Privacy policy

1. Visitors to sites that use Pairfully

When a website runs our script, it sends us a compact description of each visit: the pages viewed and the time on each, how far down each page was scrolled, the visible label of the links and buttons clicked, whether a form was started, sent or rejected and which field was invalid, JavaScript error messages, the referrer and UTM tags, and the device class. The country is looked up from the connection on our server. Every field is listed in the data sheet below.

• No cookies and no localStorage. A random tab id is kept in sessionStorage and deleted when the tab closes.
• Our server keeps a one-way hash of the connection’s IP address and browser to count return visits within a day. The key behind it changes every 24 hours and the hash is deleted after 24 hours.
• Nothing typed into a form is read. No recordings, screenshots or mouse movement are captured.
• Paths that look like they contain an email address or a long number are masked before they leave the browser.
• Email addresses, phone and card-like numbers, access tokens, ids and URL query strings are removed from click labels, form and field names, error messages and lead fields, in the browser and again on our server.

EU and UK consent rules cover more than cookies, so whether a site needs to ask its visitors before running Pairfully depends on that site and its other tools. The data sheet is written so a customer’s lawyer can decide. If a customer passes lead-form fields to us with identifyLead, emails, phone numbers and fields named like contact details are removed before anything is stored or judged. Free text is kept, with any email address, phone number, token or id written inside it removed.

2. Our role

For visitor data, our customer is the controller and Pairfully is a processor acting on their instructions. We process it only to produce the customer’s reports, alerts and lead scores, and we delete it when the customer deletes the site or the retention period for their plan ends. We do not sell, share or combine it across customers.

3. Customers with an account

• Account data: your email address, name, organisation name and role.
• Site configuration: domain, what the site sells, an ideal-customer description and key pages.
• Billing: plan, payment references and invoices, handled by our card provider. We never see card numbers.
• Alert targets you configure: an email address, a Slack webhook or a WhatsApp number.

We use this to run your account, send the reports and alerts you asked for, and bill you.

4. Sub-processors

• Our AI infrastructure provider processes the visit summary to judge each visit. It receives the summary only, after the personal-data removal described above, under a data processing agreement. The provider is named in our DPA, available on request.
• Railway hosts the application and database.
• Cloudflare R2 stores encrypted backups.
• Resend delivers email: reports, alerts and sign-in codes.
• Sentry records application errors in the signed-in app only. It is not loaded on our marketing pages, and it is set not to collect IP addresses.
• Bachs processes card payments. We never see card numbers.

5. Retention

Judged sessions are kept for 90 days on the Free plan, 13 months on Growth and Scale and 25 months on Agency, then deleted. Weekly reports are kept for the life of the account. Account data is deleted within 30 days of account closure.

6. Your rights

Customers can export or delete their data from Settings or by emailing us. Visitors to customer sites cannot be identified from what we hold, so there is nothing to look up; if you believe otherwise, contact the site owner or us at privacy@pairfully.com.

Data sheet

Every field the script sends, what happens to it, and who handles it.

• Page path, in order, with timing. Segments that look like an email address or contain six or more digits in a row are replaced with * in the browser.
• Referrer: the referring site and page only (origin and path), on the first page view.
• UTM tags: utm_source, utm_medium, utm_campaign, utm_term and utm_content on the landing URL. Other query parameters are never sent.
• Scroll depth: the furthest point reached on each page, as a percentage.
• Clicks: the visible label of the nearest link or button, cut at 40 characters, with emails, long numbers, tokens and ids removed. Three fast clicks are sent as a rage click with the same label, or the element’s tag name when there is no link or button.
• Forms: started, sent or rejected, the form’s name or id, and the name of an invalid field. Never field values.
• JavaScript errors: the message, with URL query strings, emails, long numbers, tokens and ids removed, cut at 120 characters.
• Device class: phone, tablet or desktop, from the user-agent string.
• Country: looked up from the connection on our server. The IP address itself is not stored.
• Daily visitor hash: a one-way hash of the IP address and browser with a key that changes every 24 hours. Deleted after 24 hours.
• Tab id: a random value in sessionStorage, deleted when the tab closes. Sent with each batch.
• Goals and purchases: that a goal you define, or a purchase, happened.
• Lead fields: only if you call identifyLead. Up to 20 fields; contact details, including ones written inside free text, are removed before anything is stored or judged.
• Retention: judged visits are kept for 90 days on Free, 13 months on Growth and Scale, and 25 months on Agency. Weekly reports are kept for the life of the account.
• Where it’s handled: Railway (hosting), Cloudflare R2 (encrypted backups), our AI infrastructure provider (judging), Resend (email), Sentry (errors, signed-in app only), Bachs (payments).

7. Changes

We will post changes here and, for material changes, email account owners at least 14 days before they take effect.