TypeUI logoTypeUI

TypeUI Trust Center

One place to understand how TypeUI protects your account, website analytics, and visitor data.

Effective date: August 20, 2026

Use this page when you want to understand TypeUI's privacy and security practices or share them with your legal, security, or procurement team. These documents explain the product as it works today. They are not legal advice, and using TypeUI does not automatically make your website compliant with every law.

Find the answer you need

  • Security — how we protect your account, dashboard, analytics, previews, and backups.
  • Insights Data Policy — what the tracker collects, what it leaves out, and how long data stays.
  • Data Retention — the 90-day detailed-session window and the lifecycle for aggregates and backups.
  • GDPR Compliance — how consent works and what you need to configure on your website.
  • Data Processing Addendum — processor terms you can use when TypeUI handles analytics on your behalf.
  • Privacy Policy — how we handle your account, billing, support, and TypeUI service information.
  • Terms of Service — the rules for using TypeUI, subscriptions, and service responsibilities.

Who is responsible for what

We manage your TypeUI account, billing, security, and support data. When you install Insights, you decide which website to track, when collection starts, and how you use the results. This normally makes you the controller or business for your visitors' analytics, while Bergside acts as the processor or service provider. The exact roles can vary by law and use case.

Privacy controls included with Insights

  • You can keep the tracker off until your consent tool enables analytics.
  • Withdrawing consent stops collection and clears the local session.
  • Global Privacy Control and Do Not Track signals disable collection.
  • Typed text, form values, page content, query strings, URL fragments, complete referrer URLs, raw IP addresses, and full user-agent strings are not saved as Insights analytics.
  • Origin checks, authenticated private operations, service limits, abuse protection, workspace authorization, and optional MFA protect the service.
  • Analytics starts private. A verified website owner can choose a read-only unlisted, password-protected, or public shared dashboard; only the public mode is eligible for search indexing.
  • You can exclude sensitive interface areas and delete a website and its analytics from your dashboard.
  • Restricted analytics recovery copies are kept separately from live data.

How usage limits work

Insights subscriptions are limited by pageviews across the workspace over a rolling 30-day window. Sessions and events do not independently consume or pause a paid plan. If a batch would cross the pageview allowance, TypeUI rejects the whole batch before writing analytics and resumes only after usage falls below the allowance or the plan changes. Other service-protection controls do not change the customer's paid allowance.

The live count represents sessions with activity during the previous 90 seconds, so it is an approximate presence signal rather than an exact count of identifiable people.

What happens to your data over time

Detailed sessions, page journeys, and connected custom events are kept on a rolling 90-day basis. Aggregate traffic, engagement, and UI interaction totals remain available while your subscription is active. If paid access ends, collection pauses and a 30-day recovery period begins. If you do not return, we automatically delete the remaining analytics and private heatmap previews. The Data Retention page explains the complete timeline.

TypeUI keeps restricted recovery copies to reduce operational risk. A restore is best-effort and may not include the latest activity. After deletion, an isolated recovery copy may remain inaccessible for up to 32 days before scheduled cleanup completes.

Recovery copies for website analytics and TypeUI account data are managed separately and may follow different provider recovery cycles.

Which providers help run TypeUI

TypeUI uses established providers for hosting, authentication, infrastructure, billing, email, support, abuse prevention, and product analytics. The Privacy Policy identifies providers used across TypeUI, and the DPA lists subprocessors that may process customer Insights data.

Processing may occur across provider regions and global networks. Review the DPA when assessing transfer requirements for your website.

Current certification status

TypeUI does not currently claim SOC 2, ISO 27001, or another independent compliance certification, and we do not publish an independent legal opinion for Insights. You remain responsible for your lawful basis, notices, consent setup, data-subject requests, transfer assessment, and any other obligations that apply to your website.

These controls and provider safeguards reduce risk but do not guarantee uninterrupted service, perfect analytics, absolute security, or complete recovery. Keep independent exports for information you must preserve. The Terms of Service explains the applicable service limitations, liability cap, and mandatory rights that cannot be waived.

Need help?

If you still have a security or privacy question, contact us through the contact page.