GDPR Compliance
Last updated: April 8, 2026
This page explains how StorePilot supports GDPR compliance for website owners (Clients) who use the Platform to collect data from EU-based visitors.
Role Definitions
| Role | Party | Explanation |
|---|---|---|
| Data Controller | You (the Client / website owner) | You determine the purpose and means of collecting visitor data |
| Data Processor | StorePilot Platform | We process visitor data strictly on your behalf and according to your instructions |
| Data Subjects | Your website visitors | EU individuals whose data is collected via the Plugin |
By accepting our Terms of Service, you also accept our Data Processing Agreement (DPA), which governs our role as your Data Processor under GDPR Article 28.
Lawful Basis for Processing
As Data Controller, you must establish and document a lawful basis for each type of data your Plugin configuration collects:
| Feature | Suggested Legal Basis | Notes |
|---|---|---|
| JavaScript / PHP error tracking | Legitimate Interests (Art. 6(1)(f)) | Can be framed as security/stability interest; document your LIA |
| Pageview analytics | Legitimate Interests or Consent | Depends on whether data is linked to an identifiable individual |
| Session recordings | Consent (Art. 6(1)(a)) | Required — recordings are behavioral profiling data |
| Lead / checkout data | Contract Performance (Art. 6(1)(b)) | Data entered by the user during a checkout process |
| WP User ID linking | Legitimate Interests or Consent | Linking anonymous visitor to a known user requires justification |
For session recordings, prior, freely given, informed, specific, and unambiguous consent is required before the Plugin may activate recordings for that visitor.
Data Subject Rights — How to Fulfill Them
GDPR grants eight rights to data subjects. Here is how StorePilot helps you comply:
Right to Access (Art. 15)
You can view all data linked to a visitor in Dashboard → Visitors → [Visitor Profile]. This shows:
- All pageviews
- All errors linked to that visitor
- All leads / checkout data
- Linked session recordings
- Geolocation (country), device, browser info
Right to Erasure (Art. 17) ✅
Use the "Erase Visitor Data" button on a visitor profile, or call the API:
DELETE /api/v1/sites/{siteId}/visitors/{visitorId}/data
Authorization: Bearer <jwt>
This performs:
- Permanent deletion of all pageviews, recordings, leads
- Anonymization of linked error records (removes
visitorId,ipAddress,wpUserId) - Permanent deletion of the visitor record itself
Right to Rectification (Art. 16)
Lead / checkout data can be edited from Dashboard → Leads → [Lead Detail]. You can update personal fields where a user has requested correction.
Right to Restriction (Art. 18)
If a visitor requests restriction of processing, you can:
- Immediately delete their data using the erasure endpoint above
- Or disable recordings for your site in Dashboard → Settings → Recordings
Right to Data Portability (Art. 20)
All data is accessible via the Platform API in JSON format. You can query visitor data programmatically and provide it to the data subject.
Right to Object (Art. 21)
If relying on Legitimate Interests as legal basis, you must honor objections. The fastest way to comply is to erase the visitor's data (see Right to Erasure above).
Data Minimization Recommendations
To minimize GDPR risk, consider the following settings:
- Disable session recordings unless specifically needed — they collect the most personal data.
- Enable IP anonymization — configure the Plugin to truncate the last IP octet before sending to the Platform.
- Limit recording duration — set a maximum session recording length (e.g., 30 minutes) in Settings.
- Do not record checkout pages with payment fields — the Plugin masks input fields, but as an extra precaution, exclude
/checkout/*from recording in Settings → Excluded URLs.
Data Transfers Outside the EU
If your Platform server is outside the EU (e.g., US-based VPS), you are transferring personal data to a third country. Under GDPR Chapter V, this requires one of:
- Standard Contractual Clauses (SCCs) — accepted by inserting EU SCCs into your Data Processing Agreement
- Adequacy Decision — if the server is in a country with an EU adequacy decision
- Hosting in the EU — the simplest option: host the Platform within the EU (e.g., Germany, Netherlands, Ireland)
Recommendation: Host your Platform server within the EU to avoid additional GDPR transfer obligations.
Data Processing Agreement (DPA)
By accepting our Terms of Service, you agree to the DPA which covers:
- Subject matter, duration, and nature of processing
- Categories of personal data processed
- Categories of data subjects
- Our obligations as Data Processor (Article 28(3) requirements):
- Process data only on your documented instructions
- Ensure confidentiality
- Implement appropriate technical and organizational security measures
- Assist with data subject rights requests
- Delete or return all data after service termination
- Make available all information necessary to demonstrate compliance
- Notify you within 72 hours of becoming aware of a data breach
For a signed PDF copy of the DPA for your records, contact: contact@store-pilot.net
Security Measures (Article 32)
We implement the following technical and organizational measures:
| Measure | Implementation |
|---|---|
| Data in transit | TLS 1.2+ for all API endpoints |
| Authentication | JWT with 15-min expiry + bcrypt (rounds: 12) + refresh token rotation |
| Database access | MariaDB on private network; port 3306 not exposed publicly |
| Storage encryption | S3 server-side encryption; local storage outside webroot |
| Access control | API keys per site; JWT guards on all dashboard endpoints |
| Logging | Structured logging with sensitive headers redacted |
| Key rotation | API keys can be rotated from the dashboard at any time |
| Token revocation | Refresh tokens are immediately revoked on logout and on rotation |
Breach Notification
In the event of a data breach affecting personal data, we will notify affected Clients within 72 hours of becoming aware, as required by GDPR Article 33. Notification will include:
- Nature of the breach
- Categories and approximate number of data subjects affected
- Likely consequences of the breach
- Measures taken or proposed to address the breach
Contact for GDPR Inquiries
DPO / Legal contact: contact@store-pilot.net