Personal information
- Account Information: Email address, name (if provided)
- Authentication Data: Google OAuth profile information (name, email, profile picture)
- Contact Information: Email address for support and service communications
Legal and privacy
Privacy Policy
This policy explains how Slickful Group LLC operates heatmapp, what data we process, how the customer tracking snippet is minimized by design, and which rights and choices apply.
Start here
Overview
Slickful Group LLC ("we," "our," or "us") operates heatmapp (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our heatmap analytics service.
We build the customer tracking snippet around data minimization: no cookies, no browser storage, no session replay, no form values, and no persistent cross-device visitor profile. Customers remain responsible for their own legal basis, privacy notice, and consent configuration where applicable.
Our DPA terms, subprocessor list, data map, retention schedule, and customer privacy notice template are available in the heatmapp trust center.
Collection
Data we collect
Website analytics data
- Website Information: Domain names, page paths, and aggregate interaction metrics derived from masked events.
- User Interactions: Pointer coordinates for heatmaps, clicks, scroll depth, and timing, without visitor text content or typed input values.
- Device Information: Viewport size, device type category, and browser family.
End-visitor analytics (heatmap tracking script)
When your visitors load a website that embeds our tracking script, we process interaction data so you can view heatmaps and related metrics. By design we limit what leaves the visitor's browser:
- No cookies or local storage for the snippet: The tracker does not set cookies and does not use browser storage; it keeps a short-lived, in-memory session identifier only for the current tab (typically up to 30 minutes of inactivity).
- No persistent visitor profile: We do not assign a stable cross-device or cookie-based visitor ID for the analytics pipeline.
- Structural element cues only: We collect structural metadata such as tag name, input type, form order, and field order. We do not collect DOM IDs, element names, classes, CSS selectors, readable labels, placeholders, page copy, form field values, or keystrokes from visitors.
- Reduced device detail: We use device category, viewport size, and browser family instead of storing full user agent strings in analytics storage.
- No raw mouse trails: We do not store movement paths or session replay data.
- Reduced referrer detail: Referrers exclude query strings and fragments to avoid accidentally collecting tokens or identifiers from URLs.
Technical and infrastructure data
- Infrastructure and security: Our hosting providers may process IP addresses and HTTP metadata for delivering pages, rate limiting, abuse prevention, and auditing. Heatmap event storage used for your dashboard is designed not to persist full visitor IP addresses in analytics datasets.
- Dashboard sessions (heatm.app): When you log into the Service, we use cookies or similar mechanisms through our authentication providers to keep your session secure.
- Usage diagnostics: Aggregated feature usage, error logs, and performance metrics tied to operating our platform.
Use
How we use your data
Service provision
- Provide heatmap analytics and user behavior insights
- Generate reports and visualizations of website interactions
- Maintain and improve service functionality
- Process payments and manage subscriptions
Communication
- Send service-related notifications and updates
- Provide customer support and respond to inquiries
- Send important account and security notifications
Legal basis (GDPR)
- Contract Performance: Processing necessary to provide our services
- Legitimate Interest: Service improvement, security, and fraud prevention
- Consent: Marketing communications, where applicable
Sharing
Data sharing
We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:
- Service Providers: With trusted third-party services that help us operate our platform. Our current subprocessor list is published at /legal/dpa.
- Legal Requirements: When required by law or to protect our rights and safety
- Business Transfers: In connection with a merger, acquisition, or sale of assets
- Consent: When you explicitly consent to sharing
Controls
Data security
We implement appropriate technical and organizational measures to protect your data:
- Encryption in transit and at rest
- Secure authentication and access controls
- Regular security assessments and updates
- Limited access to personal data on a need-to-know basis
- Secure hosting infrastructure through Supabase
Lifecycle
Data retention
We retain your data only as long as necessary for the purposes outlined in this policy:
- Account Data: Retained while your account is active
- Analytics Data: Trial and unknown plan data is retained for 30 days, Starter data for 90 days, and Pro data for 12 months.
- Deleted Accounts: All associated data is permanently deleted within 30 days
- Legal Requirements: Some data may be retained longer if required by law
Rights
Your rights
Under GDPR and other applicable laws, you have the following rights:
- Access: Request a copy of your personal data
- Rectification: Correct inaccurate or incomplete data
- Erasure: Request deletion of your personal data
- Portability: Receive your data in a structured, machine-readable format
- Restriction: Limit how we process your data
- Objection: Object to processing based on legitimate interests
- Withdraw Consent: Withdraw consent for consent-based processing
To exercise these rights, contact us at support@heatm.app.
Vendors
Third-party services
We use subprocessors to provide hosting, database, analytics processing, payments, screenshot infrastructure, transactional email, and optional AI insights. The current list is maintained at /legal/dpa.
Supabase: Database and authentication services
Google OAuth: Authentication and user profile information
Stripe: Payment processing
Netlify: Website hosting and deployment
Tinybird: Minimized analytics event storage and reporting queries
Resend: Transactional email delivery
These services have their own privacy policies, and we encourage you to review them.
Transfers
International data transfers
Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for such transfers, including:
- Standard contractual clauses
- Adequacy decisions by relevant authorities
- Appropriate technical and organizational measures
Age limits
Children's privacy
Our service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you become aware that a child has provided us with personal information, please contact us immediately.
Updates
Changes to this Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by:
- Posting the updated policy on our website
- Sending an email notification to registered users
- Displaying a notice on our service
Your continued use of the service after changes become effective constitutes acceptance of the updated policy.
Contact
Contact us
If you have any questions about this Privacy Policy or our data practices, please contact us:
Slickful Group LLC
EIN: 37-2188713
1021 East Lincolnway, 8688
Cheyenne, Wyoming 82001
United States
Email: support@heatm.app