Vision is built to show how visitors use your site without collecting who they are or what they type. This page explains, in plain words, how visitor data is handled. The Privacy Policy and the Data Processing Agreement are the legal references.
Roles#
For data recorded on your website, your company is the controller and Henkan & Partners is the processor, acting on your instructions under the Data Processing Agreement. You accept the DPA when you create your organisation.
Masked in the browser#
The script applies these rules before any data leaves the visitor's browser:
| What | How it is handled |
|---|---|
| Every form field value | Replaced with ***. Vision records that the visitor typed, never what. |
| Password fields | Never captured. |
| Payment fields | Fields with card autocomplete, or names containing "card", "cvc" or "iban", are never captured. |
| Email addresses, phone numbers, card numbers and IBANs in page text | Replaced with ***. |
| All text on cart, checkout, account, order and profile pages | Replaced with asterisks, so names, addresses and order details stay hidden. |
Editable text areas (contenteditable) and elements with data-hv-mask | Text replaced with asterisks. |
Elements with data-hv-block | Left out of the recording entirely. |
| Page addresses | Query strings are removed, except campaign parameters. |
Identifiers and IP addresses#
Visitor data is pseudonymised, not anonymised: a random visitor identifier links the sessions of the same browser. Vision never stores visitors' IP addresses. For abuse protection it uses a one-way hash of the address combined with the site, kept only briefly for rate limiting. The country is derived when the request arrives and is left empty when it cannot be determined reliably. Without consent (in the default mode), no recording and no visitor identifier is created.
AI processing#
Session and pattern summaries are written by an AI model from timelines, friction tags, page addresses and basic session facts. The model never receives the raw recording or typed values. See AI summaries.
Storage and retention#
Data is hosted in the United States (AWS us-east-1, through Lovable Cloud). Transfers from the EU/EEA, the UK and Switzerland rely on the European Commission's Standard Contractual Clauses.
| Data | Kept for |
|---|---|
| Raw session replays | 30 days |
| Timelines, friction tags, summaries and patterns | 13 months |
Replays are stored in private storage. Members watch them through short-lived signed links (valid 5 minutes) issued only for sessions of their own organisation.
Access control#
- Organisation isolation. Every table is protected by row-level security in the database: members only ever see data of organisations they belong to. Hiding a button in the interface is never the only protection.
- Read-only recording data. Members cannot change or delete recorded sessions; only Vision's processing writes them.
- API keys. Keys are read-only, shown once and stored only as a SHA-256 fingerprint. A key stops working when the teammate who created it leaves the organisation. See API keys.
- Invitations. Invitation links expire after 7 days, and only a fingerprint of each link is stored.
Sub-processors#
| Sub-processor | Purpose |
|---|---|
| Lovable Labs Inc. (US) | Application hosting and Lovable Cloud |
| Supabase Inc. (US) | Database, authentication and file storage |
| Amazon Web Services (US, us-east-1) | Infrastructure |
| OpenAI, L.L.C. (US), through the Lovable AI gateway | AI summaries of sessions and patterns |
The DPA holds the authoritative list. Henkan informs customers before adding or replacing a sub-processor.
Your responsibilities#
You choose the legal basis for recording, configure your consent banner and inform your visitors. Mark any additional sensitive elements with data-hv-mask or data-hv-block. Visitors who want to exercise their rights contact you; Henkan helps you answer.