> For the complete documentation index, see [llms.txt](https://fredhopper.gitbook.io/product-discovery/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://fredhopper.gitbook.io/product-discovery/tracking-and-sending-events/data-handling.md).

# Data Handling

Page actionsInformation on cookie usage, server-side data processing, personal data removal policies, and security measures for user activity tracking and data storage.

## Browser cookie <a href="#browser-cookie" id="browser-cookie"></a>

The Fredhopper activities SDK uses **persistent cookies** (or browser local storage) to store a user's **session ID** or a **boolean** representing user's opt-out choice. The session ID is either provided or generated by the SDK. When generated, it will be represented by a UUID.

The cookie persists until the user clears their browser cache.

## Server side data processing <a href="#server-side-data-processing" id="server-side-data-processing"></a>

### Collected data <a href="#collected-data" id="collected-data"></a>

| Data points                                                                        | Purpose                                                                                                                                  | Data processor |
| ---------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | -------------- |
| **Session ID** and the **anonymized logged in user ID** (email, username, user ID) | Cookie matching feature and calculation of user journeys                                                                                 | Rezolve AI     |
| User traits (you decide what exact information is being sent)                      | Enables the use of personalization algorithms                                                                                            | Rezolve AI     |
| Users IP addresses                                                                 | Operational monitoring (capability to implement active protection and to do post-mortem security reports in case of attacks or breaches) | Rezolve AI     |

### Personal data removal policies <a href="#personal-data-removal-policies" id="personal-data-removal-policies"></a>

#### **Activity events data**

User information is anonymized and impossible to retro-match to an individual user. All users activity data will be stored on the Fredhopper platform as long as the client contract dictates the access to services.

**Operational data**

The policy for operational logging is as follows:

* **Online log analysis sub-system (ELK)**: Rolling window of 2 months
* **Backup of logs**: Retained for 2 years with regular monthly purging

### Security measures <a href="#security-measures" id="security-measures"></a>

* **Segregation:** Strict access controls to ensure proper separation of sensitive data
* **Changing Security Settings:** Only privileged administrators with dedicated and trained teams can modify security settings
* **Encryption:** Applied to logging storage to protect data integrity
* **Secure Communication:** All communication over the internet uses secure transport protocols (HTTPS/SSH)

### Place of processing <a href="#place-of-processing" id="place-of-processing"></a>

User data (IDs, traits, IPs) is stored and processed in the EU. Activity events are stored and processed in the EU and the same region as FHR or XO.

| FAS/XO region | User data (IDs, traits, IPs) | Activity data |
| ------------- | ---------------------------- | ------------- |
| EU            | EU                           | EU            |
| US            | EU                           | US + EU       |
| AP            | EU                           | AP + EU       |