Skip to content
UserExplorer

Privacy and security

GDPR session replay with privacy built into the snippet

GDPR session replay is possible when personal data is minimised and you have a legal basis for recording. UserExplorer masks inputs, emails and numbers in the browser by default, can wait for your own consent banner, offers a DPA and lets Scale and Enterprise choose EU or US hosting.

See a sample report
  • Masking happens in the browser before data leaves
  • Consent mode follows the signal of your own banner
  • DPA, retention limits and deletion on request
  • EU or US hosting on Scale and Enterprise
Security lead reading a printout with personal data blacked out
app.userexplorer.com/settings/privacy
Mask all form inputsTyped text never leaves the browser
Mask emails and long numbers in page textCard, phone and ID patterns
Wait for consent from your bannerRecording starts after the visitor agrees
Record network request bodiesOff by default

Data region

European Union

Keep recordings for

90 days

Data processing agreement accepted. Sample data.

Privacy by default

Private data is masked before it ever leaves the visitor's browser

Product manager configuring a snippet on a laptop with a dashboard on the second screen

Many replay tools record first and hide sensitive data later in their own systems. UserExplorer does the opposite. The snippet replaces the content of form inputs, email addresses and long numbers such as card or phone numbers with placeholders in the browser, so that text is never sent to us at all.

You can extend masking with your own CSS selectors for account balances, order details or anything else you consider private, and block whole elements from recording. The same rules apply to session replay, heatmaps and the AI researcher, which only ever sees masked data.

Controls

Data protection controls available to every team

The defaults are strict. You decide what to relax, never the other way round.

Masking by default

Inputs, emails and numbers are masked on every plan from the first visit. Add custom selectors for other private elements.

Consent mode

Recording can start only after the consent signal from your own banner. You remain responsible for collecting consent on your site.

Retention limits

Data is deleted automatically after 3 months on Startup, 6 on Growth, 12 on Scale and 24 on Enterprise.

Deletion on request

Delete all data for a single visitor when they exercise their right to erasure, from the dashboard or the API.

Role based access

Roles and permissions on Scale and Enterprise limit who can watch replays, export data or change settings.

Hosting region

Scale and Enterprise customers choose whether their data is stored in the EU or in the US.

Consent

Consent mode that listens to the banner you already have

Under GDPR and the ePrivacy rules, session recording on visitor devices usually needs consent. UserExplorer does not ship its own banner on your site. Instead, consent mode makes the snippet wait until your consent platform or banner sends the signal you configure, and stop if consent is withdrawn.

As the website owner you decide the legal basis and wording and you are responsible for consent on your site. We act as your processor under a data processing agreement, available on the DPA page, and process recordings only to provide the service you configure.

acme-shop.com/signup/step-3

Step 3 of 4

Verify your phone

+1 (415) 555 0132
Send code

Code not delivered. Try again.

02:14 / 05:40
iPhone, Safari Paid search Dead click on Send code Sample data

By plan

Privacy and security features on each plan

  • Masking of inputs, emails and numbers

    Startup
    Yes
    Growth
    Yes
    Scale
    Yes
    Enterprise
    Yes

  • Custom masking selectors

    Startup
    Yes
    Growth
    Yes
    Scale
    Yes
    Enterprise
    Yes

  • Consent mode

    Startup
    Yes
    Growth
    Yes
    Scale
    Yes
    Enterprise
    Yes

  • Data processing agreement

    Startup
    Yes
    Growth
    Yes
    Scale
    Yes
    Enterprise
    Signed in the dashboard

  • Data retention

    Startup
    3 months
    Growth
    6 months
    Scale
    12 months
    Enterprise
    24 months

  • EU or US hosting choice

    Startup
    No
    Growth
    No
    Scale
    Yes
    Enterprise
    Yes

  • Roles and permissions

    Startup
    No
    Growth
    No
    Scale
    Yes
    Enterprise
    Yes

  • Audit log

    Startup
    No
    Growth
    No
    Scale
    Yes
    Enterprise
    Yes

  • SSO and SCIM

    Startup
    No
    Growth
    No
    Scale
    No
    Enterprise
    Yes

See the full plan comparison on the pricing page.

Security practices

How we protect the data you send us

Described plainly. We do not claim certifications we do not hold.

Encryption

Recording data travels from the browser to us over encrypted TLS connections and is stored with a hosting provider in the region of your project.

Access on a need basis

Only the people who operate the service can reach production systems, and they do not watch customer replays unless you ask for help with one.

Audit log on Scale and Enterprise

Scale and Enterprise accounts see who viewed replays, exported data or changed settings, and when.

Enterprise identity

SSO and SCIM provisioning on Enterprise connect UserExplorer to your identity provider so access ends when someone leaves.

Our own website

We practise what we recommend on userexplorer.com

Our marketing site sets only essential cookies, such as the session and security cookies needed for login and checkout. We do not run advertising pixels or cross site tracking here, which is why you do not see a cookie banner. Details are in the cookie policy and the privacy policy.

Questions about data protection go to [email protected], and logged in customers can use in-app help.

FAQ

Questions teams ask before they start

Is session replay allowed under GDPR?

It can be, when you minimise personal data, have a legal basis such as consent, inform visitors in your privacy notice and use a processor with a DPA. This page describes our controls, it is not legal advice for your specific case.

Where does masking happen?

In the visitor's browser. Masked text is replaced before recording data is sent, so it never reaches our servers or the AI researcher.

Do you provide a cookie banner for my site?

No. Consent mode connects to the banner or consent platform you already use. You stay responsible for collecting and recording consent on your site.

Can I keep data in the EU?

Yes. On Scale and Enterprise you choose EU or US hosting for your project data.

How do I delete a visitor's data?

Search for the visitor by identifier and delete their data from the dashboard, or use the API on Scale and Enterprise. Deletion covers recordings, events and survey answers for that visitor.

Do you have SOC 2 or ISO certification?

We do not claim certifications we do not hold. We describe our actual controls on this page and in the DPA, and answer security questions at [email protected].

Does the AI researcher see personal data?

It works on the same masked data you see in the dashboard. Masked fields are not available to it.

Record real sessions without recording private data

Masking in the browser, consent mode tied to your banner and clear retention limits from the first visit.

See pricing