Privacy policy

This policy covers two different groups of people: customers, who have a SplitSimple account, and visitors, who land on a customer’s page that has our pixel on it. The rules are different for each.

What we collect from customers

• Your email address, name, company and the platform you told us you use.
• Your experiments: names, page URLs, traffic splits and goals.
• Billing details, which are held by Stripe. We never see or store your card number.
• Security and audit records: who did what in your workspace, and when.

What we collect from visitors

When someone loads a page carrying a SplitSimple pixel, we record the minimum needed to tell two pages apart:

• A random first-party visitor ID we generate. It is not derived from anything about the person.
• The page URL, referrer and UTM parameters.
• A coarse device type, browser and operating system, derived from the user-agent string.
• An approximate country, if the hosting platform provides one.
• A timestamp.

What we deliberately do not collect

• No raw IP addresses. An IP is hashed with a secret salt purely for rate limiting, and workspaces have IP anonymisation on by default, which discards even that.
• No fingerprinting. We do not build a device signature to identify people across sites.
• No form fields. The pixel never reads inputs, so it cannot see a name, email or card.
• No cross-site tracking. A visitor ID is scoped to one customer’s workspace.
• No selling of data, ever, to anyone.

Do Not Track and Global Privacy Control

Workspaces can switch on Do Not Track honouring, per workspace or per experiment. When it is on, a visitor whose browser sends DNT: 1 or a Global Privacy Control signal is routed to the page normally but is not assigned, counted or stored at all.

Cookies

We set one first-party cookie, ss_vid, which holds a random string and nothing else. Its only job is keeping a returning visitor on the same page they saw the first time. Experiments can run in cookie-free mode, in which attribution lasts only for the pageview. See the cookie policy.

Who your data is shared with

• Supabase — database and authentication.
• Vercel — application hosting.
• Stripe — subscription billing.
• Resend — transactional email.
• Sentry — error monitoring, when configured. Errors are scrubbed of secrets and IPs.

That is the whole list. We do not share data with advertisers or data brokers.

How long we keep it

Raw visit and conversion rows are deleted automatically once they pass your plan’s retention window — 30 days on Free, 12 months on Pro, 24 months on Agency — or sooner if you set a shorter window in your workspace settings. Daily summary rows are kept so historical charts do not go blank.

Your rights

You can export everything in your workspace, and you can delete your workspace, from your settings. Deleting a workspace removes its experiments, visitors, events and conversions permanently. If you are in the EU or UK, you also have rights of access, rectification, erasure, restriction, portability and objection — email us and we will action them.

Who is responsible for what

For visitor data, our customers are the data controller and SplitSimple is the processor. It is the customer’s responsibility to disclose the tracking in their own privacy policy and to obtain any consent their jurisdiction requires. We give you the controls — Do Not Track honouring, IP anonymisation, cookie-free mode and configurable retention — but we cannot make that disclosure for you.

Contact

Questions about this policy go to our support page.