Retention and deletion

IP addresses and location

• IP addresses aren’t stored by default. Each source has a Record IP address setting (“Off means country only, from the edge”). It’s off unless you turn it on.
• Country comes from Cloudflare’s network as the request arrives, without storing the address it came from.
• Browser, operating system and device type are read from the user agent, which is then discarded.
• Server events follow the same rule: $ip is kept only when the source records IP addresses, and $user_agent is never stored raw.
• No fingerprinting. A visitor is recognised only by the random ID in their browser’s storage, never from their IP address or device.

Retention

You choose how long to keep raw events when you create a project (Keep raw events for). Your choice is saved straight away. Automatic enforcement, which removes raw events once they pass that age, is still being switched on; until it is, contact us if you need older events removed sooner.

Exporting data

• Events: export the rows you’re looking at in Events as CSV, up to 50,000 at a time.
• Reports: insights have Export CSV, a funnel’s drop-off drawer and Traces have Export, each board has Export as CSV in its menu, and a board tile’s menu has Download CSV.
• Everything in an organization: an organization Owner can request an export in the organization’s settings. It arrives as a ZIP of JSON files: each project’s configuration (sources, identity links, funnels, segments, insights, boards, experiments, alerts) and its raw events. Events are included for organizations with up to 50,000 in total, and the JSON can’t exceed 8 MiB; above either limit the export can’t complete yet, so export events from Events instead.
• Your own account: export your personal account data from your account’s data and privacy settings.
• Through the API: the MCP server reads every report with a key.

Deleting data

• An organization: an Owner can delete it from the organization’s settings. Access stops at once; for 30 days it can be restored, and then its data, including every project’s events, is permanently removed.
• Your account: the same 30-day window applies.
• A source: Remove this source, on the source’s page, stops collection immediately.
• One person’s events: there’s no self-serve button yet. Contact us with the person’s ID to have their events removed.
• A key: revoking a server key or an MCP key takes effect on the next request.

GDPR checklist

What most teams do when they set up ClickClacks for European visitors:

1. Decide on consent. The tracker sets no cookies but does use browser storage. For visitors in the EU and UK, use opt-in mode (data-consent="opt-in") with your consent banner, or load the tag only after consent: see Consent and opt-out.
2. Keep IP recording off unless you need it.
3. Send IDs, not identities. Use an internal user ID with identify and as distinct_id, never an email address.
4. Keep personal data out of URLs and properties. The tracker strips well-known sensitive parameters, but can’t know what your paths and custom properties mean. What isn’t scrubbed lists the gaps.
5. Mask personal content in heatmap captures with data-cc-mask or skip selectors.
6. Pick the shortest retention that answers your questions.
7. List ClickClacks in your own privacy notice as the analytics service you use.
8. Keep the paperwork. ClickClacks processes visitor data for you as a processor. The data processing agreement and the subprocessor list are the documents your own records need.

What the AI features send

Ask, Explain, the friction investigator and event naming send your question and aggregate results to our AI provider: counts, rates and page-level summaries. They never send a person, a session, a visitor ID or an individual event.

• Query strings are removed from page paths, and ID-like path segments become :id.
• Values that look like email addresses, phone numbers or identifiers are replaced with (redacted), as are all values of a property named like personal data, such as email.
• A count of fewer than five people is shown to the model as <5.

The screening looks for patterns, so a person’s name or free text stored in a property value can still be read. Keep personal data out of event properties. The MCP server is different: there your own agent reads your data with your key, and nothing is filtered.

Requests from your users

• Access: find the person in People. Their profile shows their activity, and Open in Events lists every event, which you can export as CSV.
• Erasure: contact us with their ID. To stop collecting from their browser straight away, opt them out.
• Objection: opt-out is remembered in the browser, per hostname, until they opt back in.

Next steps

• What’s collected: every field and storage key.
• Security: how ClickClacks is run.
• Limits: sizes and rates.