EU-Hosted Heatmap Tools: Privacy Defaults Compared (2026)

Why "EU-hosted" isn't the whole story

"Our data stays in the EU" is the first line on many privacy pages. It's a good start. But for a European shop, six other questions decide how much risk a tool adds:

1. Does it run before the visitor consents? In the EU, heatmaps and recordings need consent (our GDPR guide). A tool that starts collecting on page load puts the burden on your banner setup.
2. Where is masking done? Text hidden in the visitor's browser never reaches the vendor. Text hidden on the vendor's server was still sent and stored.
3. What is masked out of the box? Form fields only, or also numbers, email addresses and page text?
4. Are IP addresses stored?
5. How long are recordings kept by default?
6. Who else touches the data? A US parent company or US cloud provider can be subject to US law, wherever the server is. Most vendors cover this with the EU-US Data Privacy Framework and contract clauses.

France's CNIL makes the same point in its final recommendation on session replay, published November 5, 2026: vendors should always offer the most protective default settings, mask by default, block passwords and bank details and let you set retention per purpose (CNIL recommendation, in French). It also makes question 2 concrete. For replay used to improve the user experience, masked data should either not be collected at all or be stored encrypted and released only on a reasoned request. Text that is hidden only when you watch, while the vendor stores it in full, doesn't meet that bar.

What we checked

For each tool, we looked up the default behavior in the vendor's own documentation on November 5, 2026:

• Data location: default region, EU option, cloud provider
• US companies in the chain: parent company, cloud, CDN, other sub-processors
• Before consent: does the tag collect anything by default, and is there a built-in way to wait for consent?
• Masking: page text, form fields and keystrokes, by default
• IP addresses: stored, shortened or discarded
• Retention: how long recordings (or raw data) are kept
• Checkout: excluded or masked by default?

"Not documented" means we couldn't find it in official docs. It doesn't mean the tool doesn't do it. Ask the vendor.

Results: heatmap and session recording tools

Sources per tool are in the notes below. Varly is our own product; its row comes from our help center.

Results: A/B testing tools

Testing tools rarely record sessions, so masking matters less. The key questions are data location, consent behavior and IP handling.

Tool-by-tool notes

Microsoft Clarity

Free, unlimited, and stored "in the Microsoft Azure cloud service" with no region option (Clarity FAQ). Since October 31, 2025, Clarity starts in "consent denied" for visitors from the EEA, UK and Switzerland, but it still loads and collects cookieless data (consent management, without consent). Default masking is "Balanced": numbers and email addresses; input boxes are masked in every mode (masking). Recordings are kept 30 days; heatmap data and favorited sessions 9 months (retention). Setup guide: Clarity consent mode in the EU.

Contentsquare (formerly sold as Hotjar)

Hotjar is now part of Contentsquare. For Free and Growth plans, Contentsquare's sub-processor list says data is hosted in Ireland on AWS or Azure; Pro and Enterprise customers in the EU default to the EU (Contentsquare sub-processors, v2026.4). The same list includes US companies such as AWS, Microsoft, OpenAI and Snowflake. Hotjar's help center (which blocked our fetch, so we relied on its search excerpts) says keystrokes, numbers and email addresses are suppressed by default and IP addresses are never displayed (suppression). Contentsquare is moving Hotjar customers over: from August 18, 2026, it may import visitor data ahead of the switch; afterwards Hotjar stays read-only for 90 days before data is deleted (Hotjar service schedule). If you're on Hotjar, check what that means for your DPA.

Mouseflow

A Danish company. EU customers' data is stored with Google Cloud in Belgium (sub-processors). IP addresses are masked automatically (GDPR page). Keystrokes in fields that contain personal data are masked by default; page text isn't, unless you configure it (masking settings). Mouseflow says you "may need to obtain active and explicit consent" and offers a cookieless mode and CMP integration, but the tag doesn't wait for consent by itself.

Matomo Cloud

Matomo's company, InnoCraft, is based in New Zealand. Matomo Cloud runs on AWS in Frankfurt with backups in Dublin (sub-processors). Matomo is unusually direct: heatmaps and session recordings need "prior consent" and are "not included in the scope of consent-exempt analytics" (Matomo FAQ). The recorder masks all inputs and, per the same FAQ, excludes text nodes unless you whitelist them; keystroke recording is off by default. IP addresses are shortened by 2 bytes by default (Matomo privacy). Cloud keeps heatmaps and recordings for 3 months (retention FAQ). Self-hosting Matomo On-Premise keeps all data on your own server.

PostHog (EU Cloud)

EU Cloud runs on AWS in Frankfurt (PostHog). By default PostHog starts capturing on page load; you can switch to opt-in with opt_out_capturing_by_default or a cookieless mode (data collection). Replay masks inputs by default, not page text (replay privacy). On EU Cloud, IP capture is off by default for new projects (GDPR). Retention depends on the plan, from up to 30 days on the free plan (retention). PostHog can also be self-hosted.

FullStory

"The default data center for all customers is located in the US"; an EU data center in Frankfurt is available (FullStory). Capture starts on load unless you delay it until consent (consent management). Its fully private mode ("Private by Default") "can be turned on via request" (FullStory); newer accounts mask form fields by default and card fields are excluded (form privacy). IP addresses are discarded by default (IP).

Lucky Orange

Data is processed and stored in Google Cloud in the United States unless you're on a custom plan (security overview). Tracking starts on load unless you turn on "Require Consent" (consent). IPs are hashed by default (IP settings). Page text isn't masked by default (sensitive data).

Crazy Egg

Data is "stored electronically in the USA on the Amazon Web Services infrastructure", and the last part of the IP address is set to 0 before storage (Crazy Egg). Email, password, number and text inputs are masked by default (masking). Recordings are kept for 24 months (FAQ). We found no built-in consent mode.

UXtweak

Stored on AWS in Ireland (privacy policy). It has a built-in consent bar you can turn on per region, and says EU consent is required for recording personal data (setup). IP anonymization and email/number obfuscation are on by default for EU visitors (GDPR); payment details, passwords and hidden inputs are always excluded.

Varly (our product, in private beta)

App and data are hosted with Hetzner in Germany; Cloudflare, a US company, sits in front as CDN, so we don't call it "100% EU". Varly shows no banner of its own: it reads your existing banner and does nothing (no cookie, no requests) until a visitor accepts statistics cookies (consent). Text is hidden in the visitor's browser; the default is Balanced (numbers and email addresses), and form fields are always hidden (recording privacy). Checkout and cart pages are on the "never track" list by default, IP addresses are not stored, and recordings are deleted after 30 days unless a team member favorites them (13 months) (privacy and GDPR). One default to know: new sites record all consenting visits. Busy sites can lower that to 10–50%, which is closer to the CNIL's preference for sampling.

Testing tools

• VWO / Wingify (VWO and AB Tasty merged into Wingify in 2026): data centers in the US, Belgium, India and Australia, chosen by account location (where data is stored, security FAQ). Cookie consent handling is off until you enable it (cookie consent). The last octet of IPs is removed by default (visitor data). Behavior-analytics data is kept 1–3 months by plan (retention).
• Convert: visitor data "stays in Europe on German servers"; IPs aren't stored; the company itself is US-based (privacy notice, GDPR). A consent-required mode is optional (Convert support).
• Kameleoon: a French company; says it "never stores IP addresses" and keeps visit data 24 months (Kameleoon). Hosting regions aren't named publicly; its security portal lists Cloudflare, OVHcloud, Hetzner, OpenAI and Mixpanel among sub-processors (security portal).

Left out: Smartlook. Cisco, its owner, ended sales on May 31, 2026, and end of life is August 31, 2027 (Cisco).

Self-hosted options

If you want the data on your own servers:

• Matomo On-Premise with the Heatmap & Session Recording plugin. Mature, EU-minded, and you choose the retention.
• PostHog self-hosted. Open source; more of a product-analytics suite than a CRO tool.
• OpenReplay. Open-source session replay you can host yourself.

Self-hosting moves the work to you: updates, security, backups and scaling. You also still need consent; hosting it yourself changes where the data goes, not whether you may collect it.

US companies in the chain

Almost every row above has a US company somewhere: a parent company, a cloud (AWS, Google, Microsoft), a CDN (Cloudflare) or an AI provider. That's normal in 2026 and usually covered by the EU-US Data Privacy Framework and contract clauses. What you can do:

• Read the sub-processor list, not just the headline. Save a copy with the date.
• Ask what each US sub-processor receives. A CDN that delivers a script file is different from a cloud that stores recordings, or an AI provider that reads survey answers.
• Check AI features separately. Several tools now send data to AI providers for summaries. Ask whether that's on by default, and which provider is used.
• Have a plan B. The Data Privacy Framework has been challenged in court; an appeal is pending at the EU Court of Justice (WilmerHale).

Questions to ask before you sign

1. Does the tag load or send anything before the visitor consents? Can it wait for my banner?
2. Is masking done in the browser? What's masked out of the box?
3. Are keystrokes ever recorded?
4. Are checkout and payment pages excluded by default?
5. Are IP addresses stored, shortened or discarded?
6. Where is data stored, and can I pick the region in the contract?
7. Which sub-processors are US companies, and what does each receive?
8. Do you use our visitors' data for your own purposes, including AI training?
9. What's the default retention for recordings, and can I shorten it?
10. Can I delete a single recording?

FAQ

Which heatmap tool is the most privacy-friendly? It depends on your setup. On defaults alone, tools that wait for consent, mask in the browser, skip checkout and don't store IPs (for example Matomo with consent enabled, UXtweak with its consent bar, or Varly) need the least configuration. Any tool can be set up carefully.

Is Hotjar EU-hosted? Yes. Hotjar, now Contentsquare, hosts Free and Growth customers in Ireland. Its sub-processors include US companies.

Is Microsoft Clarity GDPR compliant? No tool is compliant by itself. Clarity has no EU region and collects cookieless data before consent unless you block it. Many EU shops use it with the script blocked until consent. See our Clarity consent guide.

Does EU hosting mean I don't need consent? No. Consent is about accessing the visitor's device, wherever the data ends up.

---

Varly is in private beta. It waits for consent, masks in the browser and skips checkout by default. Join the waitlist.

Related: GDPR and CRO · Hotjar alternatives for ecommerce · Microsoft Clarity alternatives for EU shops · Clarity consent mode