Sequential Terms of Service

Last changed: 18 October 2026.

1. Who we are

Sequential is a hosted service for product analytics and session replay at https://www.usesequential.com.

Sequential is run from the Czech Republic. Contact: hello@usesequential.com.

In these terms, "we" and "us" mean the operator of Sequential.

2. These terms

These terms are a contract between you and us.

"You" means the business or organisation that uses Sequential. The person who accepts these terms confirms that they have the authority to accept them for that business or organisation.

You accept these terms when you do one of these:

• create an account;
• accept an invitation to an organisation;
• claim a trial that an AI agent set up for you.

Section 14 (Data processing terms) is part of these terms. Our Privacy Policy tells you how we use personal data as a controller. The Privacy Policy is for information. It is not part of this contract.

3. Business use only

Sequential is for businesses and organisations. It is not for consumers.

When you sign up, you confirm that you act for a business or an organisation, or as a self-employed person in your trade or profession. You confirm that you do not act as a consumer.

Sequential is not available to consumers.

4. The free preview

Sequential is in a free preview.

• We provide Sequential "as is" and "as available".
• We can change, add or remove features at any time.
• We set usage limits for each organisation. The app and our docs show the current limits. When an organisation reaches its session limit, Sequential refuses new data until the limit resets. Other limits pause or refuse one feature.
• We do not promise a level of availability or a support response time.
• We can end the preview. Before we end it, we will tell the owners of each organisation by email at least 30 days before, so that you can export your data.

Sequential is free today. If we start charging, we will tell you before and you can choose.

5. Your account and your organisation

• Give true information when you sign up.
• Keep your password, your two-factor codes, your backup codes and your access tokens secret.
• You are responsible for what the members of your organisation do in Sequential. This includes the access tokens they create and the agents they connect.
• The owners of an organisation control it: its members, roles, projects, settings and its deletion.
• If you think that someone uses your account without permission, tell us at once at hello@usesequential.com.

We record how you use our website and the app. We use Sequential on www.usesequential.com and in the app. It records the pages that you open, your clicks and a session replay of the pages, and stores ids on your device. Our servers also send events about what you do in Sequential, for example that you verified your email or that an agent called a tool with your token, with your user id. Our Privacy Policy (sections 5.10 and 6.2) says exactly what. If you do not want to be recorded, please do not use our website or the app.

6. The code you install and the data you send

We have no control over how you install sequential.js, the replay recorder, our backend SDK or any other tracking code that sends data to Sequential. This includes other vendors' SDKs that send data to Sequential, for example PostHog, Mixpanel, Amplitude, Pendo or Smartlook.

So you alone are responsible for these:

• Legal basis. You must have a legal basis to collect your end users' data and to send it to Sequential.
• Consent. Where the law asks for consent, you must get it before the code stores or reads data on an end user's device, and before the code records a session. In the EU, this applies to cookies and to device storage, such as localStorage. In the Czech Republic, see § 89(3) of Act No. 127/2005 Coll.
• Notice. You must tell your end users that you use Sequential for analytics and session replay, for example in your privacy notice.
• Settings. You choose your recording and masking settings. If you loosen masking, more data is recorded.
• Content of your data. Keep personal data out of user ids, account ids, event names, event properties, URLs and element ids, where you can. Sequential masks and cleans data by shape. It does not find every piece of personal data.

Sequential does not ask your end users for consent, and it does not check if they gave it. sequential.js can start each visitor as opted out (data-opt-out), so that it sends nothing until you call sequential.optIn(). data-opt-out stops sending, but sequential.js still stores its ids on the device. Where the law asks for consent before any storage, load the SDK only after your consent check.

Do not send these to Sequential:

• special categories of personal data (Article 9 GDPR), for example health data;
• personal data about criminal convictions and offences (Article 10 GDPR);
• payment card numbers, passwords, or national identity numbers;
• data from a site or app that is aimed at children.

If a third party or an authority makes a claim against us because you broke this section 6, you will compensate us for the loss that this causes.

7. Acceptable use

Do not use Sequential to:

• break the law, or to record people where the law does not allow it;
• send malware, or attack, overload or probe Sequential;
• get around a limit, a security measure or a refusal;
• use an ingest key, a token or an account that is not yours;
• copy, sell or resell Sequential, or give access to it as a service to others;
• reverse engineer Sequential, except where the law allows it.

If you find a security problem, tell us at hello@usesequential.com. Do not test it on other customers' data.

8. AI features and agents

• Sequential uses an AI model provider to judge sessions and to check text for hidden instructions aimed at an AI (prompt injection). Section 14 and our Privacy Policy say what we send.
• AI answers can be wrong. Check them before you act on them.
• Owners and admins can switch off automatic judging for each project. Features that a person starts, such as Ask and the Insights tab, still send data when someone uses them.
• You can connect your own AI agent, for example through an access token or a claude.ai connection. You choose that agent and its provider. The agent's provider receives the answers that Sequential gives to the agent. That provider is not our sub-processor.
• An access token with the exports:write permission can download your project's events and sessions as stored, with IP addresses and user ids. Give such a token only to a tool that you trust with that data.
• An AI agent can set up a trial for an email address before anyone has an account. If no one claims the trial within 72 hours, we erase it. The person who claims a trial accepts these terms.

9. Your data and our service

"Customer Data" means the events, recordings and other data that your sites and apps send to Sequential. It also means the content that you add, such as rubrics, saved views, fix links and feedback.

• You keep all your rights in Customer Data.
• You allow us to store, process and show Customer Data to provide Sequential to you and to keep it secure, as section 14 says.
• Our own analytics records the app while you use it (Privacy Policy, section 5.10). So a recording of a signed-in user can contain the Customer Data that the app shows on the screen, such as your end users' ids and your event names.
• We do not sell Customer Data.
• We keep counts of usage for each day. These counts have no user, session or event identifiers.
• If you send us ideas or feedback about Sequential, we can use them freely.
• Sequential, its software and its docs belong to us. While these terms apply, you can use Sequential for your business. You cannot transfer this right.

10. Retention, export and deletion

• We set the retention periods for each organisation. Today, on the hosted service, every organisation keeps events and recordings for 7 days. We can give an organisation up to 30 days. For events only, we can lift this limit for an organisation, up to 365 days. Data is deleted in weekly blocks and by daily jobs, so it stays 7 to 16 days. The app shows your periods.
• Owners and admins can export a project's events and sessions. The export files can be downloaded for 7 days.
• Owners and admins can delete a project. An owner can delete the organisation. Section 14.13 says what happens and when.
• Backups keep copies of the database and the analytics data for up to 7 days. Data that you delete can stay in a backup until that backup expires.

11. Suspension and termination

• You can stop using Sequential at any time. To end this contract, delete your organisation, or write to us.
• We can suspend or end your access at once if you break these terms, if the law requires it, or to protect Sequential, other customers or end users.
• In other cases, we can end this contract with at least 30 days' notice by email.
• When this contract ends, we delete Customer Data as section 14.13 says.

12. Liability

Sequential is a free preview. To the extent that the law allows:

• we give no warranties, express or implied;
• we are not liable for indirect loss, loss of profit, loss of business or loss of data. Export the data that you want to keep;
• our total liability under these terms is limited to EUR 100.

These limits do not apply:

• to harm that we cause intentionally or by gross negligence;
• to harm to a person's life, health or other natural rights;
• where the law does not allow a limit. This includes § 2898 of the Czech Civil Code (Act No. 89/2012 Coll.);
• to the rights that data subjects have against us under the GDPR.

13. Changes to these terms

We can change these terms. If a change works against you, we will tell the owners of each organisation by email at least 30 days before it applies. If you do not agree, you can end this contract before the change applies, and we will delete your data as section 14.13 says.

Changes that the law requires, or that only make these terms clearer, can apply sooner.

14. Data processing terms

This section 14 is the contract between you and us under Article 28 of the GDPR (Regulation (EU) 2016/679). It applies when Sequential processes personal data in Customer Data for you.

14.1 Roles

• You are the controller of the personal data in Customer Data. If you act for your own client, you are the processor and we are your sub-processor. You confirm that your client allows this.
• We are the processor.
• Sequential has no control over how you install its code on your sites and apps. You alone are responsible for the legal basis and for any consent that your end users must give (see section 6). We process their data only as you instruct.

14.2 Subject matter and duration

• Subject matter: we host and analyse the data that your sites and apps send, so that you can use Sequential.
• Duration: while this contract applies, and after it until we delete the data as section 14.13 says.

14.3 Nature and purpose

We receive, store, mask and clean, analyse, show, judge with AI, export and delete Customer Data. We do this to give you product analytics, session replay, heatmaps, AI session judging, findings and agent access.

14.4 Types of personal data

The data depends on what your code sends and on your settings. It can include:

• online identifiers: the user ids and account ids that you send, session ids, and anonymous device ids;
• the full IP address of each event that a browser or an app sends, and the country that we look up from it;
• device and browser data: the browser and the operating system, and the device type and the screen size when your SDK sends them;
• page addresses and referrers, with query values cleaned;
• events: page views, clicks with element text, form submits, errors and custom events, with the properties that you send;
• events that your servers send through our backend SDK;
• text that users type into text fields of a mobile app, when the mobile SDK captures it automatically. Since 18 October 2026, emails and card numbers of 15 or 16 digits in it are redacted. Names and other typed text are kept;
• the traits that you send when you identify a user or an account. These can include names or email addresses if you send them;
• session recordings of web pages or app screens, masked under your settings;
• technical data from web recordings: JavaScript errors, console entries (their text only if you turn it on), the address, method, status and timing of network requests, and page performance. Query values and credentials are redacted;
• heatmap data: counts per page area, with no text.

14.5 Categories of data subjects

• the visitors and users of your websites and apps;
• your staff, when they use your websites and apps;
• other people whose data you send to Sequential.

14.6 Your instructions

• We process the personal data only on your documented instructions. These terms, your settings in Sequential and your use of the app and the API are your instructions.
• If EU or Member State law requires us to process the data in another way, we tell you first, unless that law forbids it.
• If we think that an instruction breaks the GDPR or other data protection law, we tell you.

14.7 Confidentiality

Every person who can access the personal data is bound to keep it confidential.

14.8 Security

We use the technical and organisational measures in Annex A. We can change them, but we will not make the overall protection lower.

14.9 Sub-processors

• You give us a general authorisation to use sub-processors.
• Annex B lists the categories of our sub-processors. We give you the names and locations of our sub-processors on request at hello@usesequential.com.
• Before we add or replace a sub-processor, we tell the owners of each organisation by email at least 30 days before. You can object in that time. If we cannot solve the objection, you can end this contract and we delete your data.
• Each sub-processor must follow data protection terms that give at least the protection of this section 14. We are responsible to you for our sub-processors.
• An agent that you connect, and its provider, is not our sub-processor. You choose it.

14.10 International transfers

Sequential's backend runs in the AWS region eu-central-1 (Frankfurt, Germany). Some sub-processors can process data outside the EEA. When they do, we use a transfer tool that the GDPR allows, for example the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

14.11 Help with data subject requests

• Sequential gives you these tools: export of a project's data, and deletion of a project or an organisation. Sequential also deletes data at the end of the retention period. Sequential sets that period.
• Sequential cannot delete or export one person's data from the app. For such a request, write to us at hello@usesequential.com. We help you by hand, within a reasonable time.
• If an end user writes to us directly, we tell you. We do not answer the request ourselves, unless you instruct us to.

14.12 Help with security, breaches and impact assessments

• We help you meet your duties under Articles 32 to 36 GDPR, as far as the information we have allows. For example, we give you information for a data protection impact assessment.
• If we become aware of a personal data breach that affects Customer Data, we tell the owners of the organisation without undue delay, and within 48 hours. We tell you what happened, what data it affects, what we did, and who you can contact. If we do not know everything at first, we send the rest when we know it.

14.13 Deletion at the end

• Before this contract ends, you can export your projects' events and sessions (not recordings).
• When you delete a project, Sequential revokes its ingest keys and the data becomes unavailable at once. The recordings become unreadable within 60 seconds, because we delete their encryption keys. We delete the events from the live databases within 14 days. Storage removes the recording files later, by a date that the app shows.
• When an owner deletes the organisation, we do the same for each of its projects, but the app does not show the dates.
• When this contract ends for another reason, we delete the organisation in the same way within 30 days.
• Backup copies expire within 7 days.
• We keep data longer only where EU or Member State law requires it.

14.14 Audits

• On request, we give you the information that you need to show that we meet Article 28 GDPR. This includes written answers to a reasonable security questionnaire.
• If that information is not enough, or a supervisory authority asks for it, you can audit us. You or an auditor that you choose must give us 30 days' notice, keep what you see confidential, and pay the cost. You can audit at most once a year, unless there was a breach.

15. Other terms

• Law. Czech law governs these terms. The UN Convention on Contracts for the International Sale of Goods does not apply.
• Courts. The courts of the Czech Republic decide disputes.
• Transfer. We can transfer this contract to a company that takes over Sequential. We will tell you first.
• Whole agreement. These terms are the whole agreement between you and us about Sequential.
• Severability. If a court finds one part of these terms invalid, the other parts still apply.
• Language. If we translate these terms, the English text applies.

Annex A: Security measures

These measures are in place today.

• Encryption in transit. The API accepts HTTPS only, with TLS 1.2 or 1.3. Plain HTTP is redirected to HTTPS. Our servers connect to the main database with TLS and to the cache with TLS.
• Encryption at rest. The main database, the analytics disks, the cache and the recording storage are encrypted. Each recording is encrypted with its own key.
• Network. The main database and the cache are in private subnets. The analytics database is in our private network, but it has a public IP address for outgoing traffic. Its firewall accepts only our own servers. The link from our servers to the analytics database does not use TLS yet. It stays inside our private network.
• Masking by default. New web projects use the Strict masking preset. Page text and inputs are masked in the visitor's browser before they are sent. Our servers mask inputs, attributes and addresses again.
• Cleaning. In events, query values in page addresses are removed, except campaign and ad-click values. In recordings, the Strict preset removes the whole query. Credentials, email addresses and card numbers in DevTools data are redacted.
• Access control. Four fixed roles: Owner, Admin, Member and Viewer. The server checks the role on every request.
• Two-factor sign-in. Users can turn on authenticator-app codes. Owners and admins can require two-factor sign-in for the whole organisation. Sign-in attempts are rate-limited.
• Audit log. Changes to members, roles, keys, tokens, agent connections, recording settings and exports are logged. No one can edit or delete an entry in the app.
• Access tokens. Tokens are shown once and stored as a hash. Each token has only the scopes that you choose and expires after 30, 90 or 365 days.
• Agent output. Agent tools never return IP addresses or identity fields. Sequential removes the names, emails and phone numbers that your app sent, where it finds them. If your user ids are emails, agents see them as sent. Visitor text is screened for prompt injection. If a safeguard cannot run, the text is withheld.
• Staff access. The staff console needs two-factor sign-in and a recent code. Staff reads are logged. Support can view a customer account read-only, with a reason, for at most 30 minutes, and the customer's audit log shows it.
• Retention. Retention periods are enforced by scheduled deletion.

Annex B: Sub-processor categories