Not legal advice. This page explains what Opti-Behavior does technically. Ask your data protection adviser how the rules apply to your site and country.
Opti-Behavior is self-hosted: you are the data controller, and no data is sent to Opti-Behavior. That makes GDPR simpler, but you still decide how visitor data is collected and kept.
1. Pick the right mode #
| Mode | Personal data | Consent |
|---|---|---|
| Anonymous Mode | No cookie, no IP stored, daily non-personal hash | No banner needed |
| Full Tracking | Cookie, IP, location, persistent visitor ID | Consent required before tracking starts |
2. Consent and withdrawal (Full Tracking) #
- Use the built-in banner or your consent plugin – see Setting up the consent banner.
- Nothing personal is stored before the visitor accepts; visits are counted cookie-free until then.
- The choice is remembered 6 months by default (CNIL recommendation), 12 months as an option; then the banner asks again.
- Add
- A/B tests write their variant cookie only after consent.
3. Minimise and protect #
- Form Analytics never records what visitors type.
- Session recordings (Pro) mask form inputs; they can be encrypted.
- IP addresses are never sent to a geolocation service before consent, and lookups are rate-limited.
- Forwarded IP headers are trusted only from Cloudflare or your own reverse proxy.
4. Keep data only as long as needed #
Defaults: raw files 90 days, detailed rows 365 days, aggregated summaries (no personal data) kept. Shorten them if your policy says so – see Data retention and cleanup.
5. Answer requests #
- Access / deletion requests – in Anonymous Mode there is nothing to link to a person. In Full Tracking, use Danger Zone → Date Range or a full reset for broad deletions.
- Uninstall – choose whether data is deleted with the plugin (Danger Zone → Uninstall).
6. Your privacy policy #
Mention: the purpose (improving the site), the data (pages, clicks, scroll, device, and in Full Tracking IP and location), that data stays on your server, the retention periods, the cookie names and how to withdraw consent.
Expected result #
Your mode, banner, retention and privacy policy tell the same story.
FAQ #
Do I need a data processing agreement with Opti-Behavior? #
Opti-Behavior does not receive your visitor data, so there is no processor for analytics. Check your hosting contract.
Are recordings personal data? #
They can be. Use masking, short retention and consent (recordings wait for consent).
