Privacy Policy

Last updated: July 22, 2026

This Privacy Policy describes how hight ("we," "us," or "our") collects, uses, and protects information when you use our website at hight.ai, our analytics platform, tracking scripts, APIs, and all related services (collectively, the "Service"). We are committed to transparency and protecting your privacy.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

  • Full name
  • Email address
  • Password (stored using bcrypt one-way hashing; we never have access to your plaintext password)

If you register using Google Sign-In, we receive your name and email address from Google in accordance with your Google account permissions.

1.2 Analytics Data Collected on Behalf of Customers

When you install the hight tracking script on your website, it collects analytics data from your visitors. This data is owned by you (our customer) and is processed on your behalf. This may include:

  • Page view data: URL path, query parameters, page title, hostname
  • Referrer information: referrer domain, path, and query
  • UTM campaign parameters: utm_source, utm_medium, utm_campaign, utm_content, utm_term
  • Click identifiers: gclid, fbclid, msclkid, ttclid, li_fat_id, twclid
  • Device information: browser type, operating system, device type, screen resolution, preferred language
  • Approximate geolocation: country, region, and city (derived from IP-based geolocation; we do not collect precise GPS coordinates)
  • Session data: a hashed representation of IP address and user agent (used to identify unique sessions; raw IP addresses are not stored persistently)
  • Custom events: event names and custom properties you define (strings, numbers, booleans, dates, arrays)
  • Performance metrics: Largest Contentful Paint (LCP), Interaction to Next Paint (INP), Cumulative Layout Shift (CLS), First Contentful Paint (FCP), Time to First Byte (TTFB)

1.3 Session Replay and Heatmap Data

If enabled, the Service may record anonymized session replays and heatmap data from visitors to your website, including:

  • DOM mutation events (structural changes to the page)
  • Click positions (x/y coordinates relative to page and viewport dimensions)
  • Scroll depth and percentage

Session replay data is stored as binary data and is only accessible through the hight dashboard by authorized users of your account.

1.4 Billing Information

Payment processing is handled by Stripe. We do not store your credit card number or payment details on our servers. Stripe may collect:

  • Payment card details
  • Billing address
  • Transaction history

Stripe's privacy policy is available at stripe.com/privacy.

1.5 User Feedback

If you submit feedback through the Service, we collect the text of your message and associate it with your account.

1.6 AI Chat Interactions

When you use the AI analytics assistant, your queries and relevant analytics context are sent to our AI infrastructure provider (Groq) for processing. Chat messages are processed in real-time and are not used to train AI models. Chat interactions may be temporarily stored to maintain conversation context during your session.

1.7 Automatically Collected Information

When you visit our website or use the dashboard, we may automatically collect:

  • Log data: IP address, browser type, operating system, pages visited, time spent, referring URL
  • Device identifiers and usage patterns within the Service

2. How We Use Information

We use the information we collect to:

  • Provide, operate, maintain, and improve the Service
  • Process transactions and manage your subscription
  • Send transactional emails (account confirmations, password resets, billing receipts, and service announcements)
  • Generate analytics reports and insights on your behalf
  • Provide AI-powered analytics assistance
  • Detect, prevent, and address technical issues and security threats
  • Comply with legal obligations

3. How We Share Information

We do not sell, rent, or trade your personal information. We may share information only in the following circumstances:

  • Service Providers: We share data with trusted third-party providers who perform services on our behalf, including:
    • Stripe (payment processing)
    • Groq (AI inference for analytics assistant)
    • Resend (transactional email delivery)
    • Cloud infrastructure providers (hosting and database management)
    These providers are contractually bound to use the data solely for the purposes of providing services to us and are subject to appropriate confidentiality obligations.
  • Legal Requirements: We may disclose information if required by law, regulation, legal process, or governmental request.
  • Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred, provided that the receiving entity agrees to honor the commitments in this Privacy Policy.
  • With Your Consent: We may share information for purposes not described in this policy with your explicit consent.

4. Data Ownership and Analytics Data

You retain full ownership of all data you collect through the Service ("Your Data"). As between hight and you:

  • We act as a data processor on your behalf with respect to analytics data collected via your tracking script
  • You act as the data controller for the analytics data of your visitors
  • We do not access, use, or share Your Data except as necessary to provide the Service
  • You are responsible for ensuring your use of the Service complies with applicable privacy laws vis-a-vis your visitors

For more on your responsibilities regarding end-user data, see Section 7 (GDPR) and Section 8 (CCPA).

5. Data Security

We implement industry-standard security measures to protect your information, including:

  • Encryption in transit (TLS/HTTPS) for all data transmissions
  • Password hashing using bcrypt
  • Authentication tokens for API access
  • Regular security audits and infrastructure monitoring
  • Role-based access controls within the Service

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Specific retention periods depend on your subscription plan:

  • Starter plan: analytics data retained for up to 3 years
  • Growth plan: analytics data retained for up to 5 years
  • Scale plan: analytics data retained indefinitely

Upon account deletion, we will delete or anonymize your data within 30 days, except where retention is required by applicable law or for legitimate business purposes (e.g., fraud prevention, financial record-keeping).

7. GDPR Compliance (European Users)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

  • Legal Basis: We process personal data based on (a) performance of a contract (providing the Service), (b) legitimate interests (improving the Service, security), and (c) consent (where required).
  • Data Subject Rights: You have the right to access, correct, delete, restrict processing of, and port your personal data. You may also object to processing based on legitimate interests.
  • International Transfers: Your data may be processed in countries other than your own. We ensure appropriate safeguards are in place, including Standard Contractual Clauses where required.
  • Data Protection Officer: For GDPR-related inquiries, reach out on X (Twitter).

To exercise your GDPR rights, please reach out on X (Twitter). We will respond to all requests within 30 days.

8. CCPA Compliance (California Users)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

  • Right to Know: You have the right to know what personal information we collect, use, and disclose about you.
  • Right to Delete: You have the right to request deletion of your personal information.
  • Right to Opt-Out: We do not sell personal information. If this changes, we will provide a clear opt-out mechanism.
  • Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise your CCPA rights, reach out on X (Twitter). We will verify your identity before processing your request.

9. Cookies and Tracking Technologies

The hight tracking script is designed to operate without cookies for cross-site tracking. The Service uses:

  • Strictly necessary cookies: Session authentication tokens and preferences for the hight dashboard. These are essential for the Service to function and cannot be disabled.
  • No advertising or cross-site tracking cookies: We do not use cookies to track users across websites or for advertising purposes.

You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies may impair the functionality of the Service.

10. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete it promptly. If you believe a child has provided us with personal information, please reach out on X (Twitter).

11. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access through the Service.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date and, where appropriate, notifying you via email or in-app notification. Your continued use of the Service after the effective date of any changes constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out: