Overheat
Overheat is a European privacy-focused session recording and heatmap tool designed as a GDPR-compliant alternative to Hotjar. It captures user interactions to help website owners understand how visitors navigate their site. With EU-based infrastructure and privacy-by-design principles, Overheat eliminates the third-country transfer risk associated with US-based analytics tools. Consent is still required before session recordings begin under the ePrivacy Directive.
What does Overheat do?
What is Overheat?
Overheat is a European privacy-focused session recording and heatmap analytics tool that provides website owners with visual insights into how visitors interact with their pages. It records mouse movements, clicks, scroll depth, and navigation patterns to create heatmaps and session replays. Overheat is specifically designed as a GDPR-compliant alternative to US-based tools like Hotjar and Microsoft Clarity, with EU-based data storage and privacy-by-design features such as automatic masking of sensitive input fields.
What data does Overheat collect?
Overheat records mouse movements, click positions, scroll depth, page navigation sequences, and session duration. It may also capture form interaction data (fields focused, not necessarily values). IP addresses and browser information are collected. Sensitive form fields such as passwords and payment inputs are automatically masked. Session recordings are stored on EU-based servers.
GDPR compliance and EU advantage
Overheat's EU data storage eliminates the primary GDPR risk associated with US-based session recording tools. No transfer mechanism is required. The privacy-by-design approach including automatic form field masking reduces the risk of inadvertently capturing sensitive personal data in recordings. The ePrivacy Directive still requires consent before session recording begins, as recording user behaviour constitutes non-essential data collection regardless of storage location.
Consent requirements
Consent is required before Overheat scripts load and session recording begins. The consent notice should explain that session recordings and heatmaps are used to improve the website, describe the data captured, and confirm EU data storage. Given the EU location, no US transfer disclosure is needed. Users who decline must not have their sessions recorded.
Data location and transfers
All data is processed in the EU. No transfer mechanism required. This makes Overheat suitable for organisations with strict data localisation requirements who need session recording analytics.
Practical compliance steps
Obtain ePrivacy consent before Overheat loads. Verify automatic form field masking is active. Update your privacy policy to describe Overheat as a processor with EU data storage. Sign a DPA with Overheat. Configure session recording sampling rates and retention periods to minimise data collection. Document the processing in your RoPA noting the EU data location.
Overheat and the GDPR
Overheat is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- Consent (Art. 6(1)(a) GDPR) for session recordings and heatmap tracking as these involve systematic observation of individual user behaviour. Legitimate interest (Art. 6(1)(f)) may apply to aggregate, anonymised heatmap data with a documented balancing test.
- Risk level
- medium
- Applicable regulations
- GDPR, ePrivacy Directive
Impact assessment (DPIA)
A DPIA is advisable when Overheat session recordings capture sensitive user interactions at scale, such as form completions, health-related page visits, or financial account pages. The EU data location significantly reduces risk compared to US-based alternatives.
Sample text for your banner
We use Overheat to record and analyse how visitors use our website through session recordings and heatmaps. Overheat collects interaction data including mouse movements, clicks, and scroll behaviour. Data is processed in the EU. Please accept to enable session recording and heatmap analytics.
What Overheat sets and contacts
- Tracking method
- JavaScript snippet, session recording, heatmap tracking, click and scroll event capture, first-party cookies
- Server location
- European Union (Overheat is a European privacy-focused analytics tool)
- Cookieless mode available
- Yes
Cookies set (2)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| oh_session | session | Session | Session identifier used to maintain the active session recording and associate interaction events |
| oh_uid | persistent | 1 year | Visitor identifier used to stitch sessions across page loads for complete session replay |
Third-party domains contacted (2)
overheat.iocdn.overheat.io
Frequently asked questions about Overheat
Can't find your question? Write to us, we answer fast.
What does Overheat record?
Overheat records mouse movements, click positions, scroll depth, page navigation sequences, and session duration. Sensitive form fields such as passwords and payment inputs are automatically masked. Recordings are stored on EU-based servers.
Does Overheat require consent under GDPR?
Yes. Session recording and heatmap tracking are non-essential and require prior ePrivacy consent regardless of EU data location. Users who decline must not have their sessions recorded.
What is the legal basis for using Overheat?
Consent (Art. 6(1)(a)) is required for session recordings and individual heatmap tracking. Legitimate interest may apply to aggregate, anonymised heatmap data with a documented balancing test.
Does Overheat transfer data outside the EU?
No. All data is processed within the EU. No GDPR Chapter V transfer mechanism is required, a major advantage over US-based tools like Hotjar or FullStory.
Do I need a DPIA for Overheat?
Advisable when recordings capture sensitive interactions at scale (health, finance, legal pages). The EU data location significantly reduces the risk profile versus US alternatives.
How do I implement Overheat compliantly?
Obtain ePrivacy consent before loading. Verify automatic form masking is active. Sign a DPA with Overheat. Update your privacy policy noting EU data storage. Configure retention periods and document the processing in your RoPA.
How does Overheat compare to Hotjar for GDPR compliance?
Overheat stores all data in the EU, eliminating the US transfer risk. Hotjar requires SCCs; Overheat does not. Both require ePrivacy consent. For EU organisations, Overheat is the simpler compliance choice.
How do I add Overheat to my cookie policy?
List the Overheat session cookie under analytics, note the EU data storage, reference Overheat as processor, and link to their privacy policy. No third-country transfer disclosure is required.
Insider
Insider is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Insider supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Insider enables informed decisions that improve experience and drive results.
Bounce Commerce
Bounce Commerce offers a scalable e-commerce solution designed to help merchants sell products and services online. Its feature set includes customizable storefronts, multi-currency support, automated tax calculations, and advanced shipping options. Bounce Commerce integrates with leading payment gateways, marketing platforms, and fulfillment services. Built-in analytics and reporting tools help merchants track performance, optimize conversions, and make data-driven business decisions for sustainable growth.
Salesforce Interaction Studio
Salesforce Interaction Studio is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. Salesforce Interaction Studio provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, Salesforce Interaction Studio ensures optimal performance at scale.
Personizely
Personizely is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Personizely provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Personizely helps deliver the right message to the right audience at the right time.
Hello Retail
Hello Retail is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Hello Retail provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Hello Retail helps deliver the right message to the right audience at the right time.
DreamROI
DreamROI is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. DreamROI provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, DreamROI helps deliver the right message to the right audience at the right time.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.