Privacy Policy
Last updated 12 October 2026
This policy explains what userlily collects, why, who else handles it, and how long it is kept — both for people who sign up for userlily and for visitors to the websites where our customers install it.
Who we are
userlily (“we”, “us”) provides feedback collection, surveys, public roadmaps, web analytics, session replay, web push and related tools through this website and the scripts our customers add to their own sites. For any question about this policy or your data, email privacy@userlily.com.
Whose data this covers
- Account holders — people who sign up for userlily. We decide how this data is used, so for it we are the controller.
- Visitors to our customers’ sites — people who see a userlily widget, survey, roadmap or notification prompt, or whose visit is measured by our analytics script. Our customer decides to collect this data and what for; we process it on their behalf. If you are such a visitor, the site owner’s own privacy notice applies, and they are the first person to ask.
- Visitors to this website — anyone browsing userlily’s own pages. Here we are the controller; we read your approximate country to greet you and do not store it (see Visitors to this website).
Account holders
- Sign-in details: your name, email address and profile picture, provided through our sign-in provider, Clerk.
- What you create: campaigns, surveys, analytics and web push projects, roadmap items, ideas, dashboards, notifications and their settings.
- Files you upload: survey and roadmap backgrounds, notification icons and banners, and CSV files you import into DataHub.
- Connected accounts: if you connect Google Analytics in DataHub, an access token for it and the reports we fetch with it (see Google user data).
- AI usage: when you use an AI feature, a record of which feature and model were used, the token counts and whether the request succeeded — not the content.
Visitors to our customers’ sites
What is collected depends on which userlily products the site owner has installed and switched on.
Web analytics
- Each page viewed: its address and title, the referring page, UTM campaign parameters, time on page and how far down it was scrolled.
- Browser, operating system, device type, screen and window size, language, time zone and connection type.
- Approximate location — country, region, city and coordinates — looked up from the IP address through ipapi.co.
- The IP address itself is not stored. We keep only a one-way hash of it, salted per site and changed every day, so visits cannot be linked across days.
- If the site owner turns them on: link and button clicks, clicks on links to other sites, custom events the site sends, and friction signals (rapid repeated clicks, errors after a click, abandoned forms — the field name only, never what was typed).
- Visitors whose browser sends Do Not Track are not tracked unless the site owner turns that option off, and site owners can exclude pages from tracking entirely.
Session replay
- Off unless the site owner turns it on. When on, a recording of the page’s content and the visitor’s interactions — mouse movement, clicks, scrolling and page changes — for a share of visits the owner chooses.
- Values typed into form fields are masked by default. Owners can also mask all text, mask chosen elements, or mark elements with
data-userlily-blockso they are never captured.
Feedback widget and feedback pages
- What the visitor sends: a rating, a comment and, only if the form asks for them, a name and email address.
- A screenshot of part of the page, only if the visitor chooses to attach one.
- The page the feedback was sent from and the browser’s user-agent string.
- A hashed IP address, used only to limit repeated submissions.
Surveys
- The answers given, and the country and type of device they were sent from.
- An email address, only if the survey asks for one.
Public roadmaps
- Votes, comments and idea suggestions, with a name and email address only if the visitor chooses to give them.
- A random visitor ID in a cookie, and a hashed IP address used to limit abuse.
Web push notifications
- Only for visitors who allow notifications in their browser: the push subscription the browser creates, the browser, device type and user-agent string, the country, and the page they subscribed on.
- Whether each notification was clicked or dismissed.
Visitors to this website
When you open our home page, it asks our server for your approximate country, which our host, Vercel, works out from your connection. We use it only to greet you on that page. We do not store or log it, and if no country is available the page simply says hello without one.
How we use data
- To provide userlily: showing account holders their feedback, responses, analytics, recordings and subscribers, and sending the notifications they write.
- To keep it working and safe: rate limits, abuse prevention, and fixing faults.
- To run AI features, as described below.
- We do not sell personal data, and we do not use it for advertising.
AI features
Some features use AI models — for example tagging and summarising feedback, summarising survey answers and recordings, explaining issues and drafting notification text. When AI is enabled, the content needed for the task is sent to OpenRouter, which passes it to the AI model provider that serves the request; which provider that is can vary. Feedback comments are analysed automatically shortly after they arrive. Other features run only when an account holder uses them. Each model provider handles that content under its own terms, which can include keeping or logging it for a time — free models in particular may log what they receive. Each account has a daily limit on AI requests.
Google user data
DataHub can connect to Google Analytics. When you connect it, we ask Google for read-only access to your Analytics data (analytics.readonly) and nothing else.
- What we access: reports for the Analytics properties you choose — sessions, users, pageviews, bounce rate, top pages and traffic channels.
- How we use it: only to show those reports to you in DataHub and on your dashboards, and — if you ask an AI question about it — to send the figures needed for the answer to our AI provider.
- We do not sell Google user data, use it for advertising, or use it to develop, improve or train AI models.
- You can remove the connection in DataHub at any time, or revoke access from your Google Account’s security settings.
userlily’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Service providers
These companies process data for us, only to provide userlily. They may process it outside your country.
- Clerk — sign-in and account management.
- Akamai (Linode Object Storage) — storage for screenshots and uploaded images.
- ipapi.co — turns an IP address into an approximate location.
- OpenRouter, and the AI model providers it routes to — AI features.
- Google — only when you connect Google Analytics in DataHub.
- Browser push services (run by browser makers such as Google, Mozilla, Apple and Microsoft) — delivering web push notifications.
- Vercel — hosting the service, including working out the approximate country used to greet visitors on our home page.
- Our database provider — storing the service’s data.
How long we keep data
- Data collected for a campaign, survey, project, roadmap or workspace is kept until the account holder deletes it, or asks us to.
- Recordings shorter than the site owner’s minimum length (10 seconds unless changed) are deleted once the recording ends.
- AI usage records are deleted after 90 days.
- Account data is kept while the account exists. Deleting your account ends your sign-in, but it does not yet erase your projects and the data in them automatically — email us and we will delete it.
Security
- Data is sent over HTTPS, and IP addresses are stored only as hashes.
- Credentials for our storage and AI providers are kept on our servers, never in the scripts that run in visitors’ browsers.
- Screenshots and uploaded images are stored at long, random addresses that cannot be guessed. Anyone who has the exact address of one can open it, so do not share those links publicly.
Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict how it is used, and to complain to your data protection authority. To use any of these rights, email privacy@userlily.com. If you are a visitor to one of our customers’ sites, please contact that site’s owner first — we will help them respond.
If you install userlily
You are responsible for telling your visitors what you collect with userlily and, where the law requires it, getting their consent — for example before analytics cookies or session recording in the EU and UK. Keep sensitive information such as passwords, payment details or health data out of recordings with masking or data-userlily-block. Our Terms of Service set out these responsibilities in full.
Children
userlily accounts are not for children under 16, and we do not knowingly collect their data through accounts.
Changes to this policy
When this policy changes we will update the date at the top. If a change is significant, we will tell account holders before it takes effect.