Hotjar is a heatmap and session-recording analytics product that has been fully incorporated into Contentsquare, a private France-headquartered digital experience analytics company (Content Square SAS is named as its EU Article 27 GDPR representative entity), since Contentsquare's 2021 acquisition. Hotjar's own legal/privacy-policy URLs on hotjar.com now redirect directly to Contentsquare's Trust Portal, whose overview text confirms 'Heap and Hotjar have recently been incorporated' into Contentsquare. Contentsquare's Visitor Privacy Policy states its JavaScript Tag, embedded in customer websites/apps (the mechanism Hotjar uses), collects 'limited personal data' — an online unique identifier and digital behavioral data — via analytics cookies, and shares that data with Contentsquare Group affiliates and third-party service providers while stating it does not sell visitor personal data collected through customer sites under the CCPA. The Trust Portal discloses Contentsquare holds ISO 27001, ISO 27017, ISO 27018 and ISO 27701 certifications and a SOC 2 Type II report, and publishes specific security-incident update notices (e.g., a CVE-2026-31431 vulnerability response and an Axios supply-chain-compromise response) each confirming no customer data was accessed or impacted; no named independent audit firm or breach/incident count report was found in this research.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
6 ON FILE
COLLECTION
Contentsquare's Visitor Privacy Policy, which governs the JavaScript Tag used by Hotjar's heatmap and session-recording product on customer websites, states the tag collects limited personal data about site visitors — an online unique identifier and digital behavioral data.
Hotjar's own legal/privacy-policy URLs on hotjar.com now redirect to Contentsquare's Trust Portal, whose overview text names Hotjar's parent directly, stating that Heap and Hotjar have recently been incorporated into Contentsquare.
Contentsquare's Services Privacy Policy names Content Square SAS, a French corporate entity, as Contentsquare's designated representative in the European Union for data protection matters under Article 27 of the GDPR.
Contentsquare's Visitor Privacy Policy states it does not sell visitor personal data collected through customer websites/apps under the CCPA, while separately disclosing that such data is shared with Contentsquare Group affiliates and third-party service providers to deliver services to customers.
Contentsquare's Trust Portal states the company holds ISO 27001, ISO 27017, ISO 27018 and ISO 27701 certifications and a SOC 2 Type II report, and lists documents including a Pentest Report; the same portal publishes dated security-update notices for specific vulnerabilities (a named CVE and an Axios supply-chain compromise), each stating no customer data was accessed or impacted. No named independent audit firm or breach/request-count transparency report was found in this research.
The same Visitor Privacy Policy states the tracking mechanism is a JavaScript Tag embedded directly in the customer's website or app, which loads alongside the page in the visitor's browser and uses analytics cookies.