Inspectlet and Data Protection – What Belongs in the Privacy Policy
Compact guide to Inspectlet: processed data, purposes, legal bases (GDPR) and what website operators must include in their privacy policy.
Inspectlet and Data Protection – What Belongs in the Privacy Policy
Inspectlet data protection is a central topic for website operators that use session recordings, heatmaps and form analytics. The tool collects movement patterns of visitors in a granular form – from the mouse pointer to click paths to keyboard inputs. This makes transparent, legally secure documentation in the privacy policy necessary. This guide shows what information is required, what data Inspectlet processes and on what legal bases.
A. Purpose and Function of Inspectlet
Inspectlet is a session recording and heatmap tool from a US provider that records and analyzes user interactions on websites. The core functions are:
- Session recordings: Automatic video recording of visitor sessions with mouse movements, clicks, scrolls and keyboard inputs
- Heatmaps: Visual representation of click, scroll and movement patterns to identify UX bottlenecks
- Form Analytics: Monitoring of form completions, errors and abandonments
- Feedback surveys: Integrated surveys on visitor satisfaction
- Conversion tracking: Tracking of target actions and user journeys
Integration is via a JavaScript snippet which is embedded in the <head> or <body> area of the website and continuously transmits data to Inspectlet servers.
B. Mandatory Disclosures of the Privacy Policy when Using Inspectlet
For legally compliant websites, it is essential to make the use of Inspectlet transparent in the privacy policy. This includes:
- Name and address of the provider (full contact details)
- Description of the data processed (session recordings, click paths, device and browser information, IP addresses, possibly form contents)
- Purposes of use (product improvement, user behavior analysis, conversion optimization, possibly security)
- Legal bases (typically consent under Art. 6(1)(a) GDPR + § 25(1) TDDDG)
- Data transfer to third countries (USA – data privacy framework/Standard Contractual Clauses)
- Data Processing Agreement (DPA) – whether a DPA exists with Inspectlet
- Data subject rights – access, rectification, erasure, objection
- Right of withdrawal – possibility to opt out of consent
- Data protection officers – contact to the supervisory authority
Privacy policy in minutes — easy to maintain, no subscription.
Instead of an unreadable text block per tool: a topic-oriented, hybrid approach with a clear list of recipients — maintainable, transparent, GDPR-compliant.
- No subscription, no hidden costs
- Easy to maintain thanks to a topic-based structure instead of tool-by-tool blocks
- Curated by Dr. Thomas Helbing, certified specialist for IT law
The generator is offered by matterius GmbH. matterius is not a law firm and does not provide legal advice.
C. Provider of Inspectlet
| Field | Information |
|---|---|
| Provider name | Inspectlet (independent company) |
| Company form | USA (state: to be verified by the operator) |
| Privacy Policy | https://www.inspectlet.com/privacy (to be updated by the operator) |
| DPA available | Yes (Standard Contractual Clauses / DPF status: to be checked by the operator) |
| Data Privacy Framework (DPF) | To be verified – USA may be DPF-certified or rely on SCCs |
The provider Inspectlet and current certifications should be verified directly on the Inspectlet website and in contractual documents before use. The level of data protection and the availability of Standard Contractual Clauses may change.
D. Data Processing – Process in Steps
Snippet integration – The website operator embeds the JavaScript snippet from Inspectlet into its website. The snippet loads automatically on page load.
Data collection in the browser – Inspectlet collects user interactions in real time: mouse position tracking, clicks, scrolls, typed characters (possibly without masking), focus events in form fields.
Session identification – The user receives a session ID (typically via cookie or local storage) to associate interactions with a session.
Data transmission – Collected data is transmitted at regular intervals to Inspectlet servers in the USA. This happens without explicit user action.
Storage in third country – Data is stored on US servers of Inspectlet. The data transfer takes place under data privacy framework or Standard Contractual Clauses.
Processing and evaluation – Inspectlet processes data for analysis purposes and provides heatmaps, session recordings and reports via its dashboard.
E. Data Collected by Inspectlet
Inspectlet collects a comprehensive spectrum of user data. The information collected can be classified into several categories:
Web server log data:
- IP address of the visitor
- Timestamps of page views
- HTTP referrer
- User agent (browser type, operating system)
Click paths and navigation data:
- Complete sequence of all clicks on the website
- Clicked links, buttons and elements
- Target pages after clicks
End-device and browser data:
- Device type (desktop, tablet, mobile)
- Screen resolution
- Browser name and version
- Operating system (Windows, macOS, iOS, Android)
- Language settings
Coarse location data:
- Geographic position based on IP (country, city – without exact GPS coordinates)
Interaction data (session recordings):
- Mouse movements and position in real time
- Scroll positions and direction
- Keystrokes (in form fields, possibly without masking – particularly sensitive)
- Focus and blur of input fields
- Window size changes
Conversion events:
- Defined target actions (e.g. button clicks, form submission tests)
- Conversion rates and times
User-generated content:
- Form completions (entries in text, select and textarea fields)
- Possibly inadvertently collected content (email addresses, phone numbers, search queries) if no field masking is configured
Keystrokes in password fields or payment data are usually automatically masked. However, the website operator should explicitly check which fields are masked, and configure additional field masking if necessary – for example for credit card numbers, social security numbers or other highly sensitive data.
F. Purposes of Use
Inspectlet processes data for the following purposes:
General product improvement:
- Analysis of user behavior at aggregate level (e.g. "80% of visitors do not scroll below the fold")
- Identification of UX problems and optimization potential
- Benchmarking against industry standards
User-individual product improvement:
- Subsequent viewing of individual sessions (replay) for debugging and understanding specific user journeys
- Analysis of conversion funnel and abandonment points
- Personalization of website elements based on user behavior (possibly with extended features)
Security and abuse detection:
- Detection of suspicious patterns (automated access, bots)
- Protection against fraud (e.g. unusual form submissions)
G. Legal Bases for Inspectlet
Category: Tracking with Session Recording
Session recording with Inspectlet falls under tracking and statistics under German and European data protection law. It is not essential functionality, but optional analysis and optimization.
Required Legal Bases
1. Consent under Art. 6(1)(a) GDPR + § 25(1) TDDDG
The setting of cookies and tracking IDs is not permissible without consent. The website operator must obtain informed, voluntary consent before loading the Inspectlet snippet – typically via a cookie banner or consent tool.
- Form: Before the Inspectlet script is run (!) consent must be in place
- Content: Specific mention of "session recording", "heatmaps", Inspectlet as provider
- Right of withdrawal: Users must be able to withdraw consent at any time (e.g. via cookie settings)
2. Data Privacy Framework (DPF) or Standard Contractual Clauses (SCCs) for USA transfer
Since Inspectlet servers are located in the USA, a mechanism for legally compliant data transfer must be in place:
- Data Privacy Framework (DPF): If Inspectlet is certified under the EU-US DPF → reference in the privacy policy
- Standard Contractual Clauses (SCCs): If DPF is not in place → DPA with Inspectlet must contain SCCs
- Supplementary measures: Additional technical/organizational measures may be required
Without a valid data transfer mechanism, the data transmission to Inspectlet (USA) is unlawful. The website operator must check before use whether a current DPF status or updated SCCs are in place.
H. Special Features and Notes regarding Inspectlet
-
Session recording is highly sensitive: Keystrokes and movement patterns can reveal personal information. A clear, intelligible privacy notice is essential.
-
Configure field masking: The website operator should explicitly determine which form fields are masked (passwords, credit cards, PIN fields, social security numbers).
-
Check DPA: A data processing agreement must be in place and contain Standard Contractual Clauses or DPF certification. The operator must ensure that Inspectlet is classified as a processor (Art. 28 GDPR).
-
Data Protection Impact Assessment (DPIA): Session recording with Inspectlet may trigger a DPIA under Art. 35 GDPR, especially if highly sensitive form contents are collected.
-
Data subject rights: Users must be informed whether their session has been recorded and where they can view/erase it.
-
Opt-out mechanism: Inspectlet should offer an opt-out link or cookie blocking option to exclude users from tracking.
-
Retention period: The retention period of session recordings must be documented and should be limited to the necessary minimum (e.g. 30–90 days).
I. FAQ
Do I need to obtain consent before or after Inspectlet is loaded?
Consent must be obtained before the Inspectlet script is loaded. Modern consent management platforms (CMP) use a "Tag Manager" or similar mechanisms to load the script conditionally.
Is Inspectlet permitted in Germany?
Inspectlet is permitted under the following conditions: (1) effective consent under TDDDG/GDPR, (2) valid data transfer (DPF or SCCs), (3) DPA with Inspectlet, (4) DPIA, if required. Without these prerequisites, use is unlawful and may result in fines.
Can I use Inspectlet without consent for analytics?
No. Session recording with Inspectlet is not comparable to anonymous or pseudonymous statistics. The data is typically personal data (IP, cookies, sessions). Consent is required.
What happens in the case of personal data breaches?
The website operator and Inspectlet are obliged to report personal data breaches to the supervisory authority (state data protection authority) if there is a risk to data subjects. Inspectlet must notify without delay as a processor (DPA).
Can I combine Inspectlet with other tools?
Yes, but the overall combination of tools (e.g. Inspectlet + Google Analytics + Hotjar) may lead to increased requirements (DPIA, special consent). Data minimization is advisable – only use the tools you really need.
How long do I have to store session recordings?
The retention period depends on the purpose. Typical is 30–90 days for operational analyses. Longer storage is only permissible for a specific reason and must be justified.
J. Conclusion and CTA
The use of Inspectlet is permitted in Germany and the EU under strict conditions: informed consent, valid data transfer to the USA, data processing agreement and, if applicable, data protection impact assessment. A transparent, detailed privacy policy is not only a legal obligation but also fosters trust with visitors.
Website operators should:
- Check Inspectlet configuration: Field masking, retention period, opt-out
- Document legal bases: Consent, DPA, data transfer mechanism (DPF/SCCs)
- Update privacy policy: Make Inspectlet, data types, purposes, data subject rights, contact details transparent
- Audit regularly: Inspectlet policy and DPA should be reviewed at least annually – especially when there are DPF changes or provider updates
This guide offers an orientation for data protection compliance when using Inspectlet. It does not replace individual legal advice. For specific implementations, it is recommended to consult a data protection officer or data protection lawyer – especially in highly sensitive or complex scenarios.
Privacy policy in minutes — easy to maintain, no subscription.
Instead of an unreadable text block per tool: a topic-oriented, hybrid approach with a clear list of recipients — maintainable, transparent, GDPR-compliant.
- No subscription, no hidden costs
- Easy to maintain thanks to a topic-based structure instead of tool-by-tool blocks
- Curated by Dr. Thomas Helbing, certified specialist for IT law
The generator is offered by matterius GmbH. matterius is not a law firm and does not provide legal advice.
K. Further Resources
GDPR – Art. 6 (Lawfulness)
Legal bases for data processing.
TDDDG – § 25 (Cookies and Tracking)
Requirements for tracking, cookies and consent under German law.
EDPB – Guidelines on Cookies and Electronic Identifiers
Official interpretation by the European Data Protection Board.
Inspectlet Privacy Policy
Official privacy policy of the provider – update for verification.
Authorship
This knowledge article is provided by matterius GmbH. matterius is not a law firm and does not provide legal advice.
matterius is editorially accompanied by Dr. Thomas Helbing, a German-based lawyer specialised as Fachanwalt für IT-Recht (certified specialist for IT law) in Munich.
Dr. Helbing has been continuously recognised by Handelsblatt since 2020 through to today (2026) as one of "Germany's best lawyers" in the fields of IT law and data protection law.
According to Kanzleimonitor.de (editions 2024–2026), he ranks among the leading lawyers for data protection and IT law and is listed in the Top 100 lawyers in Germany. Kanzleimonitor is regarded as a particularly meaningful market study, as it is based exclusively on personal recommendations from in-house counsel.
Dr. Helbing has many years of advisory experience in data protection and IT law and advises clients of all sizes — from startups to high-growth SaaS companies and unicorns through to international corporations.
His professional background covers the full spectrum of practice in IT and technology law. He began his career at an international major law firm, subsequently gained in-house experience at a DAX corporation, and is himself an entrepreneur and founder of several digital projects. He also has hands-on programming experience, allowing him to understand technical systems, software architectures, and digital business models not only from a legal but also from a technical perspective.
For many years his clients have included technology companies and SaaS providers, leading German research institutions, and a systemically important German major bank. His advisory focus lies in particular in the areas of GDPR compliance, the data economy, SaaS, AI regulation, and IT contract law.
More about Dr. Helbing: www.thomashelbing.com
HubSpot and Data Protection – What Belongs in the Privacy Policy
Compact guide to HubSpot: processed data, purposes, legal bases (GDPR), DPA and what website operators must include in their privacy policy.
Inxmail Professional and Data Protection – What Belongs in the Privacy Policy
Compact guide to Inxmail: processed data, purposes, legal bases (GDPR), UWG and what website operators must include in their privacy policy.