> Overheat and GDPR: EU data storage, session recording privacy, heatmap tracking and the consent requirements to check before using it on a European site. > > Canonical: https://www.flowconsent.com/en/services/personalization/overheat Personalization # Overheat Analytics Overheat is a European privacy-focused session recording and heatmap tool designed as a GDPR-compliant alternative to Hotjar. It captures user interactions to help website owners understand how visitors navigate their site. With EU-based infrastructure and privacy-by-design principles, Overheat eliminates the third-country transfer risk associated with US-based analytics tools. Consent is still required before session recordings begin under the ePrivacy Directive. [Block Overheat until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=personalization) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Personalization](https://www.flowconsent.com/en/services/personalization) - Consent Analytics - Prior consent Required - Documented cookies 2 - Third-party domains 2 - Servers European Union (Overheat is a European privacy-focused analytics tool) Overview ## What does Overheat do? ## **What is Overheat?** Overheat is a European privacy-focused session recording and heatmap analytics tool that provides website owners with visual insights into how visitors interact with their pages. It records mouse movements, clicks, scroll depth, and navigation patterns to create heatmaps and session replays. Overheat is specifically designed as a GDPR-compliant alternative to US-based tools like Hotjar and Microsoft Clarity, with EU-based data storage and privacy-by-design features such as automatic masking of sensitive input fields. ## **What data does Overheat collect?** Overheat records mouse movements, click positions, scroll depth, page navigation sequences, and session duration. It may also capture form interaction data (fields focused, not necessarily values). IP addresses and browser information are collected. Sensitive form fields such as passwords and payment inputs are automatically masked. Session recordings are stored on EU-based servers. ## **GDPR compliance and EU advantage** Overheat's EU data storage eliminates the primary GDPR risk associated with US-based session recording tools. No transfer mechanism is required. The privacy-by-design approach including automatic form field masking reduces the risk of inadvertently capturing sensitive personal data in recordings. The ePrivacy Directive still requires consent before session recording begins, as recording user behaviour constitutes non-essential data collection regardless of storage location. ## **Consent requirements** Consent is required before Overheat scripts load and session recording begins. The consent notice should explain that session recordings and heatmaps are used to improve the website, describe the data captured, and confirm EU data storage. Given the EU location, no US transfer disclosure is needed. Users who decline must not have their sessions recorded. ## **Data location and transfers** All data is processed in the EU. No transfer mechanism required. This makes Overheat suitable for organisations with strict data localisation requirements who need session recording analytics. ## **Practical compliance steps** Obtain ePrivacy consent before Overheat loads. Verify automatic form field masking is active. Update your privacy policy to describe Overheat as a processor with EU data storage. Sign a DPA with Overheat. Configure session recording sampling rates and retention periods to minimise data collection. Document the processing in your RoPA noting the EU data location. Compliance ## Overheat and the GDPR Overheat is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) for session recordings and heatmap tracking as these involve systematic observation of individual user behaviour. Legitimate interest (Art. 6(1)(f)) may apply to aggregate, anonymised heatmap data with a documented balancing test. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive ### Impact assessment (DPIA) A DPIA is advisable when Overheat session recordings capture sensitive user interactions at scale, such as form completions, health-related page visits, or financial account pages. The EU data location significantly reduces risk compared to US-based alternatives. ### Sample text for your banner > We use Overheat to record and analyse how visitors use our website through session recordings and heatmaps. Overheat collects interaction data including mouse movements, clicks, and scroll behaviour. Data is processed in the EU. Please accept to enable session recording and heatmap analytics. Cookies and trackers ## What Overheat sets and contacts - Tracking method JavaScript snippet, session recording, heatmap tracking, click and scroll event capture, first-party cookies - Server location European Union (Overheat is a European privacy-focused analytics tool) - Cookieless mode available Yes ### Cookies set (2) | Name | Type | Duration | Purpose | | ----------- | ---------- | -------- | ------------------------------------------------------------------------------------------------- | | oh\_session | session | Session | Session identifier used to maintain the active session recording and associate interaction events | | oh\_uid | persistent | 1 year | Visitor identifier used to stitch sessions across page loads for complete session replay | ### Third-party domains contacted (2) - `overheat.io` - `cdn.overheat.io` Questions ## Frequently asked questions about Overheat Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What does Overheat record? Overheat records mouse movements, click positions, scroll depth, page navigation sequences, and session duration. Sensitive form fields such as passwords and payment inputs are automatically masked. Recordings are stored on EU-based servers. ### Does Overheat require consent under GDPR? Yes. Session recording and heatmap tracking are non-essential and require prior ePrivacy consent regardless of EU data location. Users who decline must not have their sessions recorded. ### What is the legal basis for using Overheat? Consent (Art. 6(1)(a)) is required for session recordings and individual heatmap tracking. Legitimate interest may apply to aggregate, anonymised heatmap data with a documented balancing test. ### Does Overheat transfer data outside the EU? No. All data is processed within the EU. No GDPR Chapter V transfer mechanism is required, a major advantage over US-based tools like Hotjar or FullStory. ### Do I need a DPIA for Overheat? Advisable when recordings capture sensitive interactions at scale (health, finance, legal pages). The EU data location significantly reduces the risk profile versus US alternatives. ### How do I implement Overheat compliantly? Obtain ePrivacy consent before loading. Verify automatic form masking is active. Sign a DPA with Overheat. Update your privacy policy noting EU data storage. Configure retention periods and document the processing in your RoPA. ### How does Overheat compare to Hotjar for GDPR compliance? Overheat stores all data in the EU, eliminating the US transfer risk. Hotjar requires SCCs; Overheat does not. Both require ePrivacy consent. For EU organisations, Overheat is the simpler compliance choice. ### How do I add Overheat to my cookie policy? List the Overheat session cookie under analytics, note the EU data storage, reference Overheat as processor, and link to their privacy policy. No third-country transfer disclosure is required. Same category ## More services: Personalization [See the whole category](https://www.flowconsent.com/en/services/personalization) ### [Insider](https://www.flowconsent.com/en/services/personalization/insider) [Insider is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Insider supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Insider enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/personalization/insider) [Marketing](https://www.flowconsent.com/en/services/personalization/insider) · ### [Bounce Commerce](https://www.flowconsent.com/en/services/personalization/bounce-commerce) [Bounce Commerce offers a scalable e-commerce solution designed to help merchants sell products and services online. Its feature set includes customizable storefronts, multi-currency support, automated tax calculations, and advanced shipping options. Bounce Commerce integrates with leading payment gateways, marketing platforms, and fulfillment services. Built-in analytics and reporting tools help merchants track performance, optimize conversions, and make data-driven business decisions for sustainable growth.](https://www.flowconsent.com/en/services/personalization/bounce-commerce) [Preferences](https://www.flowconsent.com/en/services/personalization/bounce-commerce) · ### [Salesforce Interaction Studio](https://www.flowconsent.com/en/services/personalization/salesforce-interaction-studio) [Salesforce Interaction Studio is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. Salesforce Interaction Studio provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, Salesforce Interaction Studio ensures optimal performance at scale.](https://www.flowconsent.com/en/services/personalization/salesforce-interaction-studio) [Preferences](https://www.flowconsent.com/en/services/personalization/salesforce-interaction-studio) · ### [Personizely](https://www.flowconsent.com/en/services/personalization/personizely) [Personizely is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Personizely provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Personizely helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/personalization/personizely) [Preferences](https://www.flowconsent.com/en/services/personalization/personizely) · ### [Hello Retail](https://www.flowconsent.com/en/services/personalization/hello-retail) [Hello Retail is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Hello Retail provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Hello Retail helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/personalization/hello-retail) [Preferences](https://www.flowconsent.com/en/services/personalization/hello-retail) · ### [DreamROI](https://www.flowconsent.com/en/services/personalization/dreamroi) [DreamROI is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. DreamROI provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, DreamROI helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/personalization/dreamroi) [Preferences](https://www.flowconsent.com/en/services/personalization/dreamroi) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)