Sequential Privacy Policy

Last changed: 18 October 2026.

1. Summary

• Sequential is a hosted service for product analytics and session replay. It is run from the Czech Republic.
• We have two roles. For the people who use Sequential and for visitors to our own website, we are the controller. For the data that our customers' websites and apps send to Sequential, we are a processor for the customer.
• Our backend servers and databases are in the AWS region eu-central-1 (Frankfurt, Germany).
• We do not sell personal data. We do not show advertising.
• To use your rights, write to hello@usesequential.com.

2. Who we are

The controller is the operator of Sequential, based in the Czech Republic.

• Email: hello@usesequential.com
• Website: https://www.usesequential.com

We have no data protection officer.

3. Our two roles

4. Where the data comes from

• From you, when you sign up, use the app, join the waitlist or write to us.
• From your organisation, when a member invites you. The member gives us your email address.
• From an AI agent, when the agent sets up a trial for your email address.
• From your browser, when you visit our website or use the app.

5. What we collect as controller, why, and for how long

5.1 Your account

• What: your name, your work email, and whether you verified it. Your password, which we store only as a hash. The name of your organisation, your role, and your projects. The time and method of your last sign-in.
• Why: to create your account and to give you Sequential.
• Legal basis: contract (Article 6(1)(b) GDPR).
• How long: while your account exists. You cannot delete your account in the app yet. Write to us and we will delete it within 30 days.
• Note: when someone creates an account, we get a notification email with their email address.

5.2 Invitations

• What: the email address of the person invited, the role, the organisation and who invited them.
• Why: to send the invitation and to let the person join.
• Legal basis: our legitimate interest and the organisation's interest in adding its team (Article 6(1)(f)).
• How long: an invitation expires after 48 hours. We keep the invitation record until the organisation is deleted, or until the account of the person who sent it is deleted.

5.3 Sign-in and security

• What: your sign-in sessions, with the IP address, the browser (user agent) and the times. For each session, a record of its last two-factor check, with the IP address and the browser. Your two-factor secret and backup codes. Counters that limit sign-in attempts per IP address.
• Why: to keep you signed in, to protect your account, and to stop attacks.
• Legal basis: contract (Article 6(1)(b)) and our legitimate interest in security (Article 6(1)(f)).
• How long: a session lasts 30 days after you last use it. A trusted device stays trusted for 30 days after you last sign in with it. We delete a session when you sign out, when you end it in Settings, and when you reset your password. An expired session can stay until your account is deleted. Records of two-factor checks are not deleted automatically, even when your account is deleted. Write to us and we delete them.

5.4 The audit log of your organisation

• What: who did what, and when, with the IP address and the browser. Examples: sign-ins and sign-outs, password and two-factor changes, invitations, role changes, keys, tokens, agent connections, recording settings and exports. Some entries keep the email address that was used.
• Why: so that the owners and admins of your organisation can see what happened, and for security.
• Legal basis: our legitimate interest and your organisation's interest in security and accountability (Article 6(1)(f)).
• How long: the entries of an organisation stay until the organisation is deleted. After 90 days, a deletion record loses the IP address, the browser and the names. Entries that belong to no organisation, for example many sign-in entries, are not deleted on a schedule yet. Write to us and we delete yours.

5.5 Sequential staff

• What: when our staff use the staff console, we log each read and change, with the staff member's email, the IP address and the browser. For each change, we also log the reason. If our support views your account read-only ("view as"), the start goes in your organisation's audit log. The stop goes there when our staff member stops the view. A view also ends by itself after 30 minutes; that end does not go in your audit log.
• Why: to control and record staff access.
• Legal basis: legitimate interest (Article 6(1)(f)) and our duty to keep data secure (Article 32).

5.6 The waitlist

• What: your work email, and if you give them, your name, company, role, current tool and a note. The campaign values (utm_*) of the link that you came from, and the page of our site that you came from. We do not store your IP address with the entry. We use it for a short time to limit the number of sign-ups from one network.
• Why: to tell you when you can use Sequential.
• Legal basis: steps at your request before a contract (Article 6(1)(b)).
• How long: we keep the entry until you ask us to delete it. Write to us.
• Note: sign-up is open today, so our website does not show the waitlist form.

5.7 Emails that we send

• What: your email address and the content of the email.
• Which emails: email verification, password reset, invitations, a two-factor reminder, waitlist emails, usage notices (at 80 % and 100 % of the monthly limit), trial emails, replies to your feedback, a notice when your agent sends feedback for you, a notice to owners and admins when a member invites someone, and the result of a share-offer request.
• We do not send marketing emails today. We do not track if you open an email or click a link in it.
• Legal basis: contract (Article 6(1)(b)) or legitimate interest (Article 6(1)(f)).
• If we start to send news about Sequential, we will ask you first or give you a simple way to stop them.

5.8 Agent trials

• What: the email address that an AI agent gives us when it sets up a trial for you, and the trial project.
• Why: to send you the link to claim the trial.
• Legal basis: legitimate interest (Article 6(1)(f)).
• How long: if no one claims the trial within 72 hours, we erase it. If you click "Not you? Erase it and stop these emails", we erase that trial at once and keep only a hash of your address, so that agents cannot set up trials for it again. Other unclaimed trials for your address end within 72 hours.

5.9 Support, feedback and the share offer

• What: the emails that you send to us. The feedback that you send in the app or through an agent: the title, the text, the type, and context such as the screen, the route, the browser and the language. Your thumbs up or down on an AI verdict, with your user id. The LinkedIn post link that you send for the share offer.
• Why: to answer you and to improve Sequential.
• Legal basis: legitimate interest (Article 6(1)(f)).
• How long: feedback items: 2 years after the item is closed. If your account is deleted, we erase the text of your feedback. Thumbs up or down: up to 400 days, and shorter when the organisation's retention is shorter. Emails: we keep them in our mailbox and do not delete them on a schedule yet. Write to us and we delete yours.
• Note: our staff can open the sender's activity in our own website analytics (section 5.10) from a feedback item.

5.10 Our website and app analytics

We use Sequential on www.usesequential.com, including the app after you sign in.

• What we record:
  • the pages that you open, with the address (query values removed, except campaign and ad-click values), and the page that you came from;
  • your clicks, with the text of the element that you click, and form submits. We do not read what you type in fields;
  • a session replay of the pages. Page text is not masked, so the replay shows the text that you saw. Inputs are masked;
  • JavaScript errors, console activity without the text of the messages, network requests (the address with no query values, the method, the status and the timing) and page performance;
  • heat counts of clicks and scrolls, with no text;
  • your browser, operating system, device type, the full IP address and the country that we look up from it;
  • a few product events, such as "sign-up form shown" or "two-factor turned on". They hold no text that you type;
  • when you are signed in: your user id, your email and your name.
• What our servers record: our backend also sends a few product events about your account, for example that you verified your email, reset your password, or that an agent called a tool with your token. They hold your user id, your organisation's id, sometimes a project id, and fixed values. Never a name, an email or text that you typed. When you cause the event in your browser, they also hold the visitor id and visit id from the __sq_ctx cookie. Our backend also records its own errors, without their messages.
• What we do not record: staff pages, sign-in pages for agent connections, the password-reset page, trial claim and erase pages, and the app while our support views it for you.
• Note for customers: the app shows your data. So our recording of the app can contain the data that you see on the screen, such as your end users' ids and your event names.
• AI: an AI model provider judges the sessions on our website and app, as it does for customers (section 7).
• Device storage: see section 6.
• Why: to understand how people use our website and app, and to find and fix problems.
• Legal basis: our legitimate interest in understanding and improving our website and app (Article 6(1)(f) GDPR). We tell you about it here and in our Terms. If you do not want to be recorded, please do not use our website or the app.
• How long: events 365 days, recordings 30 days. Data is deleted in weekly blocks and by daily jobs, so it can stay up to 9 days longer.

6. Cookies and device storage

6.1 The app (needed for the service)

These are strictly necessary. We do not ask for consent for them.

6.2 Our analytics

These store data that our analytics (section 5.10) uses. Most are written when you open a page of our website or the app. __sq_ith is written when you sign in. __lx_replay_sample is written when the replay starts.

We use no advertising cookies and no third-party analytics. Our pages load no scripts and no fonts from other companies.

7. Who receives the data

We use these service providers. They process the data for us under a contract.

You can ask us for the names and the locations of all our providers at hello@usesequential.com.

Other recipients:

• The members of your organisation. They see your name, email and role. Owners and admins also see the audit log: what you did, with the IP address, and sometimes the email address that you used.
• An AI agent that you or your team connect, for example claude.ai. It receives the answers to its requests. Its provider is a separate company, and its terms apply.
• Authorities, when the law requires it.

8. Transfers outside the EEA

Our backend servers and databases are in the EU (AWS, Frankfurt). Some providers can process data outside the EEA, for example in the United States. When they do, we use a transfer tool that the GDPR allows, for example the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

9. How we protect the data

• Our API answers only over HTTPS (TLS 1.2 or 1.3). It redirects plain HTTP requests to HTTPS.
• Our databases and storage are encrypted. Each recording has its own encryption key.
• Passwords are stored only as hashes. Access tokens are stored only as hashes.
• You can turn on two-factor sign-in. Sign-in attempts are rate-limited.
• Our staff console needs two-factor sign-in, and it logs each staff read.
• Backups keep copies for up to 7 days. Data that we delete can stay in a backup until that backup expires.

10. Data that our customers send (we are the processor)

Our customers install Sequential on their websites and apps. Their code sends us events and session recordings about their end users. For this data, the customer is the controller and we are the processor. We process it only on the customer's instructions, under the data processing terms in our Terms of Service.

• Who is responsible. We have no control over how a customer installs sequential.js or other tracking code. The customer alone is responsible for the legal basis, for any consent that the end users must give, and for telling them about it.
• Your rights as an end user. Contact the website or app that you used. If you write to us, we send your request to that customer.
• Consent. Sequential does not ask end users for consent and does not check it. A customer can start each visitor as opted out (data-opt-out), and call sequential.optIn() after its own consent check. While a visitor is opted out, sequential.js sends nothing, but it still stores its ids on the device.
• What can be collected. Pages and screens, clicks and other interactions, errors, custom events and properties, user ids and traits that the customer sends, device and browser data, the full IP address and the country, and session recordings. By default, page text and inputs in web recordings are masked in the browser. Query values in the page addresses of events are removed, except campaign and ad-click values. From 18 October 2026, emails and card numbers of 15 or 16 digits in element text are redacted.
• Device storage on customer sites. sequential.js stores the same keys as in section 6.2 on the customer's site. When the customer sends an account, it also stores __sq_aid (the account id) and __sq_ath (a hash of its traits) in localStorage. The __sq_ctx cookie is set on the customer's own domain.
• AI. Sequential sends short text summaries of sessions to an AI model provider, to judge them. For automatic judging, the summaries have no recordings and no user ids, and addresses are cut to their path. When a project member asks for insights on one session, the summary also keeps the host of the entry page and of the referrer. Customers can switch off automatic judging for each project.
• How long. The customer's organisation has a retention period. Today it is 7 days on the hosted service, unless we agree a longer period up to 30 days. Data is deleted in weekly blocks and by daily jobs, so it stays 7 to 16 days.

11. Automated decisions

The AI model provider judges sessions, for example "did the user reach their goal?". These judgments help our customers find problems in their product. They do not make decisions about a person that have legal or similarly significant effects (Article 22 GDPR).

12. Your rights

You have the right to:

• get a copy of your personal data, and know who received it;
• correct data that is wrong;
• have your data deleted;
• restrict the use of your data;
• get your data in a machine-readable format;
• object to our use of your data when we rely on legitimate interest;
• withdraw your consent at any time, when we rely on consent. This does not change what we did before.

Write to hello@usesequential.com. We answer within one month. If your request is complex, we can take two more months, and we tell you why.

You can also complain to the Czech supervisory authority: Úřad pro ochranu osobních údajů (Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Praha 7, https://uoou.gov.cz. You can also complain in the EU country where you live or work.

13. Children

Sequential is for businesses. It is not for children. We do not knowingly collect data from children.

14. Changes to this policy

We can change this policy. We show the date of the last change at the top. If a change is important, we tell account owners by email before it applies.

15. Contact

Sequential is run from the Czech Republic. Contact: hello@usesequential.com.