Data management

This is a summary of how Extellio collects and handles data from respondents from the customers website and via surveys.



Extellio uses a script on the customer’s website to collect data. For the website user it will be a so-called 3rd party script. The script is asynchronous which means that it is designed to not affect the site’s loading. Also, it doesn’t affect the website if there should be any breakdowns in communication with Extellio servers. The script is supported by the latest versions of: Edge / Chrome / Firefox / Safari.

There are two types of script management, hosting by Extellio and hosting by the customer.

Hosting at Extellio

The script is hosted by Extellio via a CDN and loaded into the page using a script tag on the customer’s website. This means that the script’s settings are updated automatically, which makes it possible to adjust the data collection on the website directly from the Extellio platform.

Hosting with the customer

The script can also be hosted by the customer, if you want to avoid loading 3rd party scripts. In this case, the ability to control the script directly from the Extellio platform is lost and the customer needs to generate a new script on the Extellio platform and replace the old script on the website with every change in the data collection.


Cookies on the customers website


Extellio uses local storage, session storage on the customer's website to control when and who should see different surveys. If storage is unavailable, it falls back to regular cookies.

The following is saved in the respondents’ browser:

  • “espace” – Information about time spent on the website and what surveys that have been seen and closed. Lifetime of one year and renewed at each update.
  • “espace_session” – Information about time spent on the site at the current visit. This is only saved during the visit.

Traffic data/analytics

If Extellio is also used to collect traffic data (Matomo with Extellio) additional cookies are set to track the visitor's behaviour on the website.

  • “_pk_id” - used to store a few details about the user such as the unique visitor ID
  • “_pk_ref” - used to store the attribution information, the referrer initially used to visit the website
  • “_pk_ses”, “_pk_cvar”, “_pk_hsr” - short lived cookies used to temporarily store data for the visit

More information about the cookies used by Matomo can be found here:

Cookie policy

Depending on cookie policy the customer will have to inform users about these cookies. If you ask the visitors for consent on your website you have to wait with loading our script until consent is given to avoid cookies being set prematurely.


Cookies when answering a survey

The survey from Extellio is always loaded from the domain, either in its own window or in an iframe. Hence the cookies used by the survey are not set on the customers website. See the "Extellio Survey Cookie Policy" document for detailed information about the individual cookies in the surveys.


Data collection

All communication is encrypted over HTTPS directly between the respondent's browser and the Extellio server. No information goes through the customer's system.

The following information is sent from the respondent's browser to Extellio.

  • Survey answers
  • URL of the page on which the response is made
  • Title of page on which the response is made
  • Browser user-agent
  • Browser language
  • IP number (not stored but used only to look up which country the respondent is in)

If Extellio is also used to collect traffic data (Matomo with Extellio) data is sent to Extellio with every page view. All data is sent directly to Extellio own servers. You can read more about it here:


Data storage

Extellio stores data with ElastX AB on servers in Sweden.
The servers are behind a firewall that is only open for HTTPS traffic.
Backup of database is taken every day and stored with City Network Hosting AB in Sweden.

Extellio stores the following data

  • Survey answers
  • URL of the page on which the response is made
  • Title of page on which the response is made
  • Browser user-agent
  • Browser language
  • What country respondents are in (based on IP, that is not stored in itself)

Access to data

Extellio and some contracted subcontractors, needed in order for us to deliver and develop our services, have access to data. Such subcontractors have confidentiality and personal data agreements with Extellio.

In addition, the customer and, where appropriate, external parties that are approved by the customer, have access to the data collected during the time when they have a valid license. Customer access to data is via the Extellio platform, either through personal login or via API.


Extellio platform

The Extellio platform is accessed by customers via the internet with personal login. User accounts and logins are managed by the company Auth0. Verification of user privileges is done using JWT issued by Auth0 and is valid for 24 hours.


Personal data

Normally respondents to Extellio surveys are anonymous and no personal data is collected. However, in some instances it may be the case that the surveys collect personal data. Depending on the agreement, either Extellio or the customer is data controller for personal data in those instances. Se further: Handling of Personal Data in Extellio Surveys.