Privacy policy

OnProd is a service for website owners. It records visits to their websites (session replay, events and errors), finds the problems visitors run into and shows analytics. It is operated by Edward William Francis Morris (ABN 12 483 583 778) of Melbourne, Victoria, Australia (“OnProd”, “we”, “us”). Our servers and databases are in Australia, in the Sydney region of Amazon Web Services (ap-southeast-2).

This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) and, where they apply to us, the EU and UK General Data Protection Regulation (GDPR) and similar laws.

1. Two roles

We handle personal information in two different roles:

• Our customers, and visitors to onprod.app. For account, billing and support information, and for visitors to this website, we decide how the information is used. Under the GDPR we are the controller. Sections 2 to 6 cover this information.
• Visitors to our customers’ websites. When a website uses OnProd, its owner decides what is recorded and why. We process that data on the owner’s behalf, only on their instructions, under our data processing agreement. Under the GDPR the website owner is the controller and we are a processor. Section 7 describes this data. If you visited a website that uses OnProd, that website’s privacy policy applies and its owner is the right person to contact. If you contact us instead, we’ll pass your request on to them.

2. Information about our customers

• Account: your name, e-mail address and password. We store the password only as a scrypt hash, never in a form that can be read back. If you turn on two-factor authentication, we keep its secret encrypted and your recovery codes only as hashes. If you sign in with Google, GitHub or Microsoft, we receive the name, e-mail address and account ID that provider shares with us.
• Workspace: workspace and site names, site domains, settings, the members of each workspace and their roles, and the e-mail addresses of people you invite.
• Billing: your plan, billing period and status, and the Stripe customer and subscription IDs. Payments are handled by Stripe, which collects your card and billing details directly and issues the invoices. We give Stripe the workspace owner’s e-mail address and the workspace’s name, and we never receive card details.
• Security and activity: for each signed-in session, its IP address, browser user agent and times; failed sign-in attempts, used to lock out attackers; and an audit log of actions in a workspace: who did what and when, from which IP address, and for invitations the address invited.
• Messages: what you write when you e-mail us, and our replies.
• How you use the dashboard: once you’re signed in, we record your visits to the dashboard with OnProd itself, linked to your account ID: the pages you open, clicks, errors, the browser and device, and a replay of the screen with every piece of text masked in your browser before it’s sent. Page addresses are cut down in your browser to the kind of page, so IDs, tokens, searches and the addresses of your own site’s pages are never sent, and replays of your visitors’ sessions are never recorded. This data stays on our own servers and is never combined with the data of the websites you track.

3. Visitors to onprod.app

The public pages of onprod.app use no advertising, no cookies and no third-party scripts, fonts or images. We count visits to them with OnProd itself, at its count level: the page viewed, how far it was scrolled and for how long, where the visitor came from (referrer and campaign tags), the browser, device type, language and time zone, and the country, region and network looked up from the IP address, which is not stored. Nothing is stored in your browser, no ID is created and nothing is recorded, so each page view counts on its own. The dashboard’s sign-in and sign-up pages count visits the same way. This data stays on our own servers. [Confirm in Cloudflare that Email Address Obfuscation, Bot Fight Mode and challenge pages are off, since each adds a script or a cookie.] Like any web server, ours records the IP address, time and address of each request in server logs, which we use only for security and troubleshooting and which are rotated within [14] days. Cloudflare, which carries all traffic to onprod.app, handles the same details on the way (see section 9). If you e-mail us, we keep your message and our reply.

4. Cookies and browser storage

The OnProd dashboard sets two cookies, both strictly necessary and both only when you sign in:

Cookie	What it does	How long it lasts
_analytics_session	Keeps you signed in to the dashboard	7 days, or until you sign out
_analytics_oauth	Protects signing in with Google, GitHub or Microsoft	10 minutes

The dashboard also keeps preferences, such as the colour theme, in your browser’s local storage. We don’t use advertising or analytics cookies. Once you’re signed in, the OnProd script that records how you use the dashboard (section 2) keeps a random visitor ID, a session ID and data not yet sent in local storage, session storage and IndexedDB; on the public pages and the sign-in pages it stores nothing.

On our customers’ websites, the OnProd script keeps a random visitor ID, a session ID, the website’s own user ID if it sets one, and data not yet sent in the browser’s local storage, session storage and IndexedDB. It never sets cookies. The website owner decides whether the script runs and must ask for consent where the law requires it. When a visitor is only counted (see section 7), nothing is stored in their browser.

5. How we use it

• To provide OnProd: to create and secure your account, run your workspace and send the e-mails the service needs, such as address verification, password resets, invitations, security alerts and usage and billing notices. GDPR basis: our contract with you.
• To bill you and keep the records tax law requires. Contract; legal obligation.
• To keep OnProd secure: to detect and stop abuse, protect accounts under attack and investigate incidents. Our legitimate interest in keeping the service and our customers’ data safe.
• To answer your questions and support you. Contract; legitimate interests.
• To run and improve the service using aggregate figures, such as how many sessions and Insights each plan uses. Legitimate interests.
• To see how the dashboard is used and where it goes wrong, and to count visits to onprod.app (sections 2 and 3). Our legitimate interest in improving OnProd.
• To tell you about new features, only if you agree; every such e-mail lets you unsubscribe [confirm whether product news will be sent]. Consent.

We don’t sell personal information, use it for advertising, or share it for cross-context behavioural advertising.

6. Who we share it with

• The service providers on our sub-processors page (hosting, e-mail delivery and the network in front of our servers; payments and site logos in the dashboard, once we turn them on; and AI for customers who turn it on), under contracts that limit what they may do with it.
• Google, GitHub or Microsoft, only if you choose to sign in with them, once we offer it. Their own privacy policies cover what they do.
• Our professional advisers, such as lawyers and accountants, under a duty of confidentiality.
• Courts, regulators and law enforcement, when the law requires it. Unless the law forbids it, we tell the affected customer first.
• A buyer of our business, who must keep to this policy, after we tell you.

7. Data from our customers’ websites

What OnProd records depends on how each website owner sets it up. It can include:

• the pages visited and where the visitor came from (referrer and campaign tags). Sensitive URL parameters, such as tokens, e-mail addresses and passwords, are replaced in the browser before anything is sent;
• clicks, with the text of the button or link clicked; form submits, the time spent in each form field and whether a form was left unsent (never the values typed); scroll depth and time on page;
• JavaScript errors and failed network requests;
• a replay of the page as the visitor saw it: its layout and text, with every input value masked in the browser. Website owners mask or leave out anything else that is personal;
• the browser’s user agent (its name, version and operating system), the device type, screen and window size, language and time zone;
• a random visitor ID and session ID, and the website’s own user ID if it identifies signed-in users;
• custom events and details about users that the website chooses to send;
• the country and network (internet provider), looked up from the IP address, and for visitors in Australia the state, from the time zone. The IP address itself is not stored with events or sessions; it appears only in our server logs (see section 10).

Each session is scored for signs of automation, so that bots, and the website owner’s own staff, can be left out of reports. With the stricter privacy settings, visitors in places whose laws require consent, such as the EU, the UK and Switzerland, are only counted until the website records their consent: page views, time on page, scroll depth and the website’s own custom events, with no replay, no visitor or user IDs and nothing stored in the browser.

We use this data only to provide OnProd to the website owner: their analytics, replays, issues and, unless they turn them off, AI Insights. We don’t combine it with other customers’ data, sell it, or use it for any other purpose. The website owner decides how long it is kept, can export the data of a signed-in user, can delete the data of a signed-in user or of one browser, and can delete everything by closing their workspace. Deleted data stays in our backups until they expire (see section 10).

8. AI Insights

AI Insights are on for each new site unless the customer turns them off in its settings. While they are on, OnProd sends the evidence for one issue at a time to the site’s AI provider:

• Anthropic, through the Anthropic API, which processes it in the United States; or
• Amazon Bedrock, run by Amazon Web Services in Australia [confirm the region, and that requests are not routed outside Australia].

The evidence covers up to 5 affected sessions and up to 2 that went fine: the 30 seconds before and after the problem in each, an outline of the page, the device type, the browser and its major version, and whether the visitor was signed in; the site’s domain names and page titles; and the issue’s counts (for a form, also the time visitors spent on each field). It never contains session, user or visitor IDs, IP addresses, locations, network names, full user agents or values typed into forms. Before sending a pack, OnProd checks it for the IDs and networks of the sessions involved, and doesn’t send it if it finds one. Page text the website owner hasn’t masked can be included. Customers can see exactly what was sent for every Insight (“What Claude saw”).

[Confirm against the current provider terms, and link them: that neither Anthropic nor AWS uses the inputs or outputs of these API requests to train models, and how long each provider keeps them.]

We use the result only to show the Insight to that customer.

9. Overseas disclosure

We store and process data in Australia. Some of our providers process data overseas:

• Cloudflare (at its data centre near each visitor or user, which can be anywhere in the world): every request to OnProd in transit, including IP addresses, dashboard pages and the data the OnProd script sends from customers’ websites;
• Anthropic (United States): AI Insights evidence, for sites with AI Insights on through the Anthropic API;
• Stripe (United States and other countries [confirm]): billing information, once we turn on card payments;
• Logo.dev (United States [confirm]): the domain names of customers’ sites, and the IP address and browser of each person using the dashboard, whose browser loads site logos from Logo.dev, once we turn site logos on;
• Google, GitHub and Microsoft (United States): sign-in, only for people who choose them, once we offer it.

The e-mails we send go out through Amazon Simple Email Service in Sydney.

Before we disclose personal information to someone overseas, we take reasonable steps, through our contracts with them, to make sure they handle it consistently with the APPs. For customers in the EU, the UK or Switzerland: Australia does not have an adequacy decision, so transfers to us and onward to our providers are covered by the standard contractual clauses in our data processing agreement.

10. How long we keep it

• Account and workspace information: while your account is open. When you delete your account, we delete it straight away, and the workspaces you were the only member of are erased 7 days later, except their names, their sites’ names, their billing records and their audit logs.
• Billing records: [7] years, as Australian tax law requires.
• Security records: sign-in sessions until you sign out or end them, and otherwise within 2 days after they expire (a session lasts at most 7 days); the audit log for 365 days; a note that a verification or password-reset e-mail was sent, kept under a one-way hash of the address rather than the address itself, for 2 days, also after the account is deleted, so that no one can flood an address with them. Server logs: [14] days.
• How you use the dashboard, and visits to onprod.app: [13 months] [confirm, and whether closing an account deletes its usage data sooner].
• Data from customers’ websites: for the retention period the customer sets for each site, and until they set one, for as long as the workspace exists [confirm a default limit]. It is erased 7 days after the site or its workspace is deleted.
• Backups: we back up the database every night and keep each backup for 30 days; it is then removed for good 7 days later. Replay recordings are stored with versioning, so a deleted recording can be recovered for 30 days before it is removed for good. Data deleted from OnProd stays in these backups until they expire.

11. Security

We keep data in AWS in Sydney, encrypt it in transit and at rest, store passwords only as hashes, offer two-factor authentication, keep each workspace’s data separate and limit access to what support and security need. Our security page has the details.

12. Your rights

You can ask for access to the personal information we hold about you, and ask us to correct it (APPs 12 and 13). Where the GDPR applies, you can also ask us to erase it, restrict how we use it, give it to you in a portable form, or stop using it on the basis of legitimate interests, and you can withdraw consent at any time.

You can do much of this yourself in the dashboard’s account settings: change your name and password, see and end your signed-in sessions, and delete your account. For anything else, e-mail [email protected]. We’ll reply within 30 days, may need to confirm your identity, and don’t charge for it.

If your request is about a website that uses OnProd, contact that website’s owner. We’ll help them answer it.

13. Complaints

E-mail [email protected] and we’ll reply within 30 days. If you’re not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992) or, in the EU or the UK, to your data protection authority (in the UK, the Information Commissioner’s Office).

14. Data breaches

If a data breach involving your personal information is likely to cause serious harm, we’ll notify you and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme. When a breach affects data we process for a customer, we tell that customer without undue delay so they can meet their own obligations.

15. Automated decisions

We don’t use personal information to make decisions that significantly affect anyone’s rights or interests. Bot scoring only decides whether a session appears in a customer’s reports, and AI Insights describe problems on a website, not people.

16. Children

OnProd is a service for businesses, for people aged 18 and over. As a controller, we don’t knowingly collect children’s personal information. Our customers must not use OnProd on websites directed at children [under 16, confirm the age].

17. Changes

When we change this policy we’ll post the new version here and update the date at the top. For significant changes we’ll e-mail account holders at least [30] days before they take effect.

18. Contact

Edward William Francis Morris, ABN 12 483 583 778, Melbourne, Victoria, Australia. E-mail [email protected].

[EU and UK representative under Article 27 of the GDPR, if one is required.]