Session replay records visitors before they consent

Hotjar is initialised on every page load, so keystrokes and clicks are captured before any consent is given. In California that pattern is the basis of a wave of wiretap class actions; in the EU it is unlawful access to terminal equipment.

Non-commercial AI model shipped in a paid product

The image-tagging feature loads a model published under CC BY-NC 4.0. That licence forbids commercial use, and the feature ships in the paid plan — every paying customer's request runs the model outside its licence.

Turkish national ID numbers (TCKN) written to application logs

User records including TCKN and e-mail are logged in plain text on signup. Logs are typically retained longer, replicated to third-party tools and accessible to more staff than the database.

Free trial auto-renews with no online cancellation path

Subscriptions start with a 7-day trial that converts to paid, but the code has no cancel endpoint or billing portal. Regulators on both sides of the Atlantic now expect cancelling to be as easy as signing up.

Marketing consent checkbox is pre-ticked at signup

The signup form ships with the marketing e-mail checkbox already checked. Consent obtained this way is invalid in the EU and Türkiye, so every marketing message sent on that basis is unlawful.

User profiles sent to OpenAI without transfer safeguards or AI disclosure

The full user object — including TCKN and date of birth — is serialised into an LLM prompt. That is an international transfer of more data than the feature needs, and users are not told they are interacting with AI-generated plans.

Face-analysis library present — biometric processing needs explicit consent

face-api.js is a dependency. If it is used to analyse users' faces (e.g. progress photos), Illinois BIPA and GDPR Art. 9 require written or explicit consent before any template is created.

Images without alt text and click-only controls on signup

The signup page has an image without alt text and a clickable <div> that keyboard and screen-reader users cannot operate. The European Accessibility Act applies to consumer e-commerce services since June 2025.