Privacy

Draft. This document describes how SaaS Pro Max handles data. It has not been reviewed by a lawyer and it is not a contract. It will be replaced before the product is generally available.

Last updated 2026-09-03.

Two different sets of data

SaaS Pro Max is a hosted service. It holds two kinds of data, and they are not governed the same way.

Console data is what you type into SaaS Pro Max: your name, your email address, your organization and application names, your API key metadata, your audit trail. We hold it on your behalf, and it is shown only to members of your organization whose role allows it.

Application data is what your own applications send through the SDKs: pageviews, custom events, person records, exceptions, metrics. You are the controller of that data and we process it for you. It stays in the database we operate for the service, it is never sold or shared with a third party, and you can read all of it back out through the Management API, the CSV export or a scheduled export to your own storage bucket.

What the SDKs collect

The browser SDK sends what you configure it to send. With the defaults on, that is: the page URL, path, title and referrer; UTM parameters and ad click ids from the landing URL; screen and viewport size; locale and timezone; a random anonymous id; a session id; and any events you fire yourself.

Automatic analytics does not collect keystrokes, form values or clipboard contents. Optional session replay requires a separate choice and an enabled application policy. It records page structure with text masked and inputs, code and private content excluded. Optional diagnostics records performance and interactions with explicitly marked controls. Surveys require a separate choice; survey and feedback responses are sent only when you submit them. Do not include secrets in a response.

On this site, you can change these choices on this Privacy page or your Account page. Turning off optional collection stops future capture; it cannot retract already submitted data. Console operational analytics follows the console's existing service contract; the optional features still require your choice.

IP addresses

Raw IP addresses are never stored. At ingest, the request IP is HMAC-hashed with a server-side secret (SPM_IP_HASH_SECRET) and only the hash is written, so the same visitor can be counted twice without the address being recoverable from the database. Country, region and city come from edge headers, not from an IP lookup table.

Cookies and cookieless mode

By default the browser SDK stores an anonymous id (spm_aid, 400 days), a session id (spm_sid, 30 minutes of inactivity), a distinct id after identify() (spm_did), and first/last touch attribution (spm_attr).

Set cookieless: true (or data-cookieless on the script tag) and it uses localStorage only and writes no cookies. Set consent: "pending" and it writes nothing and sends nothing until you call spm.consent("granted"). spm.optOut() stops collection for that browser.

The console itself sets spm_session, spm_csrf, spm_theme, spm_skin and the current organization and environment. All of them are functional; none of them are advertising cookies.

Personal data in the console

Emails, names and IP hashes are shown only to members whose role carries the people.pii.read permission. Provider secrets, connector private keys and destination tokens are envelope-encrypted in the vault, are never returned to the browser, and are decrypted server-side for exactly one outbound call.

Retention

Each application carries a retention window (365 days by default) that you set in Settings → Data. Deleting an application deletes its events.

Contact

Questions go to hello@saaspro.dev.