#Privacy and capture scope

Einstellungen › Datenschutz & Erfassung decides what X3 captures on your site. You are the controller of this data; X3 processes it on your behalf and gives you the switches, a factual risk assessment for each of them and the texts for your banner and privacy policy. The decision is yours – X3 does not give legal advice. Changes need project:admin, are versioned (a concurrent edit gets a conflict instead of overwriting) and land in the audit log.

#Consent mode

The mode is the ceiling: a signal can be set lower than the mode, never higher. Switching the mode resets the signals to that mode's defaults.

#Levels per signal

Each signal has one of four levels: Aus, Nur mit Zustimmung, Solange nicht abgelehnt, Immer. The banner reports two purposes to X3 – statistics (analytics) and session recording (recordings) – each as granted, pending or denied.

Defaults in the standard mode: the four base signals and forms „Solange nicht abgelehnt“, mouse movement, recording and single live visitors „Nur mit Zustimmung“. No default needs an acknowledgement.

#Risk traffic light and acknowledgement

Every level shows a traffic light with one sentence and its source, for example:

• Klicks · Solange nicht abgelehnt – yellow: „Liest Klickziel und Position im Browser aus; § 25 gilt auch ohne Cookies. Grauzone wie Dein bisheriger Tracker.“ (§ 25 TDDDG, EDPB 2/2023)
• Sitzungsaufzeichnung · Solange nicht abgelehnt – red: „Aufzeichnung ohne Einwilligung halten DSK und CNIL für unzulässig; höchstes Bußgeldrisiko in dieser Liste.“
• Ort · Solange nicht abgelehnt – yellow: coarse location, no IP stored, the city only from the minimum count.

Every red level and the mode „Immer cookielos“ need an explicit acknowledgement by a project admin: the dialog shows the risk, the admin confirms with their own text, and X3 stores name, time, level and text in the settings and in the audit log (PATCH …/settings/behavior answers ack_required without it). The acknowledgements stay visible in the change log of the page.

#Texts generated from your scope

From the current settings X3 writes, in German (Du-Form) and English:

• the privacy-policy block – what is captured regardless of the banner, until rejected and only with consent, the legal basis of each group, the storage periods, that no IP is stored and no cookies are set, and that the data is never used for advertising on other sites;
• the banner purposes – „Statistik (cookielos)“ or „Statistik“, „Sitzungsaufzeichnung“ and „Live-Ansicht & Mausbewegung“, each marked opt-in or pre-selected.

The texts change when you change the scope. They never call the data „anonym“: behaviour data and recordings are pseudonymous personal data, so words like „anonym“, „anonymisiert“ or „keine personenbezogenen Daten“ are blocked in every visitor text (a test enforces this).

#Always on – not configurable

• Masking in the browser of inputs, passwords, payment fields, quiz answers and text that looks like personal data; an allowlist unmasks single elements.
• Excluded pages (login, account, checkout, payment, password reset, admin; more under the health preset) are never recorded.
• No IP storage. Location comes from edge headers; the IP is only used in memory for the cookieless session hash and never written.
• Rejection, GPC and opt-out are honoured immediately for everything except the base signals in „Immer cookielos“ – and those stop on GPC and opt-out too. With „Bei Ablehnung schon Erfasstes löschen“ (on by default) X3 also deletes what was captured in that session.
• Retention limits: recordings 7, 30 or 90 days, saved clips at most 90 days, events per the project's retention.
• Deletion per visit, visitor, lead or page; visitors delete their own data in the privacy center.
• No use for retargeting or for advertising on other websites.
• Minimum counts: aggregates appear only from kMin visitors (default 5) and hide cells below cellSuppress (default 3). Viewers without the personal-data permission never see names, and see a city only from kMin visitors.

#Presets for sensitive sites

The health preset applies the rules for special categories of data (Art. 9 GDPR): recording, mouse movement, form interactions and single live visitors are capped at „Nur mit Zustimmung“, the minimum count rises to 10, recordings are never linked to leads, AI summaries are off, quiz choices are anchored only to their container, and the exclusion list grows by appointment, patient and questionnaire pages. These locks cannot be lifted while the preset is on (preset_locked). The presets „Recht“, „Finanzen“ and „Kinder“ label the project and keep its levels; choose the levels for them deliberately.

#The data basis in the dashboard

Every heatmap, replay, report and MCP answer names its basis – „alle Besucher · solange nicht abgelehnt“ or „nur mit Zustimmung“ – so nobody mistakes a consent-only sample for all traffic.

#API

• GET /v1/projects/{project}/settings/behavior – settings, allowed maximum and risk per level, generated texts and the change log (scope analytics:read).
• PATCH /v1/projects/{project}/settings/behavior – project:admin, with version; red levels need acks: [{ key, value, text, confirmed: true }]. Answers 409 on a concurrent edit, ack_required or preset_locked.
• GET|PATCH /v1/orgs/{org}/settings/behavior – the organisation switch „Einzelbesuche an KI-Apps geben“ (default off, org:admin, audited).