> Air360 is an EU based ecommerce analytics tool with session replay and heatmaps. Which cookies it sets and when GDPR consent is required. > > Canonical: https://www.flowconsent.com/en/services/analytics/air360 Analytics # Air360 Analytics · [Official website](https://www.air360.io) Air360 is an ecommerce focused product analytics and behavioural tracking platform offering heatmaps, session replay, funnel analysis and feature flags. The vendor is based in Spain and the primary infrastructure is hosted in the European Union. [Block Air360 until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=analytics) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Analytics](https://www.flowconsent.com/en/services/analytics) - Consent Analytics - Prior consent Required - Documented cookies 5 - Third-party domains 4 - Servers European Union (Spain, vendor infrastructure) Overview ## What does Air360 do? ## **What is Air360** Air360 is a product analytics platform tailored to ecommerce merchants. It combines page heatmaps, click maps, scroll maps, session replay, multi step funnel analysis and feature flags to help conversion and product teams diagnose friction along the customer journey. The vendor is based in Spain and the primary processing infrastructure is hosted in the European Union, which makes Air360 attractive for retailers seeking an alternative to US based session replay tools. ## **What data and cookies Air360 collects** Air360 sets a first party persistent visitor identifier, a session identifier and a feature flag cookie storing which experiments are active for the visitor. It captures page views, clicks, mouse movements, scrolls, form interactions, the URL, the user agent, the IP address, the device characteristics and a stream of DOM changes used to reconstruct the session replay. When session replay is enabled, the captured stream may include text typed in inputs unless those inputs are explicitly masked. ## **GDPR and ePrivacy implications** Behavioural analytics, session replay and feature flag cookies are not strictly necessary to deliver the storefront, so Article 5(3) ePrivacy requires prior informed consent before they are written. The session replay raises a specific risk under the GDPR because it can incidentally capture personal data, special category data (for example health products in a basket) or payment details if input masking is incomplete. National regulators such as the AEPD, the CNIL and the Garante have published guidance treating session replay tools as requiring opt in consent and strict input masking. ## **Consent and user controls** The Air360 snippet must be blocked by the consent management platform until the visitor accepts an analytics or product analytics category. Refusal must be as easy as acceptance, the banner must name Air360 and the session replay capability, the privacy notice must explain what is recorded and how to delete a replay. All sensitive inputs, payment fields and personal identifiers must be masked using Air360 configuration, and a do not record list must be maintained for sensitive pages. ## **Data transfers and hosting** Air360 hosts its main processing infrastructure in the European Union (Spain), so behavioural events and session replays normally stay inside the GDPR perimeter. Some sub processors used for CDN, error monitoring or transactional email may operate outside the EEA. Those sub transfers are framed by EU standard contractual clauses and a transfer impact assessment, and the sub processors register is made available to customers under the Air360 data processing agreement. ## **Practical compliance steps** Sign the Air360 data processing agreement, gate the snippet behind a consent management platform, configure aggressive masking for all input fields and any selector that may contain personal or payment data, exclude sensitive pages (checkout, account, customer profile) from session replay when not strictly needed, set a short retention for replay sessions, restrict access to the Air360 dashboard via SSO and role based controls, document the processing in the Article 30 records and update the privacy and cookie policy with a clear mention of Air360, the cookies set, the session replay and the retention. Compliance ## Air360 and the GDPR Air360 is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Article 5(3) ePrivacy Directive and Article 6(1)(a) GDPR) for behavioural analytics, session replay and feature flag cookies on the storefront. Legitimate interest (Article 6(1)(f) GDPR) may apply to aggregated funnel reporting once the data have been pseudonymised and a balancing test is documented. - Risk level high - Applicable regulations GDPR, ePrivacy Directive (Cookie Law), national implementations such as the Spanish LSSI, the French Data Protection Act, the German TDDDG and the Italian Codice Privacy, plus EU consumer law for ecommerce funnels and EDPB Guidelines 03/2022 on dark patterns. ### Impact assessment (DPIA) A DPIA is recommended whenever Air360 is deployed on an ecommerce site, because session replay captures fine grained behavioural data that may include keystrokes, mouse movements, form interactions and, if not masked properly, fragments of personal or payment information. Document the masking strategy, the retention of replay sessions, the access controls, the sub processors used and the legitimate interest balancing test for aggregated funnel analytics. ### Sample text for your banner > We use Air360 to understand how visitors interact with our store, with heatmaps, session replays and funnel analysis. This sets first party cookies and sends behavioural events to Air360 servers in the European Union. We need your consent to enable behavioural analytics. You can accept, refuse or withdraw your consent at any time. Cookies and trackers ## What Air360 sets and contacts - Tracking method JavaScript snippet with first party cookies, session replay capture and behavioural event streaming - Server location European Union (Spain, vendor infrastructure) ### Cookies set (5) | Name | Type | Duration | Purpose | | --------- | ---------------- | -------- | ------------------------------------------------------------------------------------------------------------------ | | a360\_uid | http\_persistent | 1 year | Persistent first party visitor identifier used by Air360 for behavioural analytics and session replay attribution. | | a360\_sid | http\_session | Session | Session identifier used to group behavioural events captured during a single visit. | | a360\_ff | http\_persistent | 90 days | Stores the feature flag and A B test variants assigned to the visitor by Air360. | | a360\_rec | http\_persistent | 30 days | Indicates whether the session replay recording is active for the current visitor sample. | | a360\_cs | http\_persistent | 6 months | Stores the consent choices forwarded to Air360 by the cookie banner. | ### Third-party domains contacted (4) - `air360.io` - `app.air360.io` - `cdn.air360.io` - `events.air360.io` Questions ## Frequently asked questions about Air360 Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does Air360 set? Air360 sets a first party persistent visitor identifier, a session identifier and a feature flag cookie storing the experiments active for the visitor. Additional cookies may be set for consent state and for the session replay stream when enabled. ### Is consent required for Air360? Yes. Behavioural analytics, session replay and feature flag cookies are not strictly necessary, so Article 5(3) ePrivacy requires explicit opt in. The Air360 snippet must remain blocked until the visitor has accepted an analytics or product analytics category, with refusal as easy as acceptance. ### What is the legal basis for processing? Consent under Article 6(1)(a) GDPR for behavioural analytics and session replay. Legitimate interest under Article 6(1)(f) GDPR may apply to aggregated and pseudonymised funnel reports once the data have been masked and the balancing test is documented. ### Are data transferred to the United States? No, the main Air360 infrastructure is in the European Union (Spain). Some sub processors (CDN, error monitoring, transactional email) may operate outside the EEA. In that case, the transfer relies on EU standard contractual clauses and a documented transfer impact assessment listed in the Air360 sub processors register. ### Do I need a DPIA for Air360? Yes, a DPIA is appropriate for any deployment that uses session replay or covers a significant volume of EU visitors. The processing involves systematic monitoring of online behaviour and a risk of capturing personal or special category data through replays, which meets several criteria of Article 35 GDPR. ### How do I implement Air360 in a compliant way? Sign the Air360 DPA, gate the snippet behind a consent management platform, enable input masking by default, exclude checkout, account and other sensitive pages from session replay when not strictly needed, set a short retention for replays, restrict access via SSO and roles, document a TIA for any sub transfer and review the configuration regularly. ### Are there alternatives to Air360? Comparable behavioural analytics and session replay tools include Hotjar, Contentsquare, FullStory, Mouseflow, Smartlook, Microsoft Clarity, Matomo Heatmaps and Piwik PRO. Some are EU based or offer EU hosting, others are US based. The choice depends on hosting, masking capabilities and contractual terms. ### How do I update my cookie policy for Air360? Add a dedicated entry that names Air360, lists each cookie with purpose and duration, identifies Air360 as the processor and the EU hosting region, mentions the session replay capability and its masking, links to the Air360 privacy notice and explains how visitors can refuse or withdraw consent and request deletion of their replays. Same category ## More services: Analytics [See the whole category](https://www.flowconsent.com/en/services/analytics) ### [Adobe Experience Platform Launch](https://www.flowconsent.com/en/services/analytics/adobe-experience-platform-launch) [Adobe Experience Platform Launch is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Adobe Experience Platform Launch offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Adobe Experience Platform Launch empowers organizations to optimize strategy and.](https://www.flowconsent.com/en/services/analytics/adobe-experience-platform-launch) [Analytics](https://www.flowconsent.com/en/services/analytics/adobe-experience-platform-launch) · ### [Chartbeat](https://www.flowconsent.com/en/services/analytics/chartbeat) [Chartbeat is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Chartbeat supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Chartbeat enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/chartbeat) [Analytics](https://www.flowconsent.com/en/services/analytics/chartbeat) · ### [Marfeel](https://www.flowconsent.com/en/services/analytics/marfeel) [Marfeel is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Marfeel offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Marfeel empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/marfeel) [Analytics](https://www.flowconsent.com/en/services/analytics/marfeel) · ### [Google Tag Manager for WordPress](https://www.flowconsent.com/en/services/analytics/google-tag-manager-for-wordpress) [Google Tag Manager for WordPress is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. Google Tag Manager for WordPress supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, Google Tag Manager for WordPress.](https://www.flowconsent.com/en/services/analytics/google-tag-manager-for-wordpress) [Analytics](https://www.flowconsent.com/en/services/analytics/google-tag-manager-for-wordpress) · ### [Cloudflare Browser Insights](https://www.flowconsent.com/en/services/analytics/cloudflare-browser-insights) [Cloudflare Browser Insights is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Cloudflare Browser Insights supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Cloudflare Browser Insights enables informed decisions that.](https://www.flowconsent.com/en/services/analytics/cloudflare-browser-insights) [Analytics](https://www.flowconsent.com/en/services/analytics/cloudflare-browser-insights) · ### [Ecomtrack](https://www.flowconsent.com/en/services/analytics/ecomtrack) [Ecomtrack is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Ecomtrack integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Ecomtrack helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/analytics/ecomtrack) [Marketing](https://www.flowconsent.com/en/services/analytics/ecomtrack) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)