Trust center · Cuebased

What the SDK collects

Sanitized interaction metadata, sent only after the visitor grants analytics consent. The SDK never reads page text, and debug mode shows you the exact payloads that leave the browser.

Sent after consent

Signals the SDK sends after consent
Signal	What leaves the browser
Page path	The path only, with identifiers replaced: `/orders/10482391` becomes `/orders/:id`. Query strings and fragments are dropped.
Navigation	How the page was reached: a load, reload, back or forward, or a route change in a single-page app.
Referrer	The referring host only, such as `news.example.com`, or that the visitor came from another page of your site.
Campaign	UTM source, medium and campaign when they look like slugs, such as `spring_launch`. Values that look like identifiers are dropped.
Device and page context	The device class, one of `desktop`, `tablet` or `mobile`, plus the pointer type and the page’s declared language.
Clicks	The element’s role and approved `data-cb-*` keys, such as a button in `pricing.plans`. For links, only an internal path, an external host, or the fact that it was a `mailto:` or `tel:` link. Also the input method, and whether the page visibly responded.
Section exposure	How long annotated sections were in view, and their largest visible share. Exposure approximates visibility; it is not proof of reading.
Scroll depth	Scroll segments as percentages of the page, with direction and duration.
Hover dwell	Pauses over interactive elements, on pointing devices only, after a 300 ms threshold.
Form interaction	Focus, blur and submit as booleans and counts: whether a field was filled or invalid, and how many fields a form has. Never values.
Expand and collapse	The open or closed state of disclosures such as FAQ items.
Visibility	Whether the tab is visible or hidden, and page lifecycle changes.
Web Vitals	LCP, INP, CLS, FCP and TTFB measurements with their rating.
Goal attempts	Registered goal keys such as `demo_request`, recorded as attempts until your server confirms them, and custom events you registered.
Technical envelope	Random visit, tab and page identifiers created after consent, timestamps, SDK version, configuration revision, sampling rate and counts of dropped events.

Password fields, hidden inputs, payment fields marked with autocomplete="cc-…" and one-time-code fields are private automatically, as is anything inside an element marked data-cb-private. Events from private regions are discarded entirely. Inspect the payloads yourself.

Never sent

Page text
No headings, copy, labels or button text. The SDK never reads page text.
Input values
No values, keystrokes, selections or text lengths from any field.
Accessible names
No aria-label values or other accessible names.
Arbitrary attributes
No class names, element IDs or other attributes: only approved data-cb-* keys.
Query strings and fragments
Dropped from every URL before anything is sent.
mailto: and tel: addresses
Only the fact that such a link was clicked, never the address or number.
IP-based company lookup
Cuebased does not identify companies or people from IP addresses.
Cross-site identifiers
No cookies and no identifiers shared across websites or devices.
Fingerprinting
No device or browser fingerprinting of any kind.
Screen recordings
No video, screenshots or page snapshots in the core SDK.

Collection is deny-by-default. Your consent manager decides, and the SDK follows the latest signal.

pendingDefault
The starting state on every page load. No listeners, identifiers, storage or requests.
granted
Your consent manager granted analytics. Sanitized capture starts.
denied
The visitor refused, or the browser sent a Global Privacy Control signal. Nothing starts, and a project setting cannot override a visitor’s refusal.
revoked
Consent was withdrawn. Observers disconnect, and pending buffers and identifiers are cleared immediately.

Before a grant, nothing runs: no listeners, identifiers, storage or network requests. Loading the script is not permission to observe.
Continuing to browse is never treated as consent.
Global Privacy Control is respected by default: when the browser sends the signal, a grant is not applied.
Revocation clears in-memory buffers and visit identifiers immediately. Data that was already stored is removed through a deletion request.
Behavioral analytics is the only purpose the core SDK serves. Replay and identified lead context are not part of it; if they are added later, each will be a separately configurable purpose.
A remote configuration can reduce collection or switch the SDK off. It can never grant consent or expand collection.

Identifiers and storage

After consent, the SDK keeps one session storage entry, cb:v1:visit, holding random visit and tab identifiers, so page loads in the same tab continue the visit. It sets no cookies and uses no local storage. The entry is removed when consent is revoked. Visitors are never joined across websites or devices.

Retention

Proposed defaults. Evidence and the stories built on it expire together: a story is never shown after the evidence behind it has expired.

Proposed retention defaults and deletion behavior by data class
Data class	Proposed default	Deletion behavior
Browser memory buffer	Until acknowledged or the page ends	Cleared immediately on revocation; bounded size
Optional recovery storage	Disabled; at most 24 hours if enabled	Consent-gated and cleared on revocation
Free-plan events, states and stories	7 days	Expire together, including evidence references
Paid-plan events, states and stories	30 days	Configurable shorter; 90-day option only where justified
Optional replay (not yet available)	7 days, sampled	Independent controls, same erasure index
Known-lead links (not yet available)	Off by default; at most the evidence retention	Deleted on revocation, unlinking or erasure
Operational logs	14 days	No raw visitor payloads or secrets
Administrative audit records	12 months, minimized	Only justified account and security records
Rolling encrypted backups	Up to 35 days	Restricted access; erasure tombstones re-applied on restore

Processing regions

Primary processing is planned in Frankfurt, Germany, in the EU.

Frankfurt, Germany (EU)

Planned region for event ingestion and storage, the control database and application processing.

The SDK script is public code and may be served from a global CDN. Its URL never contains visitor identifiers, and visitor events go directly to the EU ingestion endpoint.

Not every subprocessor processes data only in the EU. Authentication metadata, billing, support and any future model provider can involve other processing locations and access arrangements. For that reason, Cuebased does not claim end-to-end EU-only processing.

No AI model provider is enabled. A provider would only be used after contractual and technical review, including a data processing agreement, retention terms and a transfer assessment where required. The product works without one: deterministic analytics, factual timelines and template stories need no model.

Subprocessors

A data processing agreement will be provided before paid production use.

Planned for production, subject to DPA and review

Subprocessors planned for production, subject to DPA and review
Subprocessor	Purpose	Processing location
Supabase	Authentication and control database	Frankfurt (EU)
Render	Application compute	Frankfurt (EU)
Amazon Web Services	Queue, sanitized event archive and transactional email	Frankfurt (EU)
ClickHouse Cloud	Event analytics	AWS Frankfurt (EU)
Stripe	Billing	Can include processing outside the EU
AI providers	None enabled. Any future provider only after review, and listed here first.	Not applicable

Security

Tenant isolation
Every record belongs to one workspace. Access derives from membership, with PostgreSQL row-level security as defense in depth.
Server keys
Shown once, stored only as a hash and revocable. Public project keys identify a project and are not secrets.
Signed webhooks
Planned
Deliveries will carry a timestamped HMAC signature and a stable delivery ID, so receivers can reject forgeries and replays.
Audit log
Configuration, member and key changes, exports and deletion requests are recorded. Support access tooling is planned and will be recorded in the same log.
Deletion tombstones
Erasures are recorded outside the data they remove and re-applied before any restored data is served.
Abuse limits
Per-project rate limits and quotas protect the public ingestion endpoint. They reduce forged traffic; they cannot rule it out.

Responsible disclosure

Report a vulnerability to security@cuebased.com. Please include enough detail for us to reproduce the issue.

Deletion requests

Delete a single visit, by its visit reference, or a whole project from the dashboard. Deletion covers stories and every derived record, not only raw events.

1
Immediately
Suppressed
The visit or project disappears from every dashboard view and API read as soon as you make the request.
2
Within 7 days (target)
Erased from live systems
Events, archives, visit states, stories, derived caches and pending jobs are removed, and affected opportunities are recomputed.
3
Up to 35 days
Backups age out
Rolling encrypted backups expire. If a backup is ever restored, erasure tombstones are re-applied before any data is served.

If a visitor who submitted one of your forms asks for erasure, the cb_visit_ref value stored with their submission identifies their visit. Cuebased holds no names or email addresses to search by. Once a visit is erased, new data for that visit reference is rejected.

The seven-day figure is an implementation target, not a substitute for legal deadlines or a claim of instant removal from backups.

The waitlist

Joining the waitlist stores your email address, and your website if you add it. We use them only to invite you when there is a spot, and delete them when you ask.

Kept

Your email address
Your website, if you add it
Which form you used, and when
The version of this notice you saw

Never kept or shared

Your IP address or browser details
Cookies, analytics or tracking IDs
Anything else from the page
Your address, with anyone else

Signups are stored in a private file store on our hosting provider, Vercel, in Frankfurt. Only the Cuebased team can read them.

To be removed, email hello@cuebased.com from the address you signed up with. Joining twice changes nothing, and the form never reveals whether an address is already listed. We will set a fixed retention period before launch and update this section.