This information notice explains how we process personal data when you use Piano Site Inspector, a browser extension that helps Piano customers inspect and test their Piano implementation. The Piano Privacy Policy also applies and takes precedence over this notice.
Data Controller
Piano Software Inc., Philadelphia, US and affiliated companies belonging to the Piano group (collectively, “Piano”, “we”, “us”, “our”).
Contact: privacy@piano.io
Mail: Attn: Piano Software Group DPO, Štefánikova 14, Bratislava, 811 05, Slovakia (EU)
Where the extension relays data through a page's Piano SDK, Piano processes that data on behalf of that site's publisher, as it does for all Piano SDK traffic.
Purposes and Legal Basis of Processing
Your personal data is processed for the following purposes:
Confirming your Piano dashboard session so the extension can be enabled.
Displaying to you what the Piano SDK reports on the page you inspect (experiences, templates, checkout and login events, logged-in end user details).
Carrying out the lookups, SDK actions, API calls and site configuration that you trigger or set.
Choosing the toolbar icon for each tab.
Measuring usage of the extension (usage statistics, via Piano Analytics).
The processing is carried out on the following legal bases:
Art. 6(1)(b) Contract for all other data related to user-account logged into the plugin, like other Piano interfaces.
What Personal Data We Process
Piano may process the following categories of data (Chrome Web Store data type in brackets):
Session data (authentication information): the Piano dashboard session token, sent back to the dashboard to confirm your session. Not stored. The extension stays off until you open the Piano dashboard while signed in.
Page data reported by the Piano SDK (website content, personally identifiable information, authentication information, location): experiences, templates, approximate location of the connection, checkout and login events, and the logged-in end user's ID, email, name and token. Checkout and login events are stored on your device.
Data you enter (authentication information): settings, configuration and private keys stay on your device; a few display preferences sync with your browser profile. The application ID, API token or template content you enter is sent to Piano's API when you look up or edit something in Piano.
SDK actions and configuration (authentication information, personally identifiable information): SDK actions and API calls you trigger, configuration you set for a site (tags, custom variables, external JWT, Composer override) and lookups of the logged-in user, sent to Piano through the page's own Piano SDK. Lookups occur even while the extension is closed.
Tab addresses (web history): read to choose the toolbar icon. Only the site name is used; not stored or sent.
Usage statistics (user activity): a random installation identifier created on your device, when you open the extension, which screens and buttons you use and for how long, and the extension version. If side panel auto-reload is on, each reload after a tab switch or page load counts as an opening. Piano Analytics also receives your IP address and browser type, as with any web request. The statistics do not include page content, URLs or data from the pages you inspect.
Recipients of the Personal Data
Piano is the only party that receives data from the extension. Every request made by the extension itself uses HTTPS. Piano's own service providers act under data processing agreements.
International Data Transfers
Where personal data is transferred to recipients outside the European Economic Area, such transfers are conducted in accordance with GDPR requirements, using appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.
How Long We Keep Your Data
On your device: you can delete recorded events and site configuration in the extension, and uninstalling the extension deletes everything it stores on your device.
Your Rights as Data Subject
Under the GDPR, you have the right to:
Access your personal data;
Erasure (“right to be forgotten”);
For data processed on behalf of a site publisher, requests may be redirected to that publisher.
Chrome Web Store User Data Policy
The extension's use of data complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.
Contact
For any questions or concerns regarding this notice or the processing of personal data, please contact: privacy@piano.io
Last updated: 2026-11-02
