DPA, subprocessors, and data map

For end-visitor analytics collected through the heatmapp snippet, the customer is the controller and Slickful Group LLC acts as the processor. We process personal data, if any, only to provide, secure, maintain, and improve the Service under the customer's documented instructions and applicable law.

We maintain appropriate technical and organizational measures, including access controls, transport encryption, data minimization, retention limits, and separation between customer snippet analytics and heatm.app marketing analytics. We will assist customers with reasonable data subject requests, security inquiries, and deletion workflows where the requested data can be located from customer website, path, time range, and ephemeral session context.

Customers remain responsible for their own legal basis, website privacy notice, consent configuration where required, and ensuring the Service is not installed on pages that collect sensitive data unless appropriate safeguards are in place.

• No session replay, DOM recording, keystroke capture, or video.
• No cookies or localStorage in the customer tracking snippet.
• No cross-session or cross-device visitor identity.
• No form values, query-string referrers, full user agents, or full IP addresses in analytics storage.
• Dashboards focus on population-level UX patterns, not individual visitor dossiers.

The tracking snippet does not set cookies, use browser storage, collect form values, send readable page copy, send raw mouse trails, or create a persistent visitor ID. heatmapp analytics storage is designed not to persist full visitor IP addresses.

We aim to keep primary application and analytics processing in EU regions where our providers support that configuration. Some providers use global infrastructure for delivery, payment, email, security, support, or abuse-prevention operations.

Where data is transferred outside the EEA, we rely on vendor data processing terms, Standard Contractual Clauses, adequacy decisions, or other lawful transfer mechanisms made available by those providers.

Paste-ready starting point for customer sites. Customers should adapt this with counsel to match their jurisdiction and legal basis:

We use heatmapp to understand aggregate interaction patterns on our website, such as clicks, scroll depth, page paths, device category, and rage-click signals. heatmapp's customer tracking snippet does not use cookies or localStorage, does not record sessions, does not collect form field values or keystrokes, and does not create a persistent cross-device visitor profile. Interaction data is used to improve our website experience and is retained according to our analytics retention settings.

Customers relying on legitimate interests should document the purpose of UX improvement, necessity of minimized heatmap analytics, and balancing safeguards: no cookies, no replay, no form values, no persistent visitor ID, shortened retention, and clear privacy notice disclosure.

End visitors should contact the website owner first because the customer controls the relationship and legal basis. Customers can then contact support@heatm.app with the website, approximate time range, page path, and request type. Because heatmapp intentionally avoids persistent visitor identity, requests are handled by deletion or narrowing based on available event context rather than by a cross-site visitor profile.