Personal Data Processing Compliance

Last updated: October 28, 2026

Plerdy helps website owners improve their websites with heatmaps, session recordings, form analytics, popups and SEO tools. This page explains how Plerdy works with the EU General Data Protection Regulation (GDPR) and how we help you, as a website owner, use Plerdy in a compliant way.

Our role

Data about your website visitors: you are the controller, Plerdy is your processor. We process this data only on your instructions and only to provide the service to you.
Your Plerdy account data: Plerdy is the controller. See our Privacy Policy.

A Data Processing Agreement with Standard Contractual Clauses is available on request at [email protected].

Where data is stored

Servers, databases and session recordings: Germany, ISO/IEC 27001-certified data centres.
Our team works from Ukraine and may access data to provide support.

What Plerdy collects on your website

Tool	What is collected
Heatmaps and scroll maps	clicks, scrolling, page, device type, country
Session recordings	a reconstruction of the page and the visitor's actions, not a video; typed values are masked in the browser
Form analytics	which fields were used and errors, not what was typed
Popups and chat	what the visitor chooses to submit, for example name, email or message
Traffic sources, events, revenue	referrer, campaign tags, events, order ID and value

Plerdy uses a pseudonymous visitor ID kept in the browser's local storage to count repeat visits. IP addresses are used only to determine the country and are not stored. Under GDPR, pseudonymous data is still personal data, so we protect it in the same way.

How Plerdy helps you comply

Consent: set Plerdy to start only after the visitor agrees in your consent banner.
Privacy signals: Plerdy respects Global Privacy Control and Do Not Track.
Masking by default: values typed into form fields are masked in the visitor's browser before anything is sent. Password, email, phone, name and address fields are always masked. Elements marked data-sensitive, data-payment or data-private are not recorded.
Consent in popups: add a consent checkbox with a link to your privacy policy to any Plerdy popup form.
Retention: choose how long session recordings are kept. Other visitor data is deleted automatically after your plan's data history period.
Deletion: delete data about a specific visitor in your Plerdy account at any time.
No selling, no profiling: we do not sell visitor data, do not use it for our own purposes and do not combine data of different clients.

What you need to do

Mention Plerdy in your privacy policy.
Ask for consent before Plerdy starts, where your local law requires it.
Do not send directly identifying data, such as email addresses, to Plerdy as a visitor ID.
Answer your visitors' requests. We will help with the data we hold.

Security incidents

If a security incident affects your visitors' data or the Plerdy code on your website, we notify you without undue delay, so that you can meet your own obligations. More in our Security Policy.