Mixpanel

The Data Protection Officer

The reports documentation covers Insights, Funnels, Flows and Retention with global and inline filters, comparisons against past periods, minute-level granularity and report version history, and states that no events are sampled or dropped at ingestion, with query-time sampling confined to Enterprise projects above two billion monthly events. Saved reports sit on boards that carry sharing settings, and free-plan users are capped at five saved reports each. We found no public information on referrer and UTM campaign reports, entry and exit pages, a live real-time view, scheduled email reports or roll-up reporting across several sites. 2 5 7 10

Report an error

The Data Protection Officer

Funnels with drop-off analysis, cohorts, retention and Flows journey reports are described, with events carrying properties that can be broken down and a first-time filter on any event; the web analytics pages speak of per-page conversion rates and campaign ROI insights. We found no public information on e-commerce tracking of orders, revenue and products, on compared attribution models, on sending conversions back to ad platforms server to server, or on outbound links, downloads, forms and scroll depth tracked without code. 2 3 10

Report an error

The Data Protection Officer

The data processing agreement lists exactly what default settings collect — events, city, region, country code, browser, device, current URL — and the security page documents programmatic end-user deletion, configurable retention periods and a privacy portal for data subject requests; Do Not Track and Global Privacy Control are honoured on Mixpanel's own sites. There is no documented cookieless or consent-free mode, no statement of how a visitor is identified or whether an IP address is cut before storage, and no position on §25 TDDDG or the CNIL exemption. Before I signed off a site without a banner I would need the vendor's written reading of the law, and the captured pages do not supply one. 6 7 8 9

Report an error

The Data Protection Officer

A raw data export API, a query API, an ingestion API and a data pipelines API are documented with dedicated EU endpoints, and warehouse connectors including a named Snowflake partnership move events into the customer's own warehouse. The processing agreement states personal information is made available for 30 days after termination, then destroyed, with a certificate of destruction on request. We found no public information on a self-hosted or on-premise edition, open-source code, or an import of historical data from Google Analytics, and CSV exports of reports are capped at 10,000 rows for most reports. 4 7 9 10

Report an error

The Data Protection Officer

The integrations directory lists partners across categories from CRM and experimentation to data warehouse, the marketing pages claim integrations with more than 100 marketing tools, and the libraries require an EU server location at initialisation. Single sign-on with role-based access is documented, and the Enterprise plan includes first-party tracking domains. We found no public information on script size or loading performance, plugins for named CMS and shop systems, single-page-app support, named mobile SDKs, a tag manager template, agency or multi-site accounts, or a public status page. 2 4 5 7 9

Report an error

The Data Protection Officer

The contracting entity is a San Francisco company with US storage on Google Cloud Platform as the default, while the EU Data Residency Program provides dedicated European endpoints for ingestion, query, export and pipelines chosen at project creation; an EU representative sits in Barcelona and a UK representative in London. A published data processing agreement offers Standard Contractual Clauses and relies on the EU-US Data Privacy Framework, a subprocessor list is published with thirty days' notice and objection rights, and the certifications cited on the security page belong to the cloud provider rather than to Mixpanel itself. The documentation itself warns that data arriving through a customer data platform cannot be guaranteed to stay within the EU region — the kind of gap I look for in the whole chain, not only the database. 6 7 8 9

Report an error

The Data Protection Officer

The free tier is public and detailed — unlimited seats, up to 1M events / month, 10K session replays / month — and Growth is quoted as "Starts at $0" with "Volume discounts available"; the Enterprise plan lists inclusions such as up to 1T events / month and a custom retention policy but no price. How cost scales with traffic, seats or features beyond the free limits, and what happens on overage, is not derivable from the captured pages. A buyer cannot compute a real annual cost for a given traffic volume from public information alone. 5 10

Report an error