Mixpanel, Inc. is a privately held San Francisco product-analytics company founded in 2009. Default settings collect device identifiers, browser and OS details, referrers, UTM parameters, and city/region/country derived from IP address. Mixpanel positions itself as a first-party analytics processor: its Data Processing Addendum names the customer as controller, bars selling or sharing personal information under the CCPA unless directed by the customer, prohibits combining customer data with other sources, and sets post-termination deletion within 90 days, with EU and India data-residency options. The company holds SOC 2 Type II, ISO 27001, and ISO 27701 certifications, certifies under the EU-US Data Privacy Framework, and publishes biannual law-enforcement transparency reports. In 2018 it self-disclosed that its Autotrack feature had inadvertently ingested passwords exposed by browser frameworks and password managers; it destroyed the data and patched the SDK. Mixpanel raised a $200 million Series C from Bain Capital Tech Opportunities in 2021 at a $1.05 billion valuation.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
14 ON FILE
COLLECTION
Mixpanel's client-side SDKs collect a broad set of default properties, including an autogenerated device ID, OS, browser, screen dimensions, referrer and UTM parameters, wireless carrier and connectivity state (Android/iOS), and user city, region, country, and timezone derived from the IP address.
For its own marketing and business contacts (controller side), Mixpanel's Privacy Statement permits purchasing data about individuals from third parties, building individual profiles updated in real time, and reserving the right to use de-identified data for any purpose.
Mixpanel's DPA (Schedule 2) states that default collection is customer-configured and includes events, city/region/country, browser, and device data, with no sensitive personal information unless contractually agreed; customer data is deleted on request or within 90 days of contract termination, with a 30-day retrieval window and certificate of destruction available.
Mixpanel has remained venture/PE-backed rather than public throughout its history: TechCrunch reported the 2021 Bain Capital round came seven years after its 2014 Series B, following a 2018 leadership change in which COO Amir Movafaghi became CEO and the company refocused on product analytics.
Mixpanel is privately held; in November 2021 it raised a $200 million Series C growth investment from Bain Capital Tech Opportunities at a $1.05 billion valuation, bringing total investment to $277 million including a $65 million Series B led by Andreessen Horowitz in 2014.
Mixpanel publishes biannual law-enforcement transparency reports (delayed 180 days); the report covering January-June 2026 discloses zero US law-enforcement requests and one non-US preservation request, and describes its practice of reviewing and narrowing overbroad requests.
For visitors to its own site, Mixpanel's policy states its use of interest-based advertising services may constitute "sharing" of personal information with advertising partners under the CCPA (with an opt-out offered), while stating that Mixpanel does not "sell" personal information as the CCPA defines it.
Mixpanel publishes a subprocessor list — including Google Cloud (primary hosting), AWS (backup storage), and Anthropic (AI features, with data not used for model training) — and contractually requires each subprocessor to sign a data processing agreement restricting processing to service delivery, with 30-day advance notice and customer objection rights for new subprocessors.
Mixpanel's DPA designates the customer as controller and Mixpanel as processor/service provider, commits Mixpanel not to sell or share personal information as defined by the CCPA unless expressly directed by the customer, and prohibits combining customer personal information with data from other sources except as the customer authorizes.
Mixpanel maintains a native, active SOC 2 Type II attestation and holds ISO 27001 and ISO 27701 certifications, with documents available through its Trust Center; customer data is encrypted in transit (TLS) and at rest.
In early 2018 Mixpanel self-disclosed that its Autotrack feature had inadvertently ingested values of password and hidden form fields — exposed by a March 2017 React library change and by password managers — from customer sites; it deployed a server-side filter within days of the January 5 customer report, destroyed the inadvertently received data, fixed the SDK, and stated it found no indication the data was accessed by any employee or third party.
Mixpanel self-certifies under the EU-US Data Privacy Framework, its UK Extension, and the Swiss-US Data Privacy Framework, which places its handling of European personal data under the enforcement jurisdiction of the US Federal Trade Commission.
Mixpanel's GDPR page describes consent-management tooling under which customer implementations do not track end users unless they opt in, and its SDKs support end-user opt-out of tracking at any time.
On its own properties Mixpanel uses cookies, pixel tags, and browser local storage, and lists roughly two dozen third-party advertising and analytics cookies including DoubleClick, Facebook, AppNexus, and PubMatic; the same policy states Mixpanel turns off all non-required cookies when a Do Not Track signal is on and automatically honors Global Privacy Control opt-out signals.