Lissoss reads events, not screens. Here is what it collects, how long it keeps it, who can reach it, and which companies help run it.
The snippet sends what visitors do — pages, clicks, scroll, exits. It records no video and nothing typed, and by default nothing at all until the visitor agrees.
- No screen recordingLissoss reads events. The snippet switches session recording off itself, so a setting elsewhere can never start recording your visitors.
- Nothing until they agreeBy default the snippet records nothing and stores nothing in the browser until the visitor accepts its banner — or your own consent tool says yes.
- Form fields stay privateWhat visitors type into form fields is never recorded. A click carries the visible text of what was clicked, nothing typed.
- Your own visits, droppedLocalhost and LAN visits are dropped automatically, and “Not me” hides any visitor. The hidden count is always shown.
- No IP address reaches the AIThe AI reads summaries of behaviour — pages, clicks, timings, country. Never an IP address, and the provider may not train its models on it.
- Behaviour, never peopleThe AI is told to explain what visitors did — never to characterise them by where they are or what device they use.
Kept only as long as it's useful.
Lissoss's copy of visitor events is deleted automatically every night once it passes the retention window. Your account data stays as long as your workspace does.
- Visitor events
- Deleted after 365 days by default, every night — the window is never set below 90
- The event provider's copy
- Follows PostHog's retention for Lissoss's project
- Erasing a visitor
- An admin removes one in one step: from Lissoss's database and caches at once, from the event provider within 30 days — until then they can still appear
- Your sessions
- Export the filtered list as CSV at any time
- When a trial ends
- Nothing is deleted. The workspace turns read-only
- Closing your workspace
- On request, the workspace and its data are deleted within 30 days — except billing records the law requires us to keep
Who can reach what.
Each workspace reads only its own data, checked on the server for every request. Inside a workspace, roles decide who can change things.
- Sign-in
- Email and password, with the address verified before a workspace exists. Passwords are held only as hashes, by the sign-in provider
- Roles
- Admin, manager and viewer. Viewers read and can't run AI or change anything; only admins change settings, sites and keys
- Isolation
- A workspace reads only its own sites. A request that isn't bound to a workspace reads nothing
- MCP keys
- One per workspace, made by an admin, shown once and stored as a one-way hash. Rotate or revoke it at any time
- In transit, and the database
- Everything travels over HTTPS. Database tables are reachable only by Lissoss's server, never straight from a browser
- Pre-launch review
- 13 October 2026: four reviews — access and tenancy, injection, the public surface and cost abuse, the database and secrets. Every critical and high finding was re-checked in the code and fixed
Seven companies help run Lissoss, under contracts that bind them to its instructions. Some are in the United States; transfers out of the EEA use the Standard Contractual Clauses or an equivalent safeguard.
| Subprocessor | What it does for Lissoss | Where |
|---|---|---|
| Vercel | Application hosting | EU (Dublin) functions; global edge network |
| Supabase | Database, sign-in and file storage | EU (Ireland) |
| PostHog | Collecting and storing website visitor events | United States |
| Anthropic | AI analysis of behaviour summaries (never IP addresses) | United States |
| Resend | Transactional and digest email | United States |
| Stripe | Subscription billing and payments | United States / global |
| Sentryoptional | Error reporting (route paths and stack traces only) | United States |
No card. One snippet. Sample data until yours arrives.