Session Storage & Privacy

Pro Plan

Learn how Zenovay handles session recordings responsibly - from data masking to GDPR readiness and storage security.

Privacy First Approach

Our Philosophy

Session Replay is designed with privacy in mind:

Passwords masked by default
You control what's captured with simple CSS classes
Designed to support your GDPR and CCPA obligations
No personal data sold or shared

What We Always Mask

Regardless of your settings, password fields are never recorded. When recording starts, Zenovay automatically flags every password input (including fields tagged with autocomplete="password", current-password, or new-password) so their contents never leave the page.

Data Masking

Default Behavior

By default, Session Replay records most form inputs so the playback is useful for support and debugging. Passwords are the exception and are always masked.

Element	Default treatment
`input[type="password"]`	Always masked
`input[type="email"]`	Recorded (shown in playback)
`input[type="tel"]`	Recorded (shown in playback)
`input[type="text"]`	Recorded (shown in playback)
`.zenovay-mask-replay`	Masked
`[data-private]`	Blocked from recording

Emails and phone numbers are shown by default because they are often useful when reviewing a support session. If you need to hide them, mask or block the relevant fields using the CSS classes below.

What Masking Looks Like

In recordings, masked content shows as ••••••••. Blocked elements are removed from the recording entirely and never appear in playback.

Masking and Blocking with CSS Classes

Zenovay's recorder reads three CSS hooks. Add the appropriate class (or attribute) to any element on your site:

<!-- Mask the text (shown as ****) -->
<span class="zenovay-mask-replay">Personal info</span>

<!-- Block from recording entirely (not captured at all) -->
<div class="zenovay-block-replay">
  This section won't appear in recordings
</div>

<!-- The data-private attribute also blocks an element -->
<input type="text" data-private>

Hook	Effect
`zenovay-mask-replay` (class)	Text is masked, shown as `••••••••`
`zenovay-block-replay` (class)	Element is completely removed from the recording
`data-private` (attribute)	Element is blocked from the recording

These hooks work anywhere in your markup - on inputs, forms, or whole sections.

Recording Mode

Session Replay can run in two trigger modes, set per website:

Mode	Behavior
Errors only (default)	Sessions are recorded in the background and only saved when the visitor hits a JavaScript error, so you keep the recordings that matter
All sessions	Every session is recorded (sampled automatically on high-traffic sites to keep volume manageable)

To change the mode, open the website's dashboard, go to Settings → Advanced, enable Session Replay, then choose the recording mode. Recording stays off until you enable it.

Recording all sessions captures more data. Make sure your masking and exclusions are configured and that your privacy notice covers session recording before switching to "All sessions".

Blocking Recording

Block Entire Pages

You can stop recording on specific URL paths. In the website's dashboard, go to Settings → Exclusions and add the paths you want to exclude under Exclude URL paths, for example:

/admin/*
/account/settings
/checkout/payment

Sessions on excluded paths are skipped and never stored.

Block Elements

To remove a specific element from recordings, add the zenovay-block-replay class or the data-private attribute:

<!-- Don't record this element at all -->
<div class="zenovay-block-replay">
  This section won't appear in recordings
</div>

<!-- Same effect with the data-private attribute -->
<div data-private>
  Sensitive content here
</div>

Depending on your jurisdiction:

Region	Requirement
EU (GDPR)	Explicit consent often required
California (CCPA)	Opt-out must be available
Other	Varies by law

Recording is enabled from your website settings (Settings → Advanced), not via a JavaScript API. To stop all tracking (including recording) when a visitor withdraws consent, use the tracker's command queue:

// Disable tracking if consent withdrawn
if (!userConsented) {
  zenovay('disable');
}

// Re-enable tracking when consent is granted
if (userConsented) {
  zenovay('enable');
}

Works with any consent manager that can fire a callback, including OneTrust, Cookiebot, and CookieYes, or your own custom implementation.

// Wait for consent signal
window.addEventListener('consent-given', function() {
  zenovay('enable');
});

window.addEventListener('consent-withdrawn', function() {
  zenovay('disable');
});

Data Storage

Where Data Is Stored

Session data is:

Encrypted at rest
Hosted on Cloudflare's global edge infrastructure
Stored with the EU (Frankfurt) database as the primary region

Retention Periods

Plan	Retention
Pro	60 days
Scale	120 days
Enterprise	180 days

After Retention

When retention expires:

Recordings are automatically deleted
They cannot be recovered

Data Security

Encryption

All session data is:

Encrypted in transit (TLS)
Encrypted at rest

Access Control

Recordings are only visible to members of your workspace, scoped by their role. Audit logging of who accessed what is available on the Scale plan.

Security & Compliance Posture

Zenovay is designed for GDPR readiness and runs on infrastructure from certified providers:

Cloudflare (SOC 2 Type II, ISO 27001, ISO 27018)
Supabase (SOC 2 Type II)
Stripe handles all payment data (PCI DSS Level 1)

For international data transfers, Zenovay relies on the EU-US Data Privacy Framework and Standard Contractual Clauses where applicable.

Legal Basis

For session recording under GDPR:

Basis	Notes
Consent	Explicit user consent
Legitimate Interest	With proper assessment

Data Subject Rights

Users can request:

Access to their recordings
Deletion of recordings
Export of their data

Implementing Rights

When you receive a request:

The user submits the request
Find the relevant sessions in your dashboard
Export or delete them
Confirm completion

Deleting Recordings

To remove a specific recording, open the website's Sessions view, find the session, and delete it. The recording and its stored events are permanently removed and cannot be recovered.

For a broader account-level deletion request, see GDPR compliance details.

User Controls

Opt-Out Options

You can give visitors a way to turn off tracking using the tracker's disable command:

<!-- User-facing opt-out -->
<button onclick="zenovay('disable')">
  Don't track my activity
</button>

Respect Do Not Track

Zenovay respects Do Not Track (DNT) and Global Privacy Control (GPC) signals by default. No additional attribute is needed. Add data-ignore-dnt="true" to the tracking script only if you need to override this behavior.

Third-Party Content

Iframes

Third-party iframes:

Are not recorded across origins (cross-origin iframe recording is disabled for security)
May show a placeholder in playback

Third-Party Scripts

Content loaded from other domains:

May render differently in playback
Font fallbacks are possible
External images may not load

Sensitive Industries

Healthcare

Note that Zenovay is not HIPAA-certified and we do not sign Business Associate Agreements. If you operate in healthcare:

Mask or block all PHI fields and sections
Treat session recordings as out of scope for PHI, or do not enable recording on pages that contain it

Financial Services

For financial data:

Mask all financial fields
Block payment pages with path exclusions
Use audit logging (Scale) to track recording access

Legal Considerations

Consult your legal team about:

Industry requirements
Regional laws
Customer agreements

Audit & Compliance

Audit Logging

Scale Plan

Workspace audit logs track administrative actions, including:

Viewer identity
Timestamp
Action taken

Best Practices

Privacy Checklist

Before enabling recording:

Privacy notice updated to mention session recording
Consent mechanism in place (where required)
Sensitive fields masked or blocked
Excluded paths configured
Team aware of privacy responsibilities

Regular Reviews

Periodically check:

Masking configuration
New sensitive fields added to your site
Consent compliance
Recording mode and exclusions

Documentation

Keep records of:

What you record
Your legal basis
Retention periods
Who can access recordings

Configuration Summary

Configure these in the website's dashboard:

Settings → Advanced: enable Session Replay and set the recording mode (errors only / all sessions)
Settings → Exclusions: add URL paths to exclude, for example /admin/*

For element-level control, add CSS hooks in your HTML:

<div class="zenovay-mask-replay">Masked content</div>
<form id="payment-form" class="zenovay-block-replay">Blocked from recording</form>

Do Not Track and Global Privacy Control are respected by default; add data-ignore-dnt="true" to the tracking script to override.