FullStory

Partner Terms and Conditions: Key Points and Risks

> Scope: This agreement governs a business partner’s participation in Fullstory’s partner programs and use of the Partner Portal. It is not primarily an end-user privacy policy. Data handling is also governed by Fullstory’s Privacy Policy, Cookie Policy, Acceptable Use Policy, Service Terms, and any applicable Program Addendum.

1. Data Collection and Usage

The agreement may involve collection or access to:

• Partner profile information: Information the Partner submits or publishes in the Partner Portal. It must be truthful and accurate.
• Lead and prospect information: Identifying and business information about prospective or actual Fullstory customers, such as the Lead’s identity and likely purchase scope.
• Personal Data: Any information relating to an identified or identifiable person that is protected by applicable privacy laws.
• Account, tax, and payment information: Information required to enroll for Referral Fees.
• Login and portal activity: The Partner is responsible for activities conducted through its credentials, although the agreement does not provide detailed portal-logging disclosures.

Fullstory may use, reproduce, display, and disclose a Partner’s profile to third parties for business and program-related purposes. Prospect Information may be used only to provide services contemplated by the agreement and for related customer insights, service or feature announcements, and reporting.

Partners must not submit Sensitive Data—such as financial, health, government-identification, children’s, or special-category data—in Lead Registrations or otherwise share it with Fullstory under this agreement.

2. User/Partner Rights Regarding Data

The MPPA does not provide a detailed set of access, correction, deletion, portability, or objection rights. Those rights depend primarily on:

• Applicable data-protection laws;
• Fullstory’s Privacy Policy; and
• Any separate data-processing agreement or Service Terms that applies.

A Partner may request return or destruction of the other party’s Confidential Information. However, the recipient may retain information in ordinary-course backups, where legally required, or where reasonably needed to demonstrate compliance. Retained information remains protected by confidentiality obligations.

The Partner is responsible for giving individuals legally required privacy notices and obtaining any required consents before sharing their Personal Data with Fullstory.

3. Third-Party Sharing

The agreement permits disclosure of information to:

• Affiliates, employees, agents, contractors, and service providers with a need to know and confidentiality obligations;
• Third parties for business and program-related display of the Partner’s profile;
• Government authorities where disclosure is legally required; and
• Third-party websites or platforms linked through the Partner Portal.

Prospect Information may not be sold or otherwise shared with third parties, and may not be used to market the Partner’s own products or services unless Fullstory gives written authorization.

The agreement does not list specific vendors or explain international transfers; those details may appear in Fullstory’s separate privacy, security, or subprocessor materials.

4. AI/ML Training

The MPPA contains no express statement that Partner Data, Personal Data, Profile Information, or Prospect Information will be used to train artificial-intelligence or machine-learning models. It also contains no express prohibition on such use. Users should review the incorporated Privacy Policy, Service Terms, and any Data Processing Agreement for the controlling position.

Partners should avoid placing Customer Data or Sensitive Data in the Demo Account; Customer Data is expressly prohibited there.

5. Key Obligations and Restrictions

Partners must:

• Follow applicable privacy, anti-bribery, sanctions, export-control, and other laws.
• Maintain required licenses, permits, notices, and consents.
• Protect portal credentials and promptly report compromise.
• Complete Fullstory-required training or certifications.
• Refer Leads through approved channels and provide reasonable sales assistance.
• Use Fullstory materials and trademarks only as authorized and under branding rules.
• Act professionally and avoid deceptive, misleading, disparaging, spam, or unauthorized claims.
• Not sell, sublicense, distribute, or contract for the Services unless separately authorized.
• Not represent itself as Fullstory’s agent or bind Fullstory.
• Keep Confidential Information confidential and return or destroy it when requested.
• Not subcontract or outsource its contractual obligations without authorization.

Referral Fees may be lost if required account, tax, or payment information is not supplied within 180 days after the payment due date. Referral Fees are paid only after Fullstory receives customer payment, and the default aggregate cap is $75,000 per referred customer.

6. Liability and Disputes

The Services, program materials, benefits, and content are provided “as is” and “as available,” with broad warranty disclaimers.

Fullstory’s aggregate liability is generally capped at US$500, and neither party is liable for indirect, consequential, punitive, special, exemplary, lost-profit, business-interruption, goodwill, or data-loss damages. The cap does not apply to Fullstory’s gross negligence, willful misconduct, or fraudulent misrepresentation.

The Partner must indemnify Fullstory for claims involving, among other things, the Partner’s legal violations, misuse of Prospect Information, breach of conduct rules, gross negligence, willful misconduct, or fraud. Fullstory provides narrower indemnity protections, mainly for its misconduct and certain intellectual-property claims.

Delaware law governs, and disputes must generally be brought exclusively in state or federal courts located in Delaware. This may increase the cost and inconvenience of litigation for Partners elsewhere.

7. Changes and Termination

Fullstory may modify the MPPA and Program Addenda by posting revised versions on the Partner Site or Portal. Changes generally take effect on the first day of the following calendar month. For fixed Program Authorizations of 12 months or longer, changes generally apply upon renewal.

If a Partner objects, its exclusive remedy is to terminate the agreement or decline/cancel renewal. Fullstory may also change benefits, tiers, programs, the Portal, or participation rights, often in its sole discretion, with commercially reasonable or reasonable notice. Either party may generally terminate on 30 days’ written notice.

Fullstory Privacy Policy: User-Focused Overview

Effective date: May 19, 2025

This policy covers Fullstory’s website, SaaS analytics services, communications, and related interactions. If you visit a third-party website using Fullstory, that website’s privacy policy generally applies to data collected there.

1. Data Collection and Use

Information collected

Depending on your relationship with Fullstory, it may collect:

• Identity and contact data: name, email, address, telephone number, username, account credentials, and subscription details.
• Device and technical data: IP address, browser, operating system, mobile-network information, device identifiers, and approximate location/ISP.
• Browsing and session data: pages viewed, links clicked, referring URLs, time spent, mouse movements, clicks, scrolling, and non-sensitive text entered.
• Transaction data: payment details, billing records, payment history, and order information.
• Communications and content: emails, chat messages, support requests, surveys, social-media posts, blog comments, and customer stories.
• Employment information: education, employment history, and job-application materials.

For visitors to customer websites, Fullstory records session activity through cookies and local storage, including actions and text entered. Fullstory says it does not attempt to identify the same person across unrelated websites.

Purposes

Uses include providing and supporting the Services, processing transactions, improving products, measuring website performance, security and fraud prevention, legal compliance, marketing and targeted advertising, recruiting, and creating aggregated or de-identified analytics.

Important risk: Fullstory’s functionality can capture detailed behavioral sessions. Customers are expected to notify their own website or app visitors and are prohibited from submitting sensitive data, but the policy places substantial responsibility on customers to configure and use the service appropriately.

2. User Rights and Choices

Depending on location, users may have rights to:

• Access or obtain a copy of personal information
• Correct inaccurate information
• Delete information, subject to exceptions
• Restrict or object to processing
• Receive portable, machine-readable data
• Withdraw consent
• Opt out of marketing, targeted advertising, “selling” or “sharing” of data
• Avoid discriminatory treatment for exercising rights

Requests can be submitted to privacy@fullstory.com or 1-833-385-5786. Fullstory may verify identity and may deny or limit requests where legally permitted.

California residents can use the “Do Not Sell or Share My Personal Information” link. The policy states that Fullstory may sell or share certain visitor data for advertising and analytics purposes, but says it does not sell or share customer or customer-user data collected through the Services.

Users can opt out of Fullstory session capture across participating websites by setting an opt-out cookie. This choice depends on the cookie remaining present.

3. Third-Party Sharing

Fullstory may share information with:

• Hosting, IT, payment, billing, support, marketing, accounting, auditing, and other service providers
• Analytics providers
• Advertising and marketing partners, including for interest-based advertising
• Affiliates
• Social-media platforms when users interact with social features
• Buyers or successors in a merger, acquisition, financing, or asset sale
• Government authorities or others when legally required or necessary for security, fraud prevention, emergencies, or enforcement

Some recipients and personnel may be located outside your country. Fullstory says recipients should use information only for authorized purposes, but an acquisition could result in different privacy practices.

4. AI/ML Training

The policy does not expressly say that identifiable customer or user session data is used to train general-purpose AI models.

However, Fullstory may use or share aggregated or de-identified information for research, analysis, modeling, marketing, and service improvement. The policy does not define in detail how de-identification is performed or whether re-identification is possible.

For Subtext, session data is transformed into semantic representations and supplied to users’ coding agents or AI development tools. This may include screenshots, page structure, actions, network data, and console errors. Those AI tools’ use and retention are governed by their own terms, creating additional third-party data risks.

5. Key Obligations and Restrictions

Customers must:

• Give notice to their website or app visitors about Fullstory use
• Avoid providing sensitive data through the Services
• Follow Fullstory’s Acceptable Use Policy
• Not use Fullstory to build cross-site user profiles for selling or exchanging demographic lists

Users should avoid entering confidential or sensitive information into websites using Fullstory unless they understand the site’s controls and privacy notice.

6. Liability, Security, and Disputes

Fullstory describes “reasonable” physical, technical, and organizational safeguards but provides no guarantee of security. It disclaims responsibility for unauthorized access by attackers and Internet-related risks.

This Privacy Policy does not itself provide detailed damages caps, indemnities, warranties, or governing-law terms; those may appear in the Customer Terms, Service Agreement, or other contractual documents.

For EEA, UK, and Swiss data transferred under the Data Privacy Framework, complaints may proceed to Fullstory, then BBB National Programs, and ultimately potentially binding arbitration under the Framework.

7. Policy Changes

Fullstory may revise the policy. The effective date will change, and material changes may receive more prominent notice, including email for certain services. Users are encouraged to review the policy periodically; continued use may indicate acceptance of the updated practices.

Overview of Key Terms and Risks

> Scope note: This is a business-to-business Master Services Agreement (MSA), not the complete privacy notice. Important privacy details—such as specific retention periods, data-subject procedures, subprocessors, and international-transfer mechanisms—are contained in the separate Data Processing Addendum (DPA), Privacy Policy, Security Documentation, and other linked policies.

1. Data Collection and Usage

• Customer Data includes electronic data submitted by or on behalf of the customer or its users through the services. This may include website, application, digital-property, and session-related information.
• Personal Data is broadly defined to include names, addresses, email addresses, telephone numbers, and sensitive information.
• The customer controls what data is collected through its application configuration and is solely responsible for configuring the service and ensuring lawful collection.
• The customer grants Fullstory, its affiliates, and applicable contractors a worldwide, royalty-free, limited-term license to host, copy, transmit, display, process, and use Customer Data as reasonably necessary to:
• Provide the services;
• Monitor, develop, and improve the services and professional services.
• Fullstory states that it acquires no ownership of Customer Data. However, it owns Usage Data—de-identified or aggregated operational information—and may use it to operate and improve its business.

Sensitive data risk

Customers must configure the service to prevent collection of sensitive data, including payment-card data, government identifiers, health information, and GDPR special-category data. If sensitive data is inadvertently collected, the customer must notify Fullstory and identify it so Fullstory can delete it. The agreement does not promise automatic detection or deletion.

2. User Rights

The MSA does not directly give individual users a detailed set of privacy rights. Rights such as access, correction, deletion, objection, portability, and restriction are primarily addressed in the separate DPA and applicable privacy laws.

The customer generally acts as the data controller and is responsible for:

• Having a lawful basis and obtaining required consents;
• Honoring privacy notices and user requests;
• Ensuring its data collection does not violate law or its own policies.

The customer may request earlier deletion of Customer Data after termination and may request a certificate of deletion.

3. Third-Party Sharing

• Fullstory may share or provide access to Customer Data to its affiliates and contractors as reasonably necessary to provide the services.
• Customers may enable third-party integrations. Doing so authorizes the third-party provider to access Customer Data needed for the integration.
• Fullstory disclaims responsibility for a third party’s use, disclosure, modification, or deletion of data.
• Third-party integration providers are expressly not treated as Fullstory subprocessors under the DPA, which may affect contractual protections.
• Fullstory may disclose confidential information where legally compelled, generally subject to notice where legally permitted.

4. AI/ML Training

The agreement does not expressly state that Customer Data will or will not be used to train generative AI or machine-learning models.

The license permits Fullstory to use Customer Data to “monitor, develop, and improve” its services. This language could potentially encompass analytics, algorithms, or machine-learning improvements, although it does not clearly authorize training general-purpose models. Customers should seek clarification or a contractual opt-out if AI training is a concern.

Usage Data may be retained, used, and disclosed if de-identified or aggregated so it does not identify the customer or users.

5. Key Customer Obligations

Customers must:

• Secure their own networks, equipment, credentials, and systems;
• Comply with the agreement, documentation, Acceptable Use Policy, and all applicable laws;
• Obtain rights, permissions, and consents for all Customer Data;
• Prevent sensitive-data collection;
• Avoid unlawful, infringing, deceptive, harmful, obscene, threatening, or malicious content;
• Not reverse engineer, copy, modify, or use the service to build a competing product;
• Promptly report violations;
• Export desired data before termination.

Fullstory may immediately suspend services where misuse threatens service security, integrity, or availability.

6. Liability and Disputes

• Most indirect, consequential, special, lost-profit, business-interruption, goodwill, and data-loss damages are excluded.
• Liability is generally capped at the greater of fees paid or payable in the prior 12 months or $1,000.
• The cap does not apply to certain matters, including payment obligations, customer breaches of usage restrictions, indemnification obligations, fraud, gross negligence, or willful misconduct.
• Services are generally provided “as is,” with limited warranties. Free trials have no warranty and essentially no liability protection.
• Non-EEA customers: Delaware law and exclusive courts in Wilmington, Delaware.
• EEA customers: England and Wales law and exclusive courts in London.

7. Changes, Renewal, and Termination

• The MSA itself generally requires a written, signed modification.
• Linked documentation, security materials, support policies, and the DPA may be updated periodically; the agreement does not provide a detailed general user-notification process.
• Subscriptions automatically renew annually unless written non-renewal notice is given at least 60 days before term end.
• Fees are generally non-refundable, and identical renewal services increase by 7%.
• After termination, session replay data may remain accessible for up to 30 days; Fullstory may delete Customer Data within six months, subject to legal-retention requirements.