Data privacy

This page explains what data VitalSentinel collects about your visitors and about you. It also explains the consent and storage modes, how long VitalSentinel keeps data, and which providers help to run the service.

Privacy by defaultCopy Anchor Link

The RUM script and the Web Analytics script are built to collect as little as possible:

• Nothing on the device by default. In the default mode, the scripts write no cookie, no local storage and no session storage on your visitor's device.
• Pseudonymous, not anonymous. VitalSentinel links the pages that one visitor views on one of your sites. So the data is pseudonymous: it does not name a person, but it is not anonymous.
• No cross-site tracking. Each domain is separate. VitalSentinel cannot link a visitor across your sites.
• IP addresses are not stored. VitalSentinel holds a visitor's IP address only in memory. It uses the address to find the location, to stop abuse, and to link the pages of one visit. The location is the country, the region, the city and the time zone. It also uses the address to mark traffic from data centers and hosting networks, so that it can remove bots. Then it discards the address.

The default mode stores nothing on the device, but it still counts the page view. To link the pages of one visit, the VitalSentinel servers make a short-lived identifier. A secret that changes every day makes this identifier, and it is limited to one domain. So it cannot link a visitor across days or across sites.

What the RUM script collectsCopy Anchor Link

The RUM script measures the speed and the errors that your real visitors get. It collects:

• Speed: Core Web Vitals (LCP, INP, CLS) and FCP and TTFB, plus page load timing.
• Errors: JavaScript errors, unhandled promise rejections and files that failed to load.
• Visit: the page address, the time, and pseudonymous identifiers for the page load and the visit.
• Device: the browser, the operating system and the device type. The VitalSentinel servers read these from the User-Agent header that every browser sends. The script also sends the window size, rounded to the nearest 50 pixels.
• Engagement: scroll depth, time on page, the number of clicks, and rage clicks (many fast clicks on one element). For a rage click, the script records the CSS selector of the element. It records no click position and no element text.

RUM consent modeCopy Anchor Link

In the domain's tracking settings, the RUM script has a Consent mode with two options:

• No consent: "Nothing is saved on your visitor's device – no cookies, no local storage, no session storage. You still get Core Web Vitals, errors and engagement." The app says: "No consent banner needed for storage."
• Consent given: for visitors who accepted your consent banner. It adds screen size, device memory, processor and connection speed. It also keeps a visit ID and a visitor ID in local storage, so page loads link into visits. The visitor ID stays for 180 days. Use this mode only after your banner has the visitor's consent.

For the settings, see Domain settings and RUM script.

What the Web Analytics script collectsCopy Anchor Link

The Web Analytics script measures your traffic. It collects:

• Traffic: page views, the address of the page (host name and path), and the referring site (host name and path, without the query string). The script removes the # part of the address and some query parameters.
• Campaigns: UTM parameters and the traffic source.
• Visit: a pseudonymous visit identifier, the pages in each visit and the visit length.
• Device: the browser, the operating system, the device type and the browser language. The VitalSentinel servers read these from the headers that every browser sends.
• Location: the country, the region, the city and the time zone. The VitalSentinel servers find them from the IP address. The region, the city and the time zone do not show in the reports yet.
• Ecommerce: product views, cart actions and purchases, on a supported shop platform. Payment details are never collected.
• Article author: the author name, on pages that publish a byline in their structured data.

The full referring address goes to the VitalSentinel servers to find the traffic source. VitalSentinel stores only the host name and the path. It removes the query string and masks text in the path that looks like personal data.

Web Analytics storage modeCopy Anchor Link

In the domain's tracking settings, the Web Analytics script has a Storage mode with three options:

The snippet that the app makes for Persistent writes no cookies. Journeys and funnels are more accurate in Session or Persistent mode, because the pages of one visitor join into one visit.

Page titles, search terms and article authorsCopy Anchor Link

The Web Analytics script stores page titles, site-search terms and article authors by default. In the domain's tracking settings, under Page titles, search terms and article authors, you can tick these boxes:

• Do not store page titles or site-search terms
• Do not store article authors

The change reaches all traffic within about a minute, with no new snippet. Text that VitalSentinel already collected stays in your reports until it ages out after three years. Consider this setting if your pages or your search box can show health, legal or other sensitive details about a visitor.

What the scripts do not collectCopy Anchor Link

The scripts do not look for these items on your pages or in your forms:

• Names, email addresses or other personal identifiers (the article byline above is the one exception)
• Passwords or other form data
• Payment card information
• Health or financial data
• A precise location, such as GPS coordinates or a street address

Do Not Track and Global Privacy ControlCopy Anchor Link

Both scripts check the Do Not Track and Global Privacy Control settings of the browser. The VitalSentinel servers also check the matching DNT and Sec-GPC headers. For a visitor who sends one of these signals:

• VitalSentinel makes no visitor identifier for the visitor.
• No engagement measurement runs: no scroll depth, no active time, no rage clicks.
• Web Analytics reads no device details. RUM reads only the window size, rounded to the nearest 50 pixels.
• VitalSentinel keeps only the country. The region, the city and the time zone stay empty.
• VitalSentinel still counts the page view, so these visitors do not disappear from your reports.

If the visitor accepts your consent banner and the banner calls grantConsent(), the visitor's choice wins over the browser signal. A consent level that you write in the snippet does not win over the signal. To remember the grant, the scripts keep the key vs_cg on the device for 180 days. revokeConsent() deletes it.

Consent banner and opt-outCopy Anchor Link

If you use a consent banner with the Web Analytics script, call grantConsent('persistent') (or grantConsent('session')) when the visitor accepts. Call revokeConsent() when the visitor refuses or changes their mind. A withdrawal changes what VitalSentinel collects from then on, not what it already collected.

// When the visitor accepts your banner
window.VitalSentinelAnalytics.grantConsent('persistent');

// When the visitor refuses or withdraws consent
window.VitalSentinelAnalytics.revokeConsent();

To stop Web Analytics for a visitor, call optOut(). Call optIn() to start it again. The opt-out applies only to the current page load. To remember the choice, store your own flag and call optOut() on each page load.

window.VitalSentinelAnalytics.optOut();
window.VitalSentinelAnalytics.optIn();

The identify() method does nothing. VitalSentinel does not identify persons in any storage mode. For the full script setup, see Web Analytics script.

Server Log MonitoringCopy Anchor Link

Server Log Monitoring reads the access logs of your server. It stores crawler traffic, not people:

• VitalSentinel stores only search engine and AI crawler requests. It drops all other requests, including your human visitors, before storage and only counts them.
• VitalSentinel stores the names of query parameters, never their values.
• For requests from bots that VitalSentinel cannot confirm, or from fake bots, VitalSentinel removes the IP address and groups the requests by network instead.
• VitalSentinel stores the credentials of log sources encrypted.

The VitalSentinel crawlerCopy Anchor Link

Site Health Monitoring and Page Monitoring use the VitalSentinel crawler.

• The crawler fetches only public pages of your verified site.
• For each page, the crawler stores the HTML and the page after JavaScript runs.
• The crawler blocks analytics and ad beacons when it renders a page. So crawler visits do not send hits to your analytics or ad tools.

Sitemap Monitoring stores the addresses in your sitemaps and the dates that your sitemaps give for them. It does not store page content.

Your account dataCopy Anchor Link

When you create an account, VitalSentinel stores your email address, your name and your time zone. It also stores your password as a secure hash (never as plain text) and your two-factor authentication settings. A workspace stores its name, its settings and its members with their roles.

Stripe processes all payments. Your card details go directly to Stripe and never reach VitalSentinel.

Your profile picture comes from Gravatar if you have one there. The VitalSentinel servers load it, so your browser does not contact Gravatar. If you have no Gravatar picture, the app shows your initial.

Theo and the AI providerCopy Anchor Link

Theo, the AI assistant in the app, is powered by Anthropic. Theo shows this notice under its first AI answer:

"Your question and the account data needed to answer it are sent to Anthropic."

The answers to suggested questions come from fixed texts and use no AI.

Some Web Analytics features also use Theo. For example, the search clusters card shows this notice:

"Theo, our AI assistant, sends the text of your visitors' searches to Anthropic, our AI provider."

For details, see Theo and privacy.

Sub-processorsCopy Anchor Link

The list of the providers that help run VitalSentinel (sub-processors) is on the VitalSentinel website, in the Privacy Policy. The Privacy Policy is the full and binding description of how VitalSentinel handles your data.

If you connect Slack or a webhook for alerts, VitalSentinel sends alerts to the destination that you choose.

How long VitalSentinel keeps dataCopy Anchor Link

How long VitalSentinel keeps data depends on the module. For most modules, the time is the same on every plan. See Plans and limits.

• When your plan keeps a shorter history (for example after a downgrade), the Billing page shows a line for each affected module. The line says how much history the module keeps, and until which date. After that date, data older than your plan's window is deleted.
• For Page Monitoring and Site Health Monitoring, each record keeps the history window of the plan that was active when VitalSentinel wrote it.
• After the window of a kind of data ends, VitalSentinel deletes it automatically.

When you delete a domain or your accountCopy Anchor Link

• Delete a domain: the domain leaves your dashboard at once. VitalSentinel keeps its data for 30 days, then deletes it for good.
• Delete your account: VitalSentinel deactivates your account at once and deletes your data for good after 30 days. This removes every workspace that you own and its data. Invoices stay with Stripe, because the law requires them.

For the steps, see Domain settings and Data and privacy settings.

Your rights and your visitors' rightsCopy Anchor Link

Under the GDPR, you can ask for access, correction, erasure, portability and objection, and you can withdraw consent. Use the Your rights section of your account settings. VitalSentinel confirms that it is you with a code that it sends to your email. See Data and privacy settings.

Visitor data from the scripts is pseudonymous, so these rights can apply to it too. Your visitors send their requests to you first. VitalSentinel cannot find the rows of a named person on its own, so you must give the visitor identifier.

Data handling and securityCopy Anchor Link

• VitalSentinel encrypts all data in transit (TLS) and at rest.
• VitalSentinel does not share your visitors' data with advertising networks, data brokers or other analytics providers.
• VitalSentinel does not sell personal data.

Text for your privacy policyCopy Anchor Link

You can add text like this to your own privacy policy:

We use VitalSentinel, a web analytics and performance monitoring service, to learn how our website is used and how quickly it loads for real visitors. In our configuration, it does not set cookies and stores nothing on your device. The data it collects is pseudonymous, not anonymous: it links the pages that you viewed on this site. For more information, see VitalSentinel's privacy documentation.

If your page addresses or page titles can contain something that identifies a person, say so in your policy, or change them.

ContactCopy Anchor Link

For privacy questions, write to privacy@vitalsentinel.com.

RelatedCopy Anchor Link

• RUM script - install the RUM script and set its consent mode
• Web Analytics script - install the Web Analytics script and set its storage mode
• Theo and privacy - what Theo reads and sends
• Data and privacy settings - your rights and account deletion
• Monitoring IPs - the crawler and its user agent