Fullstory Privacy Policy

Effective Date: January 1, 2023

Thanks for visiting Fullstory.  This Privacy Policy describes how Fullstory (“we”) collect, use, share and protect information when you interact with our main website www.fullstory.com (the “Site”) and when you use the Fullstory SaaS analytics software and services (“Services”) and includes Personal Information collected via email, telephone, social media accounts, or other means.  This document also explains (1) the information we collect; (2) the specific ways we use and disclose that information; and (3) how you can exercise your privacy rights.  By using or accessing the Site or Services, you are accepting the practices described in this Privacy Policy and our processing of your information as described below.  Please note that if you are a Fullstory Customer, when you signed up for the Services, you entered into an agreement with Fullstory’s terms of use for the Services, which includes obligations in this Privacy Policy and our Acceptable Use Policy (the “Agreement”).  

Our Privacy Policy does not apply to services offered by other companies or individuals, including products or sites that may be displayed to you, or other sites linked from our Services. Our Privacy Policy does not cover the information practices of other companies and organizations who advertise our Services, and who may use cookies, pixel tags and other technologies to serve and offer relevant ads.

The Fullstory on Fullstory

The Fullstory Services utilize a powerful script that creates a new level of ease for website owners to understand the usability of their websites.  Website owners who use Fullstory Services can watch a DVR-like video playback of user sessions on their website, enabling meaningful insight into their users’ experience, as an effective way to identify usability problems and other areas for improvement.  Fullstory exists to make the web better for end-users, and it is only available to websites that share that goal.  Please also note that we use Fullstory on Fullstory.  In this regard, we use a separate instance of the Fullstory Services to monitor the instance of Fullstory Services that our customers use.  

In this Privacy Policy, we explain the following:

• Section 1:  Definitions

• Section 2:  How We Collect Information 

• Section 3:  What Information We Collect

• Section 4:  How we use your information

• Section 5:  How we share your information

• Section 6:  How we protect and store your information

• Section 7:  Your Privacy Options

• Section 8:  Children’s Information

• Section 9:  Jurisdiction-specific Notices

  • California Residents

  • Residents of the EEA, Switzerland, or UK

• Section 10:  Data Retention

• Section 11:  International Transfers

• Section 12:  Updates to this Privacy Policy

For questions about our privacy practices, contact us at: privacy@fullstory.com.

Section 1:  Definitions

“Fullstory” means Fullstory, Inc., a Delaware corporation.  We may also refer to Fullstory as “we,” “us,” or “our.”

“Fullstory Customer” means any customer that has entered into an agreement with Fullstory to use the Fullstory Services on its site, including those in a trial environment.

“Personal Information” means any information which may identify an individual, household or device, directly or indirectly.  Examples of Personal Information include, but are not limited to, first and last names, home address, billing address or other physical address, email address, telephone number, etc.

“User” refers to a visitor to a website that uses the Fullstory Services or a client of a Fullstory Customer

“Visitor” refers to anyone accessing the Fullstory website, www.fullstory.com.

Section 2:  How We Collect Information

We may collect information about you by the following means:

• Directly from you, when you provide information to us or interact with us or our affiliates;

• Automatically when you, or our Customer(s) utilize or interact with our Services;

• From online advertising companies who may share information about the marketing and advertisements you have seen or clicked on, and from social networks and other sources of publicly available data;

• From other third party sources that provide consumer data, such as information about your interests, demographic information, and marketing inferences.

Section 3:  What Information We Collect

The types of information we collect varies depending on whether you are a:

1. Fullstory Visitor

2. Fullstory Customer, or

3. A User, i.e. someone visiting a website that uses Fullstory Services

3.1 Fullstory Visitor

This section applies to Personal Information we may process in the usual course of business via the Site.

• Usage Details about your interaction with our Site (such as the pages visited, links clicked, non-sensitive text entered, mouse movements, referring URL;

• Device Information including the IP address and other details of a device that you use to connect with our Services (such as operating system, browser type, mobile network information, and the device's telephone number); 

• Location information we use publicly available sources to approximate your geographic region and Internet Service Provider based on your IP address;

• Contact information and any other information you choose to include when you communicate with us via email, mail, or other channels;

• Profile and subscription information, such as a username and password, your name, mailing address, e-mail address, user name, or subscription preferences, when you sign up for a free trial of the Services, create an account to license the Services;

• Survey information in response to questions we may send you through the Services, including for feedback and research purposes; 

• Biographical information when you inquire about or apply for a position with us;

• User Content you may provide to publicly post to the Fullstory blog or social media sites via the Services (e.g., comments).

3.2 Fullstory Customer

This section applies to Personal Information of Fullstory Customers that we may process via provision of the Fullstory Services.  Please note that Fullstory requests that all Customers provide notice to their website or mobile application visitors that they use the Fullstory Services.

• Transactional information including payment information and payment history if you engage in transactions through the Services;

• Usage Details about your interaction with our Site (such as the pages visited, links clicked, non-sensitive text entered, mouse movements, referring URL;

• Device Information including the IP address and other details of a device that you use to connect with our Services (such as operating system, browser type, mobile network information, and the device's telephone number); 

• Location information we use publicly available sources to approximate your geographic region and Internet Service Provider based on your IP address;

• Contact information and any other information you choose to include when you communicate with us via email, mail, or other channels;

• Survey information in response to questions we may send you through the Services, including for feedback and research purposes; 

• User Content you may provide to publicly post to the Fullstory blog or social media sites via the Services (e.g., comments);

• Profile and subscription information, such as a username and password, your name, mailing address, e-mail address, user name, or  subscription preferences, when you create an account to license the Services.

• Site usage and session information. We collect information about your interaction with the Services, including the resources that you access, pages viewed, how much time you spent on a page, and how you reached our website. We also log the details of your visits to our website and information generated in the course of using our website, such as mouse movements, clicks, page visits, text entered, how long you spent on a page, and other details of your actions on our website. 

Some of this information is collected through cookies, web beacons, and other tracking technologies, which may be operated by our partners who assist us in serving ads or providing other services to you. 

You may be able to opt out tracking by cookies or control how information collected by cookies is used via a number of means, as described in Section 7. Your Privacy Options.

Your browser or device may include “Do Not Track” functionality. We treat the data of everyone who comes to our site in accordance with this Privacy Policy, regardless of your Do Not Tracking setting.  That means that we will continue to use cookies and other technologies to provide you the features of our website but will block third parties from being able to collect data regarding your interactions with our website via cookies.

3.3 A User

For Users of a Fullstory Customer, Fullstory is acting as a service provider (or processor) to the Customer for Fullstory’s Services.  Fullstory collects information on the direction of its Customer, and has no direct relationship with the User whose information it processes.  It is important to understand that when a User visits other websites that use the Fullstory Services, the Fullstory Customer’s privacy policy applies to that information collected instead of this Privacy Policy.

This section applies to Personal Information Fullstory may process relating to Users of a Fullstory Customer’s website:

• Site usage and session information. We use first-party cookies and local storage to maintain a coherent scope for a user session across multiple pages on a single website.  Specifically, we collect information about a User's interaction when a Fullstory Customer uses our Services, including the resources that they access, pages viewed, how much time they spent on a page, and how they reached their website. We also log the details of their visits to our Customer’s website and information generated in the course of using our Customer’s website, such as mouse movements, clicks, page visits, text entered, how long they spent on a page, and other details of their actions on our Customer’s website. 

Section 4:  How We Use Your Information

4.1 We use the information we collect from Customers as agreed to in the Agreement and for the following purposes:

• To complete transactions between you and Fullstory;

• Respond to your requests, questions and comments and provide customer support;

• To support our legitimate interests of maintaining and improving our user experience, and the Site;

• To create aggregated analytical data, which we can use to provide and improve our respective Fullstory Services;

• Monitor the performance of our Services including metrics such as total number of visitors, and traffic; 

• Interact with you, including to notify you regarding products, services, and promotions that may be of interest to you and inform you about important changes to this Privacy Policy, our Terms or other policies;

• Tailor the content we display to you in our Services and communications, including advertising, and offer products and services that we believe may be of interest to you;

• Manage, operate, and improve the Services and grow our business, including understanding our customer base and the effectiveness of our marketing, events, promotional campaigns, and publications, and diagnose or fix technology problems;

• In a support context, to view details of your account to ensure that it complies with your contractual obligations to us;

• Evaluate, recruit, and hire personnel;

• To perform any other function that we believe in good faith is necessary to protect the security or proper functioning of the Fullstory website or the Fullstory Services;

• Comply with legal requirements and industry standards, detect, investigate, and prevent activities that may violate our policies or be fraudulent or illegal, and protect the rights of Fullstory, you, or others.

We may use and share information in an aggregated or de-identified manner at our discretion, including for research, analysis, modeling, marketing, and improvement of our Services.  Please note that per Fullstory’s terms and conditions, Customers are prohibited from providing Fullstory with sensitive data through usage of the Services.

4.2 We use the information we collect from Users of a Fullstory Customer’s website: 

• To perform any other function that we believe in good faith is necessary to protect the security or proper functioning of the Fullstory website or the Fullstory Services;

• Comply with legal requirements and industry standards, detect, investigate, and prevent activities that may violate our policies or be fraudulent or illegal, and protect the rights of Fullstory, you, or others.

• In a support context, to view details of your account to ensure that it complies with your contractual obligations to us;

• Manage, operate, and improve the Services;

• Monitor the performance of our Services including metrics such as total number of visitors, and traffic.

We may use and share information in an aggregated or de-identified manner at our discretion, including for research, analysis, modeling, marketing, and improvement of our Services. 

4.3 General Information on our use of Personal Information

• Fullstory Services do not and will not ever attempt to identify the same person across disparate, unrelated domains.  Fullstory takes pains in its engineering choices to differentiate itself from ad-tracking software. It is a violation of our Acceptable Use Policy for our customers to attempt to build multi-site user profiles for the intent of selling or exchanging lists of users for demographic information.

• We do not sell your data  (Customer, End-User or Visitor) to third parties or otherwise share it with non-agent third parties.  If this practice should change in the future we will update this policy to identify the parties and illustrate how individuals can exercise their right to opt out of such usage.

• Fullstory's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Section 5:  How We Share Your Information

• Service Providers. We may share your information with service providers that we believe need the information to perform a technology, business, or other professional function for us such as billing and collection, IT services, maintenance and hosting of our Services, payment processors, marketing partners, accounting, auditing, and tax services, and other professional services. 

• Analytics. We partner with analytics providers, who collect information via tracking technologies on our websites to assist us with measuring visits and traffic on our websites so we can measure and improve the performance of the sites.

• Advertising. We partner with third parties who assist us in serving advertising regarding the Services to others who may be interested in the Services, or who use cookies to display interest-based advertising to you on the Services. These third parties may use tracking technologies on our Fullstory website or applications to collect or receive information from the Services and elsewhere on the internet and use that information to provide measurement services and target ads. Third parties may allow other companies to access information about you so that they may market other products you may be interested in.

• Social Media. If you interact with us on social media platforms, the platform may be able to collect information about you and your interaction with us. If you interact with social media objects on our Services (for example, by clicking on a Facebook “like” button), both the platform and your connections on the platform may be able to view that activity. To control this sharing of information, please review the privacy policy of the relevant social media platform.

• Affiliates. We share information with other entities in our corporate family, for purposes consistent with this Privacy Policy. 

• Corporate Event. We reserve the right to transfer to another entity or its affiliates or service providers some or all information about you in connection with, or during negotiations of, any merger, acquisition, sale of assets or any line of business, change in ownership control, or financing transaction. We cannot promise that an acquiring party or the merged entity will have the same privacy practices or treat your information the same as described in this Policy.

• Legal. We share information where necessary to comply with applicable law, regulations, subpoenas, or to respond to requests from law enforcement agencies or other government authorities or third-parties, as required by law and without your consent when it is necessary to protect our customers, employees, or property; detect, prevent, or otherwise address fraud, security, or technical issues; in emergency situations; or to enforce our rights under our terms of service and policies.

• Please note that Fullstory only discloses information to our employees and third-party organizations that (1) need to know such information in order to process it on Fullstory’s behalf or to provide services as described above, and (2) have agreed not to disclose it to any other parties without Fullstory’s consent.  Some of the employees, contractors and affiliated organizations may be located outside of your home country; by using the Site and/or Services, you consent to the transfer of information to such individuals and organizations in order to accomplish these purposes.

Section 6.  How We Protect and Store Your Information

Fullstory takes all reasonably necessary precautions, such as implementing a combination of physical, technical, organizational, and administrative safeguards, to protect the information we collect through the Services. Specifically, at Fullstory we maintain a robust information security program, institute security controls with the Fullstory Services, such as TLS certificates and strong authentication options, and give our Customers facilities to exercise good security practices.   Although we take reasonable steps designed to protect your Personal Information, please be advised that no security system or means of transmitting data over the Internet can be guaranteed to be entirely secure (including without limitation with respect to computer viruses, malicious software and hacker attacks). We cannot and do not guarantee or warrant the security of your Personal Information or any information you disclose or transmit to us. We are not responsible for the acts of those who gain unauthorized access, and we make no warranty, express, implied or otherwise, that we will prevent such access, and we are not responsible for any damages or liabilities relating to any such incidents to the fullest extent permitted by law. Where required under law, we will notify you of any such loss, misuse or alteration of Personal Information that may affect you so that you can take the appropriate actions.

If you use our Services outside of the United States, you understand that we may collect, process, and store your Personal Information in the United States and other countries. 

Section 7. Your Privacy Options

You may have certain choices when it comes to how we collect and use your information:

• Account Information. If you have a Fullstory account, please visit the Account Settings page to update your information, sign up for product and service notifications, and update your Fullstory plan.

• Email Marketing. If at any time you no longer wish to receive marketing communications from us, you can click the unsubscribe link at the bottom of any email or email us at privacy@fullstory.com.  

• Opting out of Fullstory.  If you wish to prevent all websites using the Fullstory Services from being able to capture activity, you can opt-out of Fullstory Services.  Opting out will create a cookie that tells Fullstory to turn off capturing on any site that uses the Fullstory Services.  The presence of this cookie is required to continue opting out.  Please note that if you are considering opting-out, you understand that the purpose of Fullstory Services is to help well-intentioned companies make their website better for you. Most people who make websites are just like you: nice people who want to do a good job and make something awesome.  Without the Fullstory Services, companies may not have enough information to understand how to improve their website, or where people are running into pain-points.  They do not need to capture anything sensitive in order to do this, and we have a strictly Acceptable Use Policy, where you can see that Fullstory has high standards regarding how our customers respect your privacy.

• Online Activity Tracking and Interest-Based Advertising. You have several options to either prevent our collection of information regarding your online activity, or prevent third parties from using such information from being used for interest-based advertisements:

  • You can opt out or set preferences regarding cookies when a device you utilize visits the Sites, by clicking the Cookie Setting on the bottom of this page.

  • You can usually modify your browser setting to disable or reject cookies across the internet. Please note that if you delete your cookies or if you set your browser to decline cookies, some features of our website or Services may not function properly or be available.  In particular, Fullstory will not be able to coalesce your anonymous user identity automatically into sessions across pages on the same website.

  • If you are visiting the Services from a mobile device, the operating system of the device may offer you options regarding how the device collects and uses your information for interest-based advertising. Click here for more information.

  • Visit http://www.networkadvertising.org   or http://www.aboutads.info to learn more about your options for opting out of interest-based advertising (or if located in the EEA, UK, or Switzerland, click here). Please note this does not opt you out of being served ads. 

Section 8. Children’s Information

We do not knowingly or intentionally gather Personal information about children who are under the age of 13.  If you become aware that a child has provided us with Personal Information, a child has provided us with Personal Information, a parent or guardian of that child may contact us at privacy@fullstory.com to have the information deleted from our records. If we learn that we have inadvertently collected the Personal Information of a child under 16, or equivalent minimum age depending on jurisdiction, we will take steps to delete the information as soon as possible and cease the use of that information in accordance with applicable law.  

Section 9. Jurisdiction-Specific Notices

Certain jurisdictions may provide additional rights to individuals with respect to the collection and use of Personal Information that we have collected. For example, you may have the right to request that we: (i) disclose to you any Personal Information that we have about you; (ii) correct or delete Personal Information that we have about you (subject to certain exceptions); or (iii) not disclose or sell your information to a third party (excluding qualified service providers). If you are a resident of any of the following jurisdictions, click on your location to learn more.

1. California

California Consumer Privacy Act

The California Consumer Privacy Act (“CCPA”), along with the California Privacy Rights Act amendment, provides California residents with rights to receive certain disclosures regarding the collection, use, and sharing of information about them, as well as rights to know/access, delete, and limit sharing of Personal Information. You have the right to be free from discrimination based on your exercise of your CCPA rights.

Fullstory may disclose your Personal Information to commercial providers for a business purpose, which includes verifying your identity when you make a payment or registering access to your accounts.  When we disclose Personal Information for these reasons, we enter into a contract that describes the purpose and requires the recipient to both keep that Personal Information confidential and not to use it for any purpose except for the purposes set forth in the contract.

To the extent that we collect Personal Information that is subject to the CCPA, that information and our practices are described in our Privacy Notice for Californians page.

Notice at Collection Regarding the Categories of Personal Information Collected

You have the right to receive notice of the categories of Personal Information we collect, and the purposes for which those categories of Personal Information will be used. The categories we use below to describe the information are those enumerated in the CCPA.

Entities to whom we disclose information for business purposes are service providers, which are companies that we engage to conduct activities on our behalf. Service providers are restricted from using Personal Information for any purpose that is not related to our engagement.

The following chart describes information we collect when you act as a customer or prospective customer of our products and services or visit our website. The sources of this Personal Information are described in the Information We Collect section above. We collect this Personal Information for the purposes described in the “How We Use Your Information” section above.

In certain circumstances, you may submit your application for employment through a third-party service that displays our job posting.  We do not control the privacy practices of these third-party services. Please review their privacy policies carefully prior to submitting your application materials.

Privacy Rights for Californians

Under the CCPA, California residents have specific rights regarding their personal information. This section describes Californians' rights and explains how California residents can exercise those rights.

Below we further outline specific rights which California residents may have under the CCPA.

1. Right to Access Your Data. You have the right to request that we disclose certain information to you about our collection, use and disclosure of your Personal Information over the past twelve (12) months. Any disclosures we provide will only cover the 12- month period preceding the receipt of your request.  The response we provide will also explain the reasons we cannot comply with a request, if applicable.

2. Right to Data Portability. You have the right to a "portable" copy of your Personal Information that you have submitted to us. Generally, this means you have a right to request that we move, copy or transmit your Personal Information stored on our servers or information technology environment to another service provider's servers or information technology environment.

3. Right to Delete Your Data. You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your Personal Information from our records, unless an exception applies.

4. Right of correction. You have the right to request correction or changes of your Personal Information if it is found to be inaccurate or out of date.

5. Right to Non-Discrimination for the Exercise of Your Privacy Rights. You have the right not to receive discriminatory treatment by us for exercising your privacy rights conferred by the CCPA.

How to Submit a Request

You may submit a request to exercise your rights to know/access or delete your Personal Information through one of two means:

• Submit a request via email to privacy@fullstory.com, or 

• Call 1-833-385-5786 to submit your request.

Upon submission of your request, we will contact you via the email address provided in your request.  To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to the information.  In some instances, such as a request for data deletion, we may first separately confirm that you would like for us to in fact delete your personal information before acting on your request.  With all requests, we will aim to complete requests as soon as reasonably practicable and consistent with any timeframes mandated by applicable laws. If we require more time, we will inform you of the reason and extension period in writing. You may authorize another individual or a business registered with the California Secretary of State, or designate an authorized agent, to make requests on your behalf through these means. 

In some cases our ability to uphold these rights for you may depend upon our obligations to process Personal Information for security, safety, fraud prevention reasons, compliance with regulatory or legal requirements, or because processing is necessary to deliver the services you have requested. Where this is the case, we will inform you of specific details in response to your request.

We may deny your deletion request if retaining the information is necessary for us or our service providers to:

1. Complete the transaction for which we collected the Personal Information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you;

2. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities;

3. Debug products to identify and repair errors that impair existing intended functionality;

4. Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law;

5. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 seq.);

6. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent;

7. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us;

8. Comply with a legal obligation; or

9. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

B. Virginia

The Virginia Consumer Data Privacy Act (“VCDPA”), provides Virginia residents with certain additional privacy rights regarding the collection, use and sharing of Personal Information. Sections 2-5 of this Privacy Policy serves as notice of the categories of Personal Information we may collect about you, our processing purposes, and provides detail about how we may disclose your Personal Information to others such as Service Providers.

Fullstory does not sell certain Personal Information as described above. Fullstory does not engage in profiling in furtherance of decisions that produce legal or similarly significant effects. Fullstory does engage in “targeted advertising” as that term is defined in VCDPA.

Privacy Rights for Virginians

Under the VCDPA, Virginia residents have specific rights regarding their personal information. This section describes Virginians' rights and explains how Virginia residents can exercise those rights.  

1. Right to Access Your Data. You have the right to request that we disclose certain information to you about our collection, use and disclosure of your Personal Information over the past twelve (12) months. Any disclosures we provide will only cover the 12- month period preceding the receipt of your request.  The response we provide will also explain the reasons we cannot comply with a request, if applicable.

2. Right to Delete Your Data. You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your Personal Information from our records, unless an exception applies.

3. Right of correction. You have the right to request correction or changes of your Personal Information if it is found to be inaccurate or out of date.

4. Right to Data Portability. You have the right to a "portable" copy of your Personal Information that you have submitted to us. Generally, this means you have a right to request that we move, copy or transmit your Personal Information stored on our servers or information technology environment to another service provider's servers or information technology environment.

5. Right to Know and Opt-out. You have the right to know if we are processing your Personal Information, and you have the right to opt-out of the use of it for purposes of targeted advertising.

How to Submit a Request

You may submit a request to exercise your rights to know/access or delete your Personal Information through submitting a request via email to privacy@fullstory.com.

C. Colorado (Effective July 1, 2023)

Beginning July 1, 2023, under the Colorado Privacy Act (“CPA”), Colorado residents will have certain additional privacy rights regarding the collection, use and disclosure of their Personal Information. Sections 2-5 of this Privacy Policy describes the categories of data, processing purposes, and categories of third parties to whom Personal Information may be disclosed.  We do not sell Personal Information of Colorado residents and we do not process Personal Information for purposes of profiling in furtherance of decisions that produce legal or similarly significant effects.  Fullstory does engage in “targeted advertising” as that term is defined in CPA.

Privacy Rights for Coloradoians 

Under the CPA, Colorado residents have specific rights regarding their personal information. This section describes Coloradoians ' rights and explains how Colorado residents can exercise those rights.

1. Right to Opt Out of Targeted Advertising.  You have the right to opt out of the processing of personal data concerning the consumer for the purpose of targeted advertising.  The opt out mechanism will be made available as of the effective date.

2. Right to Data Portability. You have the right to a "portable" copy of your Personal Information that you have submitted to us. Generally, this means you have a right to request that we move, copy or transmit your Personal Information stored on our servers or information technology environment to another service provider's servers or information technology environment.

3. Right to Access Your Data. You have the right to request that we disclose certain information to you about our collection, use and disclosure of your Personal Information over the past twelve (12) months. Any disclosures we provide will only cover the 12- month period preceding the receipt of your request.  The response we provide will also explain the reasons we cannot comply with a request, if applicable.

4. Right of correction. You have the right to request correction or changes of your Personal Information if it is found to be inaccurate or out of date.

5. Right to Delete Your Data. You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your Personal Information from our records, unless an exception applies.

How to Submit a Request

You may submit a request to exercise your rights to know/access or delete your Personal Information through submitting a request via email to privacy@fullstory.com.  Please note that the right to appeal a decision to deny processing of a request by emailingprivacy@fullstory.com, using the subject line: “DSR Appeal.'' You may also contact the Colorado Attorney General if you have concerns about the result of the appeal.

D. Connecticut(Effective July 1, 2023)

Beginning July 1, 2023, under the Connecticut Data Privacy Act (“CDPA”), Connecticut residents will have certain additional privacy rights regarding the collection, use and disclosure of their Personal Information. Sections 2-5 of this Privacy Policy describes the categories of data, processing purposes, and categories of third parties to whom Personal Information may be disclosed.  We do not sell Personal Information of Connecticut residents and we do not process Personal Information for purposes of profiling in furtherance of decisions that produce legal or similarly significant effects. Fullstory does engage in “targeted advertising” as that term is defined in CTDPA.

Privacy Rights for Connecticut Residents 

Under the CDPA, Connecticut residents have specific rights regarding their personal information. This section describes those rights and explains how Connecticut residents can exercise those rights.

1. Right to Opt Out of Targeted Advertising.  You have the right to opt out of the processing of personal data concerning the consumer for the purpose of targeted advertising.  The opt out mechanism will be made available as of the effective date.

2. Right to Data Portability. You have the right to a "portable" copy of your Personal Information that you have submitted to us. Generally, this means you have a right to request that we move, copy or transmit your Personal Information stored on our servers or information technology environment to another service provider's servers or information technology environment.

3. Right to Access Your Data. You have the right to request that we disclose certain information to you about our collection, use and disclosure of your Personal Information over the past twelve (12) months. Any disclosures we provide will only cover the 12- month period preceding the receipt of your request.  The response we provide will also explain the reasons we cannot comply with a request, if applicable.

4. Right of correction. You have the right to request correction or changes of your Personal Information if it is found to be inaccurate or out of date.

5. Right to Delete Your Data. You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your Personal Information from our records, unless an exception applies.

How to Submit a Request

You may submit a request to exercise your rights to know/access or delete your Personal Information through submitting a request via email to privacy@fullstory.com.

E. EEA, Switzerland, or the UK

If you are located in the EEA, Switzerland, or the UK, you are entitled to certain rights, subject to applicable exceptions, under the GDPR, Swiss, and UK data protection laws. Please note that, in order to verify your identity, we may require you to provide us with information prior to accessing any records containing information about you.

We typically will process your information pursuant to the following legal bases: 

(1) with your consent; 

(2) as necessary to perform our agreement to provide Services to you; or 

(3) as necessary for our legitimate interests including but not limited to the following circumstances where collecting or using Personal Information is necessary for:

• Intra-organization transfers for administrative purposes;

• Product development and enhancement, where the processing enables Fullstory to enhance, modify, personalize, or otherwise improve our services and communications for the benefit of our Customers, and to better understand how people interact with our Site and Services;

• Fraud detection and prevention;

• Enhancement of our cybersecurity, including improving the security of our network and information systems; and

• General business operations and diligence;

We also may process your information where it is necessary to comply with a legal obligation to which we are subject.

• Right of Access: You have the right to obtain confirmation as to whether we are processing personal data about you, and if so, request a copy of the personal data. 

• Right to Correction: You have the right to correct any inaccuracies in the personal data that we hold about you and, where applicable, to complete any incomplete personal data that we hold.

• Right to Erasure: You have the right to request that we erase the personal data that we hold about you if one of the conditions in Article 17 of the GDPR applies. The right to erasure does not apply in certain circumstances, including where the processing is necessary for the establishment, exercise, or defense of legal claims.

• Right to Restriction of Processing: You have the right to restrict our processing of your personal data if one of the conditions in Article 18 of the GDPR applies.

• Right to Data Portability: You have the right to receive personal data concerning you in a structured, common, and machine-readable format or request transmission of the data to a third party, if the conditions in Article 20 of the GDPR are met.

• Right to Object: You have the right to object to the processing of your personal data based on our legitimate interests at any time. We will no longer process the data, unless there are compelling legitimate grounds for our processing that override the interests, rights, and freedoms of the data subject, or the processing serves the purpose of asserting, exercising, or defending legal claims. You also have the right to object at any time to the use of your data for direct marketing.

• Right to Withdraw Consent: If we are processing your personal data based on your consent, you have the right to withdraw your consent at any time.

To submit a request to exercise your rights, please request via email to privacy@fullstory.com, or call 1-833-385-5786.  We may have a reason under the law why we do not have to comply with your request, or may comply with it in a more limited way than you anticipated. If we do, we will explain that to you in our response.

Lodging a Complaint

Users that reside in the EEA, Switzerland, or the UK have the right to lodge a complaint about our data collection and processing actions with the supervisory authority concerned. Contact details for data protection authorities are available here.

F. Data Rights

If you are located in a jurisdiction outside of the aforementioned jurisdictions, and would like to request a data right (access, transfer,  deletion of your data, etc.) please submit your request via email to privacy@fullstory.com.  We will evaluate your request, based on 

Section 10: Data Retention

As a general rule, we keep your data for only as long as it is needed to complete the purpose for which it was collected or as required by law. We may need to keep your data for longer than our specified retention periods to honor your requests, including to continue keeping you opted out of marketing emails, or to comply with legal or other obligations. 

Section 11: International Transfers

We may, directly or indirectly through third-party entities around the world, process, store, and transfer the information you provide, including your Personal Information, as described in this Privacy Policy. Specifically, the information and Personal Information that we collect may be transferred to, and stored at, a location outside of your jurisdiction, including outside the European Economic Area (EEA) and the United Kingdom, and in countries that are not subject to an adequacy decision by the European Commission and that may not provide for the same level of data protection as your jurisdiction. It may also be processed by staff operating outside of your jurisdiction who work for us or for one of the organizations outlined in this Privacy Policy in connection with the activities outlined in this Privacy Policy. Fullstory is located in the United States and operates globally. We have data centers in the United States and in the European Union.  At the time that you contract for our Services, you have the option to designate the location of the data center which supports your Fullstory account.  

The laws in the United States regarding Personal Information may be different from the laws of your jurisdiction or country.  Any international transfers, collection, storage, or processing of your Personal Information will comply with safeguards as required by relevant law. 

A. Standard Contractual Clauses

For transfers from the European Union, the United Kingdom, or Switzerland to the United States, we will comply with applicable laws to provide an adequate level of data protection for the transfer of your personal data.  Fullstory relies on the European Commission approved Standard Contractual Clauses as a legal mechanism for data transfers from the E.U.

B. Data Privacy Framework

Fullstory also complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.  

Fullstory has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF.  

Fullstory has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF.  

If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.  To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Section 12: Updates to This Privacy Policy

We may make changes to this Policy from time to time. The “Effective Date” at the top of this page indicates when this Privacy Policy was last revised. We may also notify you in other ways from time to time about the collection, use, and disclosure of your Personal Information described in this Policy.