Visitor data

Trace checks that your tracking works. It is not an analytics product: it does not count visitors, build profiles or follow anyone across pages or websites. For traffic and conversions, use SiteOS Analytics. This page lists what the observer does in a visitor's browser so you can describe it in your privacy notice and choose when it starts.

What the observer reads

The observer watches the website's own tracking activity: requests to supported services, data layer pushes, selected script and pixel loads, the consent state from your banner and, when installed, the separate GTM execution monitor. It reads names, types and outcomes locally and sends a bounded description. It does not read cookie or storage values, page content, form input or the visitor's identity, and it sets no cookie or storage entry of its own.

Three optional settings in Settings → Collection read a little more, always in the browser:

• Personal data checks and Ecommerce value checks read values only while your consent source reports that the visitor allows analytics, and stop on withdrawal. Personal data checks look for an email address or phone number in data-layer parameters, in Google Analytics, Google Ads, HubSpot and Meta Pixel request parameters and in the page address sent to those services. Ecommerce value checks look at the currency, value, transaction ID and items of ecommerce events sent to Google Analytics or Meta Pixel and of data-layer ecommerce objects. Only the kind and place of a problem leave the page, never the value. Issues and rules describes the resulting findings.
• Campaign tagging reads the landing page address once, when collection starts, and keeps only the names of known campaign parameters that have a value.

What it sends

Sent	Example
Event and property names allowed by your collection mode	purchase, currency, never their values
The service, delivery stage and technical result of a tracking request	Google Analytics request completed with HTTP 2xx
A page path only when it matches a template you approved	/users/:id, never the actual identifier
With Campaign tagging on, which known campaign parameters a landing URL had	utm_source, gclid, never their values
After analytics consent, with Personal data checks on, where an email or phone number appeared	email in uid of sign_up, never the value
After analytics consent, with Ecommerce value checks on, the kind of value problem	currency missing on purchase, never the value
The consent state your banner reports	analytics granted, advertising denied
The host name of another third-party service, for service discovery	collect.vendor.com, see below
Random page and operation identifiers, timestamps and coverage counters	Identifiers that last for one open page

Strict collection, the default, sends only built-in names plus names you approve. Extended mode, which you must choose deliberately, allows other names and masks page paths heuristically instead. Property values, request bodies, query strings and cookie values are never sent in any mode.

For service discovery, the observer sends the host name of a third-party request it does not decode, without its path, query or port. From observer 0.9 it first drops a subdomain part that looks like an identifier, such as a long random token or a UUID. Trace Edge then replaces the host name with the recognized service and its registrable domain, for example vendor.com, before anything is queued or stored.

Where it goes and how long it is kept

The observer sends data to Trace Edge on Cloudflare without cookies or a referrer, and the normalized evidence is stored by the SiteOS application. Visitor IP addresses and browser user agents are not part of stored observations, but they reach network infrastructure like any web request.

• Raw observations: seven days. A scheduled job deletes them every six hours.
• Hourly aggregates: 90 days. Daily aggregates and findings: 13 months.
• Backups and other records follow the Data Processing Agreement, which also lists the subprocessors and locations.

SiteOS processes this data on your behalf under the DPA.

Choose when Trace starts

In Settings → Collection, Start collecting decides when the observer begins:

• Immediately (default). Trace also sees what loads before a visitor chooses and after a rejection, which consent checks need.
• After analytics consent. Until your consent source grants analytics, the observer keeps and sends nothing; once its configuration has loaded, it reads only that decision. A grant starts observation and a withdrawal stops it, discarding anything not yet sent. Trace then cannot show what ran before the choice.

Waiting for consent needs observer 0.9 or later and a consent source other than No consent observation. An older installed snippet stops collecting rather than start early, so update the snippet from Installation when you choose it; see Observer and coverage.

With the SiteOS Cookie banner as the consent source, Trace can also appear in that banner; see Banner design & content. When collection, Personal data checks or Ecommerce value checks follow its Analytics choice, Settings → Collection → Consent banner → Add to banner lists SiteOS Trace under Analytics, so visitors see it among the services their choice covers.

Your decision

Whether Trace may start before consent depends on your purpose, your jurisdiction and your own assessment; minimized collection does not by itself remove consent obligations. Describe Trace in your privacy notice, decide when it starts, and keep personal information out of approved names, page templates and labels. See Consent and privacy for consent sources and how Trace reports consent evidence.