Privacy Policy

Last updated: July 18, 2026

This Privacy Policy explains how ClickSpool ("we", "us") collects, uses, and protects information in connection with our session-replay and analytics service (the "Service"). By using the Service you agree to this Policy.

ClickSpool is a small, independently operated service. We take the privacy and security of data seriously and use reasonable, industry-standard measures within our means. We are not a large enterprise with a dedicated security team or formal certifications, and no service can guarantee absolute security — but we are committed to doing our best to protect data and to being transparent about how it is handled. Because you use ClickSpool to collect data about your own visitors, you also have your own privacy responsibilities as described below.

1. Two kinds of data, two roles

Account data — information about you as our customer (email, password hash, plan, billing details). For this data, we are the controller.

Visitor data — the session recordings, events, and analytics captured from the websites you operate ("Your Sites"). For this data, you are the controller and we act as your processor, processing it only to provide the Service on your instructions. You are responsible for having a lawful basis and any required consent.

2. Account data we collect

You provide: email address, password (stored only as a salted hash), and, on paid plans, billing information handled by our payment processor.
Automatically: basic log data such as IP address, browser type, and timestamps for security and operating the dashboard.

3. Visitor data collected through the Service

When you install the ClickSpool script on Your Sites, it may record: page structure and content, mouse movement, clicks, scrolling, keystrokes in non-masked fields, navigation between pages, referrer, approximate location (country/city derived from IP), device, browser, and IP address. Passwords are masked in the visitor's browser before transmission, and you can mask, block, or exclude additional fields, elements, IP addresses, and countries using the controls we provide.

4. Cookies and similar technologies

The ClickSpool dashboard uses a strictly-necessary cookie to keep you logged in. The tracking script uses randomized identifiers stored in the visitor's browser to distinguish sessions and visitors; it does not use these to identify people across unrelated sites. Your own use of the Service on Your Sites may trigger cookie/consent obligations that are your responsibility to meet.

5. How we use data

To provide, maintain, secure, and improve the Service.
To authenticate you, communicate about your account, and provide support.
To process visitor data solely to deliver replays, heatmaps, and analytics to you.
To comply with law and enforce our Terms.

We do not sell personal data, and we do not use visitor data for our own advertising or profiling.

6. Sharing and subprocessors

We share data only with service providers that help us operate (for example, hosting and, where enabled, email and payment providers), each bound to appropriate confidentiality and security obligations, and as required by law or to protect rights and safety. We may transfer data as part of a merger, acquisition, or sale of assets.

7. Data retention and deletion

Recordings are retained according to the retention period of your plan and your settings, after which they are automatically deleted. You can delete individual recordings, bulk-delete by criteria, delete a site, or delete your entire account (which removes your sites and recordings) at any time from the dashboard. Account data is retained while your account is active and for a reasonable period afterward as needed for legal, accounting, or security purposes.

8. Security

We take reasonable measures to protect data, including hashing passwords, storing session tokens only as hashes, restricting database access, and serving the Service over HTTPS. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. International transfers

Data may be processed in countries other than where you or your visitors are located. Where required, we rely on appropriate safeguards for such transfers.

10. Your rights

Depending on your location, you (and, for visitor data, the visitors of Your Sites) may have rights to access, correct, delete, restrict, or port personal data, and to object to certain processing. For account data, contact us using the details below. For visitor data, because you are the controller, such requests should be directed to you as the operator of Your Sites; we will assist you in responding as your processor.

11. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data as a controller. You are responsible for not using the Service to knowingly collect data from children on Your Sites without proper consent.

12. Do Not Track

The tracking script can be configured to respect the browser "Do Not Track" signal; enabling that behavior on Your Sites is at your discretion.

13. Changes to this Policy

We may update this Policy from time to time. Material changes will be posted here with a new "last updated" date.

14. Contact

Questions or privacy requests: [email protected].