# Data & Privacy



VitalSentinel is designed with privacy in mind. This page explains what data we collect, how we handle it, and how to maintain compliance.

## Privacy by Default [#privacy-by-default]

VitalSentinel's tracking scripts are privacy-focused:

* **No cookies in the default storage mode** - the default `none` mode writes no cookie, `localStorage` or `sessionStorage` on your visitor's device. The `session` and `persistent` modes do store data on the device, and require visitor consent before you enable them.
* **Pseudonymous, not anonymous** - visitor data is pseudonymous. The pages one visitor viewed on one of your sites are linked together.
* **No cross-site tracking** - Each domain is isolated
* **IP addresses are not stored** - a visitor's IP address is processed in memory to work out their country, to protect the service from abuse, and as one input to the short-lived identifier that links a visit together. It is then discarded, and is not written to our analytics databases.

The default storage mode stores nothing on your visitor's device. That is not the same as recording nothing: we still count the page view, and our servers still compute an identifier so that the pages of one visit hang together. That identifier is derived with a secret that is replaced every day and is scoped to a single domain, so it cannot link a visitor across days or across sites.

## What Data is Collected [#what-data-is-collected]

### VitalSentinel App Users [#vitalsentinel-app-users]

When you create a VitalSentinel account, we collect:

**Account Information:**

* Email address (used for login and notifications)
* Password (securely hashed, never stored in plain text)
* First and last name
* Timezone preference
* Profile picture (generated from your name - no third-party avatar service is used)
* Two-factor authentication settings (if enabled)

**Workspace Data:**

* Workspace name and configuration
* Team member emails, roles, and invitation status

**Billing Information:**

* Subscription plan and status
* Usage metrics (page views, events, domains against plan limits)
* Payment methods and invoices (processed and stored by Stripe, not VitalSentinel)

**Third-Party Services:**

* **Stripe** - Handles all payment processing. We don't store credit card numbers.
* **Google OAuth** - Used only if you connect the Google Search Console integration.

**App Analytics:**

* We use our own RUM and Web Analytics scripts on the VitalSentinel dashboard
* The same storage modes apply to our own site. Our scripts store nothing on a visitor's device unless they accept our cookie bar, and the data they collect is pseudonymous rather than anonymous
* We also use Ahrefs Web Analytics on this documentation site to see which pages get read. It is a cookieless third-party script that is not part of the application, so it receives nothing about your account or any website you monitor with us
* We do not sell or share your account data with third parties

For complete details, see our [Privacy Policy](https://www.vitalsentinel.com/privacy-policy).

***

### Website Visitors (Tracking Scripts) [#website-visitors-tracking-scripts]

The following data is collected about visitors to **your** website when you install our tracking scripts.

#### RUM Script [#rum-script]

The Real User Monitoring script collects:

**Performance Data:**

* Core Web Vitals (LCP, CLS, INP, TTFB, FCP)
* Navigation timing metrics
* Resource loading times
* JavaScript errors

**Session Data:**

* Session ID (pseudonymous, regenerated per page load)
* Page URLs visited (sanitized)
* Timestamps

**Device Data:**

* Browser type and version, operating system and device type - worked out on our servers from the `User-Agent` request header your visitor's browser sends with every request, not read from their device
* Viewport size, rounded to the nearest 50 pixels
* Screen size and pixel ratio, device memory, processor and connection speed - only when you declare consent on the script tag

**Engagement (optional):**

* Scroll depth
* Time on page
* Click count, and a rage-click signal that records the CSS selector of the element clicked repeatedly. Ordinary clicks are counted only - no coordinates and no element text

#### Web Analytics Script [#web-analytics-script]

The Web Analytics script collects:

**Traffic Data:**

* Page views
* Referring domain (the hostname only, such as `google.com`). The full referring address is sent to our servers so they can classify the traffic source, and is not stored
* UTM parameters
* Traffic source classification

**Session Data:**

* Session ID (pseudonymous)
* Pages per session
* Session duration

**Device Data:**

* Browser type and version, operating system, device type and browser language - worked out on our servers from the `User-Agent` and `Accept-Language` request headers your visitor's browser sends with every request, not read from their device
* Screen resolution, window dimensions, device pixel ratio, touch capability and connection type - only in the `persistent` storage mode, or after your consent banner calls `grantConsent('persistent')`

**E-commerce (if applicable):**

* Product views
* Cart actions
* Purchases (no payment details)

#### What We Don't Collect (By Default) [#what-we-dont-collect-by-default]

* Names, emails or other personal identifiers - our scripts do not read them from your pages or your forms
* IP addresses - processed in memory to work out the visitor's country, to protect the service from abuse, and as one input to the short-lived identifier that links a visit together. They are then discarded and are not written to our analytics databases.
* Passwords or sensitive form data
* Payment card information
* Health or financial data - our scripts do not read it from your pages or your forms
* Location beyond the country - we do not derive or store a region, state, city or street from a visitor's IP address

<Callout type="warn">
  That list covers what our scripts go looking for. It does not cover what **your** site hands them. Page paths, query strings, page `<title>` values, UTM parameters, product names, order IDs and custom event properties are your content, and we store what your site sends. Redaction is pattern-based: it replaces text that looks like an email address, a card number, a token or a phone number, and it does not catch a plain name, a case reference or a search term. Design your URLs, titles and events so they do not carry personal data. If your page titles or your site-search box can reveal something sensitive, you can also stop both from being stored for a whole domain - see [Page Titles and Search Terms](/features/web-analytics#page-titles-and-search-terms).
</Callout>

<Callout type="info">
  The Web Analytics script's `identify()` method is a no-op. Person-level identification is not available in any storage mode: the user ID and traits you pass are never stored or transmitted. The method stays callable so existing `identify()` calls on your site keep working, but it does nothing.
</Callout>

## Data Handling [#data-handling]

### Transmission [#transmission]

* All data is encrypted in transit (TLS)
* Your visitors' data is not shared with advertising networks, data brokers, or other analytics providers

### Storage [#storage]

* Encrypted at rest
* Stored in secure cloud infrastructure
* Access controlled and audited

### Retention [#retention]

Data is retained based on your plan:

| Plan     | Retention |
| -------- | --------- |
| Free     | 6 months  |
| Starter  | 12 months |
| Lite     | 16 months |
| Standard | 24 months |
| Advanced | 24 months |

After the retention period, raw events and session records are automatically deleted.

### Deletion [#deletion]

You can delete data by:

* Removing a domain (deletes all associated data)
* Canceling your workspace subscription (data deleted after a grace period)
* Requesting account deletion (removes your account, your workspaces, your domains and their monitoring data). Invoices already issued stay with Stripe, because accounting law requires them to be kept.

## GDPR Compliance [#gdpr-compliance]

VitalSentinel is designed for GDPR compliance.

### The Default Storage Mode [#the-default-storage-mode]

With default settings:

* No cookies
* No persistent identifiers
* Pseudonymous data, not anonymous
* Intended to be usable without a consent banner, though whether you need one depends on your jurisdiction, your regulator's position and the rest of your tooling

### With Consent (Enhanced Features) [#with-consent-enhanced-features]

If you want returning visitor tracking:

1. Get user consent
2. Call `grantConsent('persistent')`
3. Persistent visitor IDs enabled
4. Call `revokeConsent()` when a visitor refuses, or later changes their mind
5. Follow your consent requirements

Withdrawing consent is prospective: it changes what is collected from that point on, not what was already collected.

A browser privacy signal outranks your banner. If the visitor's browser sends Do Not Track or Global Privacy Control, `grantConsent()` is refused for them, no device details are collected however your banner is wired, and the page view is still counted so the cohort does not disappear from your reports.

### Data Subject Rights [#data-subject-rights]

Under the GDPR you can exercise any of the following over the personal data we hold about you as an account holder, at no cost:

* **Access** - ask for a copy of the personal data we hold about you
* **Rectification** - ask us to correct anything that is inaccurate or incomplete
* **Erasure** - ask us to delete your personal data
* **Portability** - ask for your data in a structured, machine-readable format
* **Objection** - object to processing we carry out on the basis of legitimate interests
* **Withdraw consent** - at any time, without affecting processing carried out before you withdrew it

Email [privacy@vitalsentinel.com](mailto:privacy@vitalsentinel.com) and say which right you want to exercise, from the address on your account. We respond within 30 days of receiving your request.

Visitor data collected by our tracking scripts is pseudonymous, not anonymous, so these rights can apply to it. Your visitors' requests reach you first, and we act on them for you. A visitor identifier has to come from you or from your visitor - we cannot work out which rows belong to a named person - and a search that returns nothing is not proof that we hold nothing about that person.

### Data Processing Agreement [#data-processing-agreement]

A DPA is available for custom packages. Contact [legal@vitalsentinel.com](mailto:legal@vitalsentinel.com) to discuss your requirements.

## Other Privacy Regulations [#other-privacy-regulations]

### CCPA (California) [#ccpa-california]

VitalSentinel does not:

* Sell personal information
* Share data for cross-context advertising
* Ask your pages or your forms for sensitive personal information

### PECR (UK/EU Cookie Law) [#pecr-ukeu-cookie-law]

In the default storage mode the scripts set no cookies. Whether that removes your PECR consent obligation is a question for you and your legal counsel - we do not draw that conclusion on your behalf.

### Other Regions [#other-regions]

Our privacy-by-default approach is designed to help you meet:

* Brazilian LGPD
* Canadian PIPEDA
* Australian Privacy Act

## Best Practices [#best-practices]

### For Maximum Privacy [#for-maximum-privacy]

1. Use default configuration (no storage)
2. Don't enable persistent tracking
3. Use lower sample rates to reduce data collection
4. Mask text and selectors if needed

### For GDPR Compliance [#for-gdpr-compliance]

1. Use default (no-cookie) mode
2. Only enable persistent storage with consent
3. Provide an opt-out mechanism
4. Update your privacy policy

### Privacy Policy Updates [#privacy-policy-updates]

Add to your privacy policy:

> We use VitalSentinel, a web analytics and performance monitoring service, to understand how our website is used and how quickly it loads for real visitors. In our configuration it does not set cookies and stores nothing on your device. The data it collects is pseudonymous rather than anonymous: it links together the pages you viewed on this site. For more information, see [VitalSentinel's privacy documentation](https://docs.vitalsentinel.com/others/data-privacy).

If your page URLs or page titles can carry anything that identifies a person, say so in your policy, or change them so they do not.

## Script Configuration for Privacy [#script-configuration-for-privacy]

### Maximum Privacy [#maximum-privacy]

```html
<script
  src="https://rum.vitalsentinel.com/rum.js"
  data-key="YOUR_ID"
  data-mask-text="true"
  data-mask-selectors="true"
  data-filter-query-params="true"
  async
></script>
```

### Standard (Default) [#standard-default]

```html
<script
  src="https://rum.vitalsentinel.com/rum.js"
  data-key="YOUR_ID"
  async
></script>
```

### With Consent Management [#with-consent-management]

```html
<script
  src="https://analytics.vitalsentinel.com/analytics.js"
  data-key="YOUR_ID"
  data-storage="none"
  async
></script>

<script>
  // Option 1: Call grantConsent when your cookie banner fires
  document.addEventListener('your-cookie-consent-event', function() {
    window.VitalSentinelAnalytics.grantConsent('persistent');
  });

  // Call revokeConsent when the visitor refuses, or later changes their mind
  document.addEventListener('your-cookie-reject-event', function() {
    window.VitalSentinelAnalytics.revokeConsent();
  });

  // Option 2: Dispatch the built-in event (handled automatically)
  // window.dispatchEvent(new CustomEvent('vs-analytics-consent', {
  //   detail: { level: 'persistent' }
  // }));
  // Pass level: 'none' to withdraw.
</script>
```

## Opt-Out for Visitors [#opt-out-for-visitors]

Provide an opt-out mechanism for Web Analytics tracking:

```javascript
// Opt out of Web Analytics tracking
window.VitalSentinelAnalytics.optOut();

// Resume tracking
window.VitalSentinelAnalytics.optIn();
```

Opt-out applies to the current page load and is not persisted across page loads. If you need to remember a visitor's choice, store your own flag (for example in `localStorage`) alongside calling `optOut()`, and call `optOut()` again on each page load when that flag is set.

You do not need to wire up Do Not Track yourself. Both scripts check the browser's Do Not Track and Global Privacy Control settings, and our servers check the matching `DNT` and `Sec-GPC` request headers.

For a visitor who sends one of those signals:

* No durable visitor identifier is created for them, and Web Analytics writes no session record
* No engagement measurement runs - no scroll depth, no active time, no rage clicks
* `grantConsent()` is refused, so your consent banner cannot raise the storage mode for them
* Web Analytics reads no device details at all; RUM reads nothing beyond the window size, rounded to the nearest 50 pixels
* The page view is still counted, so the cohort does not disappear from your reports

## Security [#security]

### Our Security Practices [#our-security-practices]

* Encrypted data at rest and in transit
* Access logging and monitoring
* Incident response procedures

### Reporting Vulnerabilities [#reporting-vulnerabilities]

If you discover a security issue:

* Email: [security@vitalsentinel.com](mailto:security@vitalsentinel.com)
* Do not publicly disclose until resolved
* We'll acknowledge within 24 hours

## Contact [#contact]

For privacy questions:

* Email: [privacy@vitalsentinel.com](mailto:privacy@vitalsentinel.com)
* DPA requests: [legal@vitalsentinel.com](mailto:legal@vitalsentinel.com)

## Related [#related]

<Cards>
  <Card title="RUM Script Installation" href="/installation/rum-script">
    Privacy configuration options
  </Card>

  <Card title="Web Analytics Script Installation" href="/installation/analytics-script">
    Consent management
  </Card>

  <Card title="FAQ" href="/help/faq">
    Common questions
  </Card>
</Cards>