Sensitive text here
-``` - -Or use a custom selector: +If your pages display non-sensitive content you want visible in replays, use `unmaskTextSelector` to opt specific elements out of masking: ```ts sessionReplay: { enabled: true, - maskTextSelector: '.pii, [data-sensitive]', + unmaskTextSelector: '[data-openpanel-unmask]', } ``` +```html +Welcome to the dashboard
+ +John Doe · john@example.com
+``` + +You can also use any CSS selector to target elements by class, tag, or attribute: + +```ts +sessionReplay: { + enabled: true, + unmaskTextSelector: '.replay-safe, nav, footer', +} +``` + +### Disabling full text masking + +If you want to disable full text masking and return to selector-based masking, set `maskAllText: false`. In this mode only elements with `data-openpanel-replay-mask` are masked: + +```ts +sessionReplay: { + enabled: true, + maskAllText: false, +} +``` + +```html +This will be masked
+This will be visible in replays
+``` + ++ OpenPanel AB +
++ Version 1.0 · Last updated: March 3, 2026 +
++ This Data Processing Agreement ("DPA") is entered into between + OpenPanel AB ("OpenPanel", "Processor") and the customer identified in + the signature block below ("Controller"). It applies where OpenPanel + processes personal data on behalf of the Controller as part of the + OpenPanel Cloud service, and forms part of the OpenPanel Terms of + Service. +
+ ++ OpenPanel is built to minimize personal data collection by design. + We do not use cookies for analytics tracking. We do not store IP + addresses. Instead, we generate a daily-rotating anonymous + identifier using a one-way hash of the visitor's IP address, user + agent, and project ID combined with a salt that is replaced every 24 + hours. The raw IP address is discarded immediately and the + identifier becomes irreversible once the salt is rotated. +
++ The data we store per event is: +
++ No persistent identifiers, no cookies, no cross-site tracking. + Because of this approach, the analytics data OpenPanel collects in + standard website tracking mode does not constitute personal data + under GDPR Art. 4(1). We provide this DPA for Controllers who + require it for their own compliance documentation and records of + processing activities. +
++ Session replay (optional feature) +
++ OpenPanel optionally supports session replay, which must be + explicitly enabled by the Controller. When enabled, session replay + records DOM snapshots and user interactions (mouse movements, clicks, + scrolls) using rrweb. All text content and form inputs are masked by + default. The Controller is responsible for ensuring their use of + session replay complies with applicable privacy law, including + providing appropriate notice to end users. +
++ OpenPanel acts as a Processor when processing data on behalf of the + Controller. The Controller is responsible for the analytics data + collected from visitors to their websites and applications. +
++ OpenPanel commits to the following: +
++ The Controller confirms that: +
++ OpenPanel uses the following sub-processors to deliver the service: +
+| + Sub-processor + | ++ Purpose + | ++ Location + | +
|---|---|---|
| + Hetzner Online GmbH + | ++ Cloud infrastructure and data storage + | ++ Germany (EU) + | +
| + Cloudflare R2 + | ++ Backup storage + | +EU | +
+ OpenPanel will inform the Controller of any intended changes to this + list with reasonable notice, giving the Controller the opportunity + to object. +
++ Data minimization and anonymization +
+Access control
++ Encryption and transport security +
++ Infrastructure and availability +
+Incident response
+Open source
++ OpenPanel stores and processes all analytics data on Hetzner + infrastructure located in Germany. No Personal Data is transferred + to countries outside the EEA in the course of delivering the + service. +
++ This DPA is governed by the laws of Sweden and is interpreted in + accordance with the GDPR. +
++ Annex +
++ Execution +
++ Processor +
+OpenPanel AB
++ Sankt Eriksgatan 100, 113 31 Stockholm, Sweden +
++ Controller +
+{label}
+