Privacy Policy

Two roles

Dashboard users (people with a Specto account): we are the controller of your account data.

Visitors of instrumented websites: the website owner (our customer) decides to record its site and is the controller; we process recordings on its behalf under the Data Processing Addendum. Visitors should direct requests to the website they visited; we assist that website in answering them.

Dashboard accounts

Name, email address, the public keys of any passkeys you add, or the identity returned by a sign-in provider you choose (GitHub, Google, or your organization's SSO), organization and project memberships, and an audit trail of administrative actions. For each signed-in session we store the IP address and browser user agent so you can review and revoke active sessions; IP addresses are also used transiently for rate limiting.

Billing: payments are handled by Stripe. Card details go directly to Stripe and never reach our servers; we store the Stripe customer and subscription identifiers, plan, status and billing period.

What the SDK records on instrumented sites

DOM structure and changes (to replay the page), JavaScript errors with scrubbed stack traces, rage clicks, click positions and how far each page was scrolled (for heatmaps — no text), page navigations, console messages (scrubbed for PII-looking text; off in strict privacy mode), and network request metadata — method, URL with credentials and sensitive query parameters removed, status, timing, sizes and a short allowlist of response headers. Request and response bodies, cookies and authorization headers are never captured. When the site owner turns on backend traces, its own servers also send request timings, error messages and the attributes it chooses (credential-named values are redacted and PII-looking text masked on arrival). A random, site-scoped visitor identifier lets the site owner count returning visitors; the site owner may also attach a user id, traits and custom events it chooses to send.

Masking happens in the visitor's browser, before upload: every form input is masked, sensitive element attributes are removed, strict mode masks all text and removes query strings from recorded addresses, and site owners can mask or block any element. Do-Not-Track and Global Privacy Control are honored — recording is skipped entirely. Site owners can require consent before anything is recorded or stored, and offer an opt-out.

Cookies and browser storage

The dashboard sets only first-party, httpOnly session cookies needed to keep you signed in — no advertising or cross-site tracking. On instrumented sites the SDK sets no cookies; it uses sessionStorage to continue a recording across page loads and localStorage for the visitor identifier and consent/opt-out choices.

Retention

Recordings are deleted automatically when they exceed the retention window of the workspace's plan (a project may choose a shorter one; a project its owner places under legal hold keeps its data until the hold is lifted):

• Free: 30 days
• Pro: 90 days
• Business: 365 days
• Enterprise: 730 days

Account data is kept while the account exists. Audit entries are kept for about 13 months. Database backups expire on a 30-day cycle.

Subprocessors

None. All processing happens on infrastructure operated by the organization operating this Specto instance. Controllers are notified before any subprocessor is added.

Security

TLS in transit, tenant isolation checked server-side on every request, no passwords (sign-in is by emailed code, passkey or a sign-in provider), rate limiting, private networking between services, offsite backups encrypted at rest, and least-privilege access for the Operator's staff. Details are published in SECURITY.md in the source repository.

Your rights

You can export your account data (Your account → Export my data, in the menu under your name) and permanently delete your account in-product. For access, rectification, restriction, objection or any other request, contact the Operator (contact details are available from your account administrator). You may also lodge a complaint with your data protection authority.