Fullstory Privacy Policy

Effective Date: May 19, 2025

Please click here for a printable PDF version of this Privacy Policy.

Thanks for visiting Fullstory. This Privacy Policy describes how Fullstory (“we”) collect, use, share and protect information when you interact with our main website www.fullstory.com (the “Site”) and when you use the Fullstory SaaS analytics software and services (“Services”) and includes Personal Information collected via email, telephone, social media accounts, or other means. This document also explains (1) the information we collect; (2) the specific ways we use and disclose that information; and (3) how you can exercise your privacy rights. By using or accessing the Site or Services, you are accepting the practices described in this Privacy Policy and our processing of your information as described below. Please note that if you are a Fullstory Customer (as defined below), when you signed up for the Services, you entered into an agreement with Fullstory’s terms of use for the Services, which includes obligations in this Privacy Policy and our Acceptable Use Policy (the “Agreement”).

Our Privacy Policy does not apply to services offered by other companies or individuals, including products or sites that may be displayed to you, or other sites linked from our Services. Our Privacy Policy does not cover the information practices of other companies and organizations who advertise our Services, and who may use cookies, pixel tags and other technologies to serve and offer relevant ads.

Residents in California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, Nevada, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Virginia, Utah, the European Economic Area (“EEA”), Switzerland, and the United Kingdom (“UK”), should refer to the body of this Privacy Policy as well as the “Privacy Rights” and “Jurisdiction-Specific Notices” sections below for additional information that may be applicable to them.

The Fullstory on Fullstory

The Fullstory Services utilize a powerful script that creates a new level of ease for website owners to understand the usability of their websites. Website owners who use Fullstory Services can watch a DVR-like video playback of user sessions on their website, enabling meaningful insight into their users’ experience, as an effective way to identify usability problems and other areas for improvement. Fullstory exists to make the web better for end-users, and it is only available to websites that share that goal. Please also note that we use Fullstory on Fullstory. In this regard, we use a separate instance of the Fullstory Services to monitor the instance of Fullstory Services that our customers use.

In this Privacy Policy, we explain the following:

• Section 1: Definitions

• Section 2: How We Collect Information

• Section 3: What Information We Collect

• Section 4: How We Use Your Information

• Section 5: How We Share Your Information

• Section 6: How We Protect and Store Your Information

• Section 7: Your Privacy Options

• Section 8: Children’s Information

• Section 9: Privacy Rights

• Section 10: Jurisdiction-Specific Notices

• A. California

• B. Residents of the EEA, Switzerland, or UK

• Section 11: Data Retention

• Section 12: International Transfers

• Section 13: Updates to this Privacy Policy

For questions about our privacy practices, contact us at: privacy@fullstory.com.

Section 1: Definitions

“Fullstory” means Fullstory, Inc., a Delaware corporation. We may also refer to Fullstory as “we,” “us,” or “our.”

“Fullstory Customer” means any customer that has entered into an agreement with Fullstory to use the Fullstory Services on its site, including those in a trial environment.

“Personal Information” means any information which may identify an individual, household or device, directly or indirectly. Examples of Personal Information include, but are not limited to, first and last names, home address, billing address or other physical address, email address, telephone number, etc.

“User” refers to a visitor to a website that uses the Fullstory Services or a client of a Fullstory Customer

“Visitor” refers to anyone accessing the Fullstory Site or posting information on our webpage on a social media platform.

Section 2: How We Collect Information

We may collect information about you by the following means:

• Directly from you, when you provide information to us or interact with us or our affiliates;

• Automatically when you, or our Customer(s) utilize or interact with our Services;

• From online advertising companies who may share information about the marketing and advertisements you have seen or clicked on, and from social networks and other sources of publicly available data;

• From other third party sources that provide consumer data, such as information about your interests, demographic information, and marketing inferences.

Section 3: What Information We Collect

The types of information we collect varies depending on whether you are a:

• Fullstory Visitor

• Fullstory Customer, or

• A User, i.e. someone visiting a website that uses Fullstory Services

3.1 Fullstory Visitor

This section applies to Personal Information we may process in the usual course of business via the Site.

• Usage Details

  about your interaction with our Site (such as the pages visited, links clicked, non-sensitive text entered, mouse movements, referring URL;

• Device Information

  including the IP address and other details of a device that you use to connect to our Site (such as operating system, browser type, mobile network information, and the device's telephone number);

• Location information

  we use publicly available sources to approximate your geographic region and Internet Service Provider based on your IP address;

• Contact information

  and any other information you choose to include when you communicate with us, including to request a demo, via the chat function on the Site, email, mail, or other channels, including the contents of your communication;

• Profile and subscription information

  , such as a username and password, your name, mailing address, e-mail address, user name, or subscription preferences, when you sign up for a free trial of the Services, create an account to license the Services;

• Survey information

  in response to questions we may send you through the Site, including for feedback and research purposes;

• Biographical information

  when you inquire about or apply for a position with us;

• Education, employment, and other job application information

  when you inquire about or apply for a position with us; and

• User Content

  you may provide to publicly post to the Fullstory blog or on social media sites via the Site (e.g., comments); we may also collect your Personal Information, such as your social media username, and other personal characteristics that you have made publicly available on the social media website. Note that the third-party operators of social media websites also receive such information, and their use of your Personal Information is governed by their own privacy policies.

3.2 Fullstory Customer

This section applies to Personal Information of Fullstory Customers that we may process via provision of the Fullstory Services. Please note that Fullstory requests that all Customers provide notice to their website or mobile application visitors that they use the Fullstory Services.

• Transactional information

  including payment information and payment history if you engage in transactions through the Services;

• Usage Details

  about your interaction with our Site (such as the pages visited, links clicked, non-sensitive text entered, mouse movements, referring URL;

• Device Information

  including the IP address and other details of a device that you use to connect with our Services (such as operating system, browser type, mobile network information, and the device's telephone number);

• Location information

  we use publicly available sources to approximate your geographic region and Internet Service Provider based on your IP address;

• Business contact information

  and any other information you choose to include when you communicate with us, including to provide a customer story (which may be publicly posted), via email, mail, or other channels;

• Survey information

  in response to questions we may send you through the Services, including for feedback and research purposes;

• User Content

  you may provide to publicly post to the Fullstory blog, in relation to a customer story, or on social media sites via the Services (e.g., comments);

• Profile and subscription information

  , such as a username and password, your name, mailing address, e-mail address, user name, or subscription preferences, when you create an account to license the Services; and

• Site usage and session information

  . We collect information about your interaction with the Services, including the resources that you access, pages viewed, how much time you spent on a page, and how you reached our Site. We also log the details of your visits to our Site and information generated in the course of using our Site, such as mouse movements, clicks, page visits, text entered, how long you spent on a page, and other details of your actions on our Site.

Some of this information is collected through cookies, web beacons, and other tracking technologies, which may be operated by our partners who assist us in serving ads or providing other services to you.

For more information about the cookies that we use and how you may be able to opt out tracking by cookies or control how information collected by cookies is used via a number of means, please see our Cookie Policy.

We will comply with do not track signals as required by applicable law.

3.3 A User

For Users of a Fullstory Customer, Fullstory is acting as a service provider (or processor) to the Customer for Fullstory’s Services. Fullstory collects information on the direction of its Customer, and has no direct relationship with the User whose information it processes. It is important to understand that when a User visits other websites that use the Fullstory Services, the Fullstory Customer’s privacy policy applies to that information collected instead of this Privacy Policy.

This section applies to Personal Information Fullstory may process relating to Users of a Fullstory Customer’s website:

• Site usage and session information

  . We use first-party cookies and local storage to maintain a coherent scope for a user session across multiple pages on a single website. Specifically, we collect information about a User's interaction when a Fullstory Customer uses our Services, including the resources that they access, pages viewed, how much time they spent on a page, and how they reached their website. We also log the details of their visits to our Customer’s website and information generated in the course of using our Customer’s website, such as mouse movements, clicks, page visits, text entered, how long they spent on a page, and other details of their actions on our Customer’s website.

Section 4: How We Use Your Information

4.1 We use the information we collect from Visitors to:

• Respond to your requests, questions and comments and provide customer support;

• Support our legitimate interests of maintaining and improving our user experience, and the Site;

• Monitor the performance of our Site including metrics such as total number of visitors, and traffic;

• Interact with you, including to notify you regarding products, services, and promotions that may be of interest to you and inform you about important changes to this Privacy Policy, our Terms or other policies;

• Evaluate, recruit, and hire personnel;

• Perform any other function that we believe in good faith is necessary to protect the security or proper functioning of the Site;

• Tailor the content we display to you in our Site and communications, including advertising, and offer products and services that we believe may be of interest to you; and

• Comply with legal requirements and industry standards, detect, investigate, and prevent activities that may violate our policies or be fraudulent or illegal, and protect the rights of Fullstory, you, or others.

4.2 We use the information we collect from Customers as agreed to in the Agreement and for the following purposes, to:

• Complete transactions between you and Fullstory;

• Respond to your requests, questions and comments and provide customer support;

• Support our legitimate interests of maintaining and improving our user experience, and the Site;

• Create aggregated analytical data, which we can use to provide and improve our respective Fullstory Services;

• Monitor the performance of our Services including metrics such as total number of visitors, and traffic;

• Interact with you, including to notify you regarding products, services, and promotions that may be of interest to you and inform you about important changes to this Privacy Policy, our Terms or other policies;

• Tailor the content we display to you in our Services and communications, including advertising, and offer products and services that we believe may be of interest to you;

• Manage, operate, and improve the Services and grow our business, including understanding our customer base and the effectiveness of our marketing, events, promotional campaigns, and publications, and diagnose or fix technology problems;

• View details of your account in a support context to ensure that it complies with your contractual obligations to us;

• Perform any other function that we believe in good faith is necessary to protect the security or proper functioning of the Site or the Fullstory Services;

• Send SMS/text communications to the phone number you provide, when permissible by law and with your consent, to communicate for permissible purposes, including about updates to terms or policies or about our products and services (including promotions that may be of interest to you); and

• Comply with legal requirements and industry standards, detect, investigate, and prevent activities that may violate our policies or be fraudulent or illegal, and protect the rights of Fullstory, you, or others.

We may use and share information in an aggregated or de-identified manner at our discretion, including for research, analysis, modeling, marketing, and improvement of our Services. Please note that per Fullstory’s terms and conditions, Customers are prohibited from providing Fullstory with sensitive data through usage of the Services.

4.3 We use the information we collect from Users of a Fullstory Customer’s website to:

• Perform any other function that we believe in good faith is necessary to protect the security or proper functioning of the Fullstory Site or the Fullstory Services;

• Comply with legal requirements and industry standards, detect, investigate, and prevent activities that may violate our policies or be fraudulent or illegal, and protect the rights of Fullstory, you, or others.

• View details of your account in a support context to ensure that it complies with your contractual obligations to us;

• Manage, operate, and improve the Services; and

• Monitor the performance of our Services including metrics such as total number of visitors, and traffic.

We may use and share information in an aggregated or de-identified manner at our discretion, including for research, analysis, modeling, marketing, and improvement of our Services.

4.4 General Information on our use of Personal Information in relation to the Services

• Fullstory Services do not and will not ever attempt to identify the same person across disparate, unrelated domains. Fullstory takes pains in its engineering choices to differentiate itself from ad-tracking software. It is a violation of our

  Acceptable Use Policy

  for our customers to attempt to build multi-site user profiles for the intent of selling or exchanging lists of users for demographic information.

• We do not sell the data of our Customers or their Users collected through the Services to third parties or otherwise share it with non-agent third parties. If this practice should change in the future we will update this Privacy Policy to identify the parties and illustrate how individuals can exercise their right to opt out of such usage.

• Fullstory's use and transfer to any other app of information received from Google APIs will adhere to

  Google API Services User Data Policy

  , including the Limited Use requirements.

Section 5: How We Share Your Information

• Service Providers.

  We may share your information with service providers that we believe need the information to perform a technology, business, or other professional function for us such as billing and collection, IT services, maintenance and hosting of our Site or Services, payment processors, marketing partners, accounting, auditing, and tax services, and other professional services.

• Analytics

  . We partner with analytics providers, who collect information via tracking technologies on our Site to assist us with measuring visits and traffic on our Site so we can measure and improve the performance of the sites.

• Advertising.

  We partner with third parties who assist us in serving advertising regarding the Services to others who may be interested in the Services, or who use cookies to display interest-based advertising to you on the Site. These third parties may use tracking technologies on our Site or applications to collect or receive information from the Site and elsewhere on the internet and use that information to provide measurement services and target ads. Third parties may allow other companies to access information about you so that they may market other products you may be interested in.

• Social Media.

  If you interact with us on social media platforms, the platform may be able to collect information about you and your interaction with us. If you interact with social media objects on our Site (for example, by clicking on a Facebook “like” button), both the platform and your connections on the platform may be able to view that activity. To control this sharing of information, please review the privacy policy of the relevant social media platform.

• Affiliates.

  We share information with other entities in our corporate family, for purposes consistent with this Privacy Policy.

• Corporate Event.

  We reserve the right to transfer to another entity or its affiliates or service providers some or all information about you in connection with, or during negotiations of, any merger, acquisition, sale of assets or any line of business, change in ownership control, or financing transaction. We cannot promise that an acquiring party or the merged entity will have the same privacy practices or treat your information the same as described in this Privacy Policy.

• Legal.

  We share information where necessary to comply with applicable law, regulations, subpoenas, or to respond to requests from law enforcement agencies or other government authorities or third-parties, as required by law and without your consent when it is necessary to protect our customers, employees, or property; detect, prevent, or otherwise address fraud, security, or technical issues; in emergency situations; or to enforce our rights under our terms of service and policies.

• Please note that Fullstory only discloses information to our employees and third-party organizations that (1) need to know such information in order to process it on Fullstory’s behalf or to provide services as described above, and (2) have agreed not to disclose it to any other parties without Fullstory’s consent. Some of the employees, contractors and affiliated organizations may be located outside of your home country; by using the Site and/or Services, you acknowledge the transfer of information to such individuals and organizations in order to accomplish these purposes.

Section 6. How We Protect and Store Your Information

Fullstory takes reasonably necessary precautions, such as implementing a combination of physical, technical, organizational, and administrative safeguards, to protect the information we collect through the Site and the Services. Although we take reasonable steps designed to protect your Personal Information, please be advised that no security system or means of transmitting data over the Internet can be guaranteed to be entirely secure (including without limitation with respect to computer viruses, malicious software and hacker attacks). We cannot and do not guarantee or warrant the security of your Personal Information or any information you disclose or transmit to us. You acknowledge that we are not responsible for the acts of those who gain unauthorized access and that we cannot guarantee to prevent such access.

If you use our Services outside of the United States, you understand that we may collect, process, and store your Personal Information in the United States and other countries.

Section 7. Your Privacy Options

You may have certain options when it comes to how we collect and use your information:

• Account Information

  . If you have a Fullstory account, please visit the

  Account Settings

  page to update your information, sign up for product and service notifications, and update your Fullstory plan.

• Email Marketing

  . If at any time you no longer wish to receive marketing communications from us, you can click the unsubscribe link at the bottom of any email or email us at

  privacy@fullstory.com

  .

• SMS/text Communications

  . Please note, if you provide your phone number and consent to receive SMS/text communications from us, we will do so in a manner that is consistent with your consent. You can withdraw your consent and opt out of receiving SMS/text communications at any time by replying "STOP" to our messages or otherwise following the instructions included in the messages we send.

• Opting out of Fullstory.

  If you wish to prevent all websites using the Fullstory Services from being able to capture activity, you can

  opt-out

  of Fullstory Services. Opting out will create a cookie that tells Fullstory to turn off capturing on any site that uses the Fullstory Services. The presence of this cookie is required to continue opting out. Please note that if you are considering opting-out, you understand that the purpose of Fullstory Services is to help well-intentioned companies make their website better for you. Most people who make websites are just like you: nice people who want to do a good job and make something awesome. Without the Fullstory Services, companies may not have enough information to understand how to improve their website, or where people are running into pain-points. They do not need to capture anything sensitive in order to do this, and we have a strict

  Acceptable Use Policy,

  where you can see that Fullstory has high standards regarding how our customers respect your privacy.

Section 8. Children’s Information

We do not knowingly or intentionally gather Personal information about children who are under the age of 16. If you become aware that a child has provided us with Personal Information, a child has provided us with Personal Information, a parent or guardian of that child may contact us at privacy@fullstory.com to have the information deleted from our records. If we learn that we have inadvertently collected the Personal Information of a child under 16, or equivalent minimum age depending on jurisdiction, we will take steps to delete the information as soon as possible and cease the use of that information in accordance with applicable law.

Section 9. Privacy Rights

Certain jurisdictions have specific legal requirements and grant privacy rights with respect to Personal Information, and we will comply with restrictions and any requests you submit as required by applicable law. If you are a EEA, UK, Switzerland, or California resident, see the Jurisdiction-Specific Notices section below for additional information as to your rights and to how to exercise those rights.

Nevada residents have the right to opt out of the sale of certain pieces of their information to third parties who will license or sell their information to others. However, Fullstory does not sell Personal Information as contemplated by Nevada law.

If you are a resident of one of the U.S. states listed below, you have one or more of the following rights: (1) to request additional information about our data collection, use, disclosure, and sales practices in connection with your Personal Information; (2) to request the specific Personal Information collected about you; (3) to request the deletion of the Personal Information we have about you, with exceptions; (4) to request a restriction on certain processing of Personal Information; (5) to request correction of inaccurate information; (6) to opt-out of the processing of Personal Information for the purpose of “profiling” in furtherance of decisions that produce legal or similarly significant effects; and (7) to opt-out of the “selling” and “sharing”/“targeted advertising” of Personal Information as such terms are defined under U.S. state privacy laws.

Please note, that in relation to Visitors’ Personal Information, Fullstory sells certain Personal Information and shares Personal Information/engages in “targeted advertising” in relation to Personal Information collected on the Site. For a description of the categories of Personal Information that are sold or shared/used for targeted advertising and for a description of the categories of third parties that such Personal Information is disclosed to, see the "California" section below. In relation to Customers and Users that use the Services, Fullstory does not sell or share Personal Information, or engage in “targeted advertising”. Fullstory does not engage in profiling in furtherance of decisions that produce legal or similarly significant effects. You may also have the right to not be discriminated against for exercising your privacy rights. If you are a resident of one of the following U.S. states, you have one or more of these rights:

If you are located outside of these jurisdictions and seek to exercise your rights under the law of another jurisdiction, please contact us by emailing privacy@fullstory.com.

You or your authorized agent may submit a request regarding your Personal Information by:

• Emailing:

  privacy@fullstory.com

  .

• Call 1-833-385-5786 to submit your request.

To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to the information. We may need to request specific information from you to help us confirm your identity. This is a security measure to ensure that Personal Information is not disclosed to any person who has no right to receive it. When you make a request, we may require that you provide information and follow procedures so that we can verify your identity (and the applicable jurisdiction). The verification steps we take may differ depending on your jurisdiction and the request. Where possible, we will attempt to match the information that you provide in your request to information we already have on file to verify your identity. If we are able to verify your request, we will process it. If we cannot verify your request, we may ask you for additional information to help us do so.

We will respond to your request within the time period required by applicable law. However, we may not always be able or required to comply with your request, in whole or in part, and we will notify you in that event.

Section 10. Jurisdiction-Specific Notices

A. California

California Consumer Privacy Act

The California Consumer Privacy Act (“CCPA”), along with the California Privacy Rights Act amendment, provides California residents with rights to receive certain disclosures regarding the collection, use, and sharing of information about them, as well as rights to know/access, delete, and limit sharing of Personal Information. You have the right to be free from discrimination based on your exercise of your CCPA rights.

Fullstory may disclose your Personal Information to commercial providers for a business purpose, which includes verifying your identity when you make a payment or registering access to your accounts. When we disclose Personal Information for these reasons, we enter into a contract that describes the purpose and requires the recipient to both keep that Personal Information confidential and not to use it for any purpose except for the purposes set forth in the contract.

Notice at Collection Regarding the Categories of Personal Information Collected

You have the right to receive notice of the categories of Personal Information we collect, and the purposes for which those categories of Personal Information will be used. The categories we use below to describe the information are those enumerated in the CCPA.

Entities to whom we disclose information for business purposes are service providers, which are companies that we engage to conduct activities on our behalf. Service providers are restricted from using Personal Information for any purpose that is not related to our engagement.

The following chart describes information we collect when you act as a customer or prospective customer of our products and services or visit our Site. The sources of this Personal Information are described in the Information We Collect section above. We collect this Personal Information for the purposes described in the “How We Use Your Information” section above.

In certain circumstances, you may submit your application for employment through a third-party service that displays our job posting. We do not control the privacy practices of these third-party services. Please review their privacy policies carefully prior to submitting your application materials.

Privacy Rights for Californians

Under the CCPA, California residents have specific rights regarding their Personal Information. This section describes Californians' rights and explains how California residents can exercise those rights.

Below we further outline specific rights which California residents may have under the CCPA.

• Right to Access Your Data.

  You have the right to request that we disclose certain information to you about our collection, use and disclosure of your Personal Information. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

• Right to Data Portability.

  You have the right to a "portable" copy of your Personal Information that you have submitted to us. Generally, this means you have a right to request that we move, copy or transmit your Personal Information stored on our servers or information technology environment to another service provider's servers or information technology environment.

• Right to Delete Your Data.

  You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your Personal Information from our records, unless an exception applies.

• Right to Opt-Out

  . You have the right to opt-out of the sale of and sharing your Personal Information as such terms are defined by the CCPA. You may exercise your opt-out right on the Fullstory homepage by using the “Do Not Sell or Share My Personal Information” link.

• Right of correction

  . You have the right to request correction or changes of your Personal Information if it is found to be inaccurate or out of date.

• Right to Non-Discrimination for the Exercise of Your Privacy Rights.

  You have the right not to receive discriminatory treatment by us for exercising your privacy rights conferred by the CCPA.

How to Submit a Request

You may submit a request to exercise your rights to know/access, correct, or delete your Personal Information through one of two means:

• Submit a request via email to

  privacy@fullstory.com

  , or

• Call 1-833-385-5786 to submit your request.

Upon submission of your request, we will contact you via the email address provided in your request. To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to the information. In some instances, such as a request for data deletion, we may first separately confirm that you would like for us to in fact delete your Personal Information before acting on your request. With all requests, we will aim to complete requests as soon as reasonably practicable and consistent with any timeframes mandated by applicable laws. If we require more time, we will inform you of the reason and extension period in writing. You may designate an authorized agent to make requests on your behalf.

In some cases our ability to uphold these rights for you may depend upon our obligations to process Personal Information for security, safety, fraud prevention reasons, compliance with regulatory or legal requirements, or because processing is necessary to deliver the services you have requested. Where this is the case, we will inform you of specific details in response to your request.

B. EEA, Switzerland, or the UK

If you are located in the EEA, Switzerland, or the UK, you are entitled to certain rights, subject to applicable exceptions, under the GDPR, Swiss, and UK data protection laws. We comply with the EU-U.S., UK Extension to the EU-U.S., and Swiss-U.S. Data Privacy Frameworks. Please note that, in order to verify your identity, we may require you to provide us with information prior to accessing any records containing information about you.

We typically will process your information pursuant to the following legal bases:

(1) with your consent;

(2) as necessary to perform our agreement to provide Services to you; or

(3) as necessary for our legitimate interests including but not limited to the following circumstances where collecting or using Personal Information is necessary for:

• Intra-organization transfers for administrative purposes;

• Product development and enhancement, where the processing enables Fullstory to enhance, modify, personalize, or otherwise improve our services and communications for the benefit of our Customers, and to better understand how people interact with our Site and Services;

• Fraud detection and prevention;

• Enhancement of our cybersecurity, including improving the security of our network and information systems; and

• General business operations and diligence;

We also may process your information where it is necessary to comply with a legal obligation to which we are subject.

• Right to be informed

  . You are entitled to be informed of the use of your Personal Information. This Privacy Policy provides such information to you.

• Right of Access:

  You have the right to access your Personal Information (commonly known as a “subject access request”). This enables you to receive a copy of the Personal Information we hold about you and to check that we are lawfully processing it.

• Right to Correction:

  You have the right to request correction of the Personal Information that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

• Right to Erasure:

  You have the right to request erasure of your Personal Information in certain circumstances. This enables you to ask us to delete or remove Personal Information where there is not a good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Information where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your Personal Information to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

• Right to Restriction of Processing:

  You have the right to restrict the processing of your Personal Information. This enables you to ask us to suspend the processing of your Personal Information in one of the following scenarios:

• If you want us to establish the data’s accuracy;

• Where our use of the data is unlawful but you do not want us to erase it;

• Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or

• You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

• Right to Data Portability

  : You have the right to request the transfer of your Personal Information to you or to a third party. We will provide to you, or a third party you have chosen, your Personal Information in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you. We do not use Personal Information to make automated decisions about you in any situations where you may have a legal right to opt out.

• Right to Object

  : You have the right to object to the processing of your Personal Information where we are relying on a legitimate interest (or those of a third party) as the legal basis for that particular use of your data (including carrying out profiling based on our legitimate interests). In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object. You also have the absolute right to object any time to the processing of your Personal Information for direct marketing purposes.

• Right to Withdraw Consent

  : If we are processing your Personal Information based on your consent, you have the right to withdraw your consent at any time.

To submit a request to exercise your rights, please request via email to privacy@fullstory.com, or call 1-833-385-5786. We may have a reason under the law why we do not have to comply with your request, or may comply with it in a more limited way than you anticipated. If we do, we will explain that to you in our response.

We endeavor to respond to a verifiable consumer request within thirty days of its receipt consistent with applicable law. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded and we could refuse to comply with your request in these circumstances. We may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive.

Lodging a Complaint

You also have the right to file a complaint by contacting your local supervisory authority for data protection. Contact details for EU data protection authorities are available at https://ec.europa.eu/newsroom/article29/items/612080. If you are based in the UK, you can make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk).

Section 11: Data Retention

As a general rule, we keep your data for only as long as it is needed to complete the purpose for which it was collected or as required by law. We may need to keep your data for longer than our specified retention periods to honor your requests, including to continue keeping you opted out of marketing emails, or to comply with legal or other obligations.

We determine the appropriate retention period for Personal Information based on certain criteria, including:

• The duration of our relationship with you;

• The length of time necessary to complete a transaction;

• Whether your Personal Information is a sensitive type;

• Whether you specifically consented to retain the data; and

• Our legal, contractual or similar obligations to retain or delete the data.

Section 12: International Transfers

We may, directly or indirectly through third-party entities around the world, process, store, and transfer the information you provide, including your Personal Information, as described in this Privacy Policy. Specifically, the information and Personal Information that we collect may be transferred to, and stored at, a location outside of your jurisdiction, including outside the European Economic Area (EEA) and the United Kingdom, and in countries that are not subject to an adequacy decision by the European Commission and that may not provide for the same level of data protection as your jurisdiction. It may also be processed by staff operating outside of your jurisdiction who work for us or for one of the organizations outlined in this Privacy Policy in connection with the activities outlined in this Privacy Policy. Fullstory is located in the United States and operates globally. We have data centers in the United States and in the European Union. At the time that you contract for our Services, you have the option to designate the location of the data center which supports your Fullstory account.

The laws in the United States regarding Personal Information may be different from the laws of your jurisdiction or country. Any international transfers, collection, storage, or processing of your Personal Information will comply with safeguards as required by relevant law.

A. Standard Contractual Clauses

For transfers from the European Union, the United Kingdom, or Switzerland to the United States, we will comply with applicable laws to provide an adequate level of data protection for the transfer of your Personal Information. Fullstory relies on the European Commission approved Standard Contractual Clauses as a legal mechanism for data transfers from the E.U.

B. Data Privacy Framework

With respect to “personal information” (as defined below) for which we act as a “processor” for Fullstory Customers within the meaning of European data protection law, Fullstory complies with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) (collectively, the “DPF”) as set forth by the U.S. Department of Commerce and the Federal Trade Commission (“FTC”).

Fullstory has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of such “personal information” (as defined in the DPF) received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Fullstory has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of such personal information received from Switzerland in reliance on the Swiss-U.S. DPF. The EU-U.S. DPF Principles and Swiss-U.S. DPF Principles are referred to collectively herein as the “DPF Principles.” We are subject to the investigatory powers of the FTC with respect to our DPF compliance.

If there is any conflict between the terms in this Privacy Policy and the DPF Principles, the DPF Principles shall govern. To learn more about the DPF program, and to view our certification, please visit https://www.dataprivacyframework.gov/. Fullstory and Fullstory Customers may also protect international transfers of personal information through other legally valid methods, including international data transfer agreements, and you can contact us to request more information about such methods and agreements.

If you are an EEA, UK, or Swiss citizen, you may be able to exercise certain choices under the DPF regarding how some of your personal information is used and disclosed, and may access, correct or delete certain personal information, by following the instructions in the section of this Privacy Policy titled “EEA, Switzerland, or the UK.” However, since we act as our customer’s processor for all of the information covered by our DPF certification, it typically would be faster for you to contact the customer directly.

When we receive personal information under the DPF and then transfer it to a third-party service provider acting as our agent on our behalf, we may have certain responsibility under the DPF if both (a) the agent processes the information in a manner inconsistent with the DPF and (b) we are responsible for the event giving rise to the damage.

If you have any concern or complaint about our handling of personal information received under the DPF Principles, please contact us as set forth above, as we would like to do our best to resolve the situation. In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Fullstory commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to BBB National Programs, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://bbbprograms.org/programs/all-programs/dpf-consumers for more information or to file a complaint. The services of BBB National Programs are provided at no cost to you.

If you do not receive timely acknowledgement of your DPF-related complaint from us, or if we have not addressed your DPF-related complaint to your satisfaction, please visit https://bbbprograms.org/programs/all-programs/dpf-consumers for more information or to file a complaint. The services of BBB are provided at no cost to you. In the event DPF-related complaints to Fullstory and BBB do not result in a satisfactory resolution, you may seek to resolve the complaint through binding arbitration, as described in Annex I of the DPF, available here: https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction.

Section 13: Updates to This Privacy Policy

We may make changes to this Privacy Policy from time to time. The “Effective Date” at the top of this page indicates when this Privacy Policy was last revised. We may also notify you in other ways from time to time about the collection, use, and disclosure of your Personal Information described in this Privacy Policy. If the changes to this Privacy Policy are material, we will provide a more prominent notice for a reasonable time period (including, for certain services or programs, email notification or privacy policy changes). We encourage you to review this Privacy Policy periodically.