM parameters, device type, operating system, browser and approximate location (country and city), derived from the IP address. Nothing is stored on or read from the visitor's device: no cookies, no local storage.
Advanced mode
Everything above, plus:
- an anonymous visitor identifier stored in the visitor's browser, used to group visits into sessions;
- session replays: page changes, clicks, taps, scrolls and mouse movements, used to reconstruct the visit. Form inputs are masked automatically, and you can hide any other text;
- click and scroll heatmaps, goal conversions and clicks on outbound links;
- custom parameters, only if you choose to send them.
In both modes, you can turn off IP address storage, and your visitors can opt out of tracking.
Because you are the controller of this data, it is up to you to have a legal basis for it, to mention SessionInsight in your own privacy policy, and to ask for consent where required — in most EU countries, before recording session replays or using advanced mode. Don't send us sensitive information (such as health data or payment card details) or identifiers you have no legal basis to share.
If you visited a website that uses SessionInsight and want to exercise your rights, please contact that website's owner. If you write to us instead, we will forward your request to them.
6. Where data is stored
SessionInsight is hosted by PlanetHoster in data centres in France and Switzerland, where your account data and the data tracked on your websites are stored. Switzerland is covered by an EU adequacy decision: the European Commission recognises its level of data protection as equivalent to the EU's.
7. Who we share data with
We never sell personal data and never share it with advertising networks. We share it only with:
- Service providers that help us run SessionInsight and are bound by confidentiality and data protection obligations: PlanetHoster (hosting, France and Switzerland), our email delivery provider (account and report emails) and, once paid plans launch, our payment provider. We keep this list up to date.
- People you choose: team members you invite, and anyone who has a public or password-protected dashboard link you create.
- Authorities, when the law requires it.
8. How long we keep data
| Data | How long |
|---|---|
| Data tracked on your websites | Depends on your plan: 30 days on Free, 365 days on Growth. It is then deleted automatically. |
| Account and service data | As long as your account is open, then deleted within 30 days of you deleting your account. |
| Security logs | Up to 12 months. |
| Invoices | 10 years, as required by French law. |
| Messages you send us | Up to 3 years after our last exchange. |
| Analytics about visits to sessioninsight.com | 13 months at most. |
| Website server logs | A short period, for security purposes. |
9. Security
Data is encrypted in transit (HTTPS). Access to servers and data is limited to the people who need it. Accounts can use two-factor authentication, and replays mask form inputs by default. If a data breach affects your data, we will notify you and the relevant authority as the GDPR requires.
10. Your rights
Under the GDPR, you have the right to access your data, have it corrected or deleted, restrict or object to its processing, receive it in a portable format, and withdraw your consent at any time where processing is based on consent.
You can export your tracked data and delete your account from the dashboard. For anything else, email privacy@sessioninsight.com. We reply within one month.
You can also lodge a complaint with the French data protection authority, the CNIL, or with the authority in your country.
11. Changes to this policy
If we change this policy, we will update the date at the top of this page. If a change significantly affects how we use your data, we will tell account holders by email before it takes effect.