Privacy and consent

Sofcy - A/B Test & CRO is built to measure experiments without collecting shopper personal data. Visitors are tracked pseudonymously, analytics opt-out is honored, and the app never reads customer contact details.

Pseudonymous visitors

Each visitor is identified only by an anonymous visitor id (_ab_vid) that Sofcy - A/B Test & CRO generates. This id is used to keep a visitor on the same variant and to attribute their conversion and revenue to the right variant. It is not linked to a shopper's name, email, phone, or address.

Exactly what data is read

To attribute revenue, Sofcy - A/B Test & CRO's order webhook reads only:

• the order id,
• the order total and currency, and
• the app's own note_attributes._ab_vid value.

It never reads or stores customer name, email, phone, or address. Under Shopify's Protected Customer Data model this is Level 1 — order data with no personal fields. See Revenue attribution for how this works, and Data and consent for the developer view.

Opt-out consent

Sofcy - A/B Test & CRO honors analytics consent. When a shopper declines analytics, the app stops tracking that shopper.

• It reads Shopify's Customer Privacy API to detect the shopper's analytics-consent choice.
• It auto-detects the OneTrust and Cookiebot consent managers and follows their decision.
• When consent is declined, the app stops recording events and stops attaching the visitor id to the cart, so a declined shopper's order is not attributed.

Data retention

Raw event and assignment data is retained for about 180 days and then purged automatically. Aggregated experiment results remain available so you can reference past tests.

Compliance

• The mandatory GDPR webhooks (customers/data_request, customers/redact, shop/redact) are implemented.
• Webhooks are verified with HMAC signatures, and all traffic is served over TLS.
• The app never creates or modifies your theme files — you choose which existing templates and themes to test.