Privacy
Defrixa measures where visitors get stuck on a web page. This page describes what that involves for the people who visit a site running our tracker, and for the customers who install it.
If you visited a site that uses Defrixa
We record anonymous signals about how the page was used: which pages were viewed and in what order, clicks on links and buttons, scroll depth, and which form fields were focused or left blank.
We never record what you type.For form fields we store the field’s name and type only — never its value — and fields that look sensitive (passwords, payment details, anything marked hidden) are skipped entirely, both in the tracker and again on our servers.
We do not set cookies and we do not store a persistent identifier. A random id is held for the lifetime of the browser tab so a visit can be grouped into one session, and it is erased when the tab closes. It is not linked to you and cannot follow you to another site.
Your IP address is used to make the request and is not stored against these events.
To opt out: turn on Global Privacy Control in your browser — we honor it on our servers, on every site, before anything is recorded. You can also opt out in this browser.
If you have a Defrixa account
We store your email address, your workspace and its members, the sites and flows you configure, the reports we generate, and your billing status. Payment card details go directly to Stripe and never reach our servers.
You can download everything we hold about your account, or delete your account and its data, from Settings. Deletion removes your sites, flows, reports and collected events. It is not reversible.
How long we keep it
Visitor events, sessions and visitor records are deleted after 400 days. Daily rollups, which contain only counts, are kept longer so historical charts survive. Reports and account records are kept until you delete them or close your account.
Who else processes it
We use the following subprocessors. Each receives only what its purpose requires.
| Subprocessor | Purpose | What it receives |
|---|---|---|
| Anthropic | Generates the plain-English report and page rewrites | Public page content of the scanned URL |
| Amazon Web Services | Stores the analyzed page snapshot attached to a report | Public page HTML |
| Stripe | Payments and subscriptions | Account email, billing details |
| Resend | Sends product and account email | Account email, message content |
| Sentry | Error monitoring | Error traces (no request bodies, no IP) |
| BetterStack | Log storage | Server logs (redacted) |
| Cloudflare | Bot check on public forms | Challenge token |
| Voyage AI | Embeddings for the in-app support answers | Defrixa's own public documentation |
If you install Defrixa on your own site
You are the controller of your visitors’ data and we are your processor. Disclose Defrixa in your own privacy notice, and link visitors to the opt-out page. Because we hold no cross-site identifier, we cannot single out one of your visitors on request — the honest way to serve an erasure request is to delete the site’s data, which you can do from Settings.
Contact
Privacy questions and data requests: privacy@defrixa.com.