Pandus SDK documentation
Privacy and data
What the Pandus SDK collects and never collects, how URLs, fields and recordings are cleaned, where data is stored, how long it is kept and how to delete it.
Updated:
Pandus processes the data of your visitors on your behalf, as a processor. The terms are in the data processing agreement; the companies that help us are on the sub-processors page.
What is never collected
- What people type. Values of fields are never collected, not even in recordings.
- Who people are. No names, e-mails or phone numbers. Values that look like an e-mail, a phone or a card number are dropped in the browser and again on our server.
- Disability or assistive technology. The SDK never labels a person or a session as a screen reader user, a keyboard-only user or a person with a disability, and there are no tricks to detect it. Recordings cannot be filtered by input method or display preferences.
- The IP address. It is used for the country and region and to stop bots, then dropped. It is not written to storage.
What is collected after consent
| Data | Details |
|---|---|
| Page | URL with only allow-listed query parameters (utm_*, gclid, fbclid, q, s, search, page by default); e-mails and tokens are cut |
| Events | Name, time, page template and up to 25 parameters with simple values |
| Visit | _pandus_id cookie (13 months) and a session id (30 minutes of inactivity) |
| Device | Type, operating system, browser, screen size, language, from User-Agent Client Hints; no fingerprinting |
| Place | Country and region from the IP with the local DB-IP Lite database; city only if you switch it on. IP Geolocation by DB-IP |
| Barrier signals | Type, page, a stable selector, the WCAG criterion and a count, without text, values, session id or client id |
| Display preferences | Reduced motion, contrast, forced colours, zoom: only as shares, and only when at least 20 sessions stand behind them |
| Recordings | The page structure and what people did, with all text and fields masked |
Masking in recordings
Masking happens in the visitor's browser before anything is sent:
- every text becomes asterisks and every field shows dots;
- inputs, text areas, selects, editable content, payment fields (
autocomplete="cc-*") and elements withdata-pandus-maskstay masked whatever you set; - elements with
data-pandus-blockare not recorded at all; - you can show the text of chosen selectors, for example the navigation, in SDK → Settings;
- pages you exclude are not recorded. By default these are
/cart/pay*,/account*,/my-account*and/wp-admin*.
<section data-pandus-block>Never recorded</section>
<p data-pandus-mask>Always masked</p>
data-pandus-block and data-pandus-mask also keep the text of buttons out of click events and heatmaps.
Where data is stored
| What | Where |
|---|---|
| Events, barrier signals | ClickHouse Cloud on Google Cloud, London (UK, EU adequacy decision); ClickHouse, Inc. is certified under the EU–US Data Privacy Framework |
| Session recordings | Hetzner Object Storage, Falkenstein (Germany), served through short signed links |
| Settings, problems, barrier reports | Our servers in the EU |
How long it is kept
Events are kept for 13 months and recordings for 30 days by default; the values for your plan are on Limits. Older data is deleted automatically.
Deleting data
In SDK → Settings you can delete all SDK data of a site. When a visitor asks you to delete their data, delete it by their client id or consent id from the same page or through the API.
Your privacy policy
SDK → Install generates a text for your privacy policy in seven languages: what the SDK collects, the legal basis, the retention and the processors. It is a draft for your lawyer, not legal advice.
Countries
The SDK does not run on .ru, .by, .рф and .su sites.
The Pandus SDK and the scanner are automated checks, not a full audit, and not legal advice. The SDK changes nothing on your site and does not determine which visitors use assistive technology.