Privacy Policy — PATI A/B Testing

Effective date: October 24, 2026 · Controller / Developer: PATI Group (privacy@patigroup.com)

1. Overview

PATI A/B Testing (“the App”) runs storefront A/B experiments (content, template, price and offer tests) and attributes orders to them for Shopify merchants. This policy describes what the App collects, why, how long it keeps it, and how it deletes it.

2. Data We Collect & Process

• Store data: shop domain, store name, currency, timezone, and the Shopify OAuth session needed to run the embedded admin and publish the experiment configuration.
• Storefront visitors: a random visitor id, a session id, the page URL, a device class (mobile or desktop, derived from the user agent), the country code, the referrer or UTM source, the experiment arm shown, and funnel events (page view, add to cart, checkout started, checkout completed, merchant-defined custom events). The visitor’s IP address is used in memory to limit request rates and may appear in server logs for rejected requests; it is not stored in the App’s database. Collected by the theme app embed and by the Web Pixel, and only when the visitor allows analytics (Shopify’s customer privacy settings; in regions where Shopify needs no consent, analytics is allowed by default). With that consent the visitor id is kept in a first-party cookie _pati_vid (400 days) and in the browser’s local storage. Before consent the visitor id lives only in the browser tab’s session storage, the theme app embed sends nothing to the App, and the cart carries only the experiment arm and a no-consent flag; orders with that flag are excluded from results. When the visitor withholds or withdraws consent, the App removes the cookie and the local-storage id and marks the cart as no-consent. To keep prices and page versions consistent, the arm a visitor was assigned (no personal data) stays in local storage.
• Orders: from Shopify order and refund webhooks the App stores order id and name, dates, currency, totals, discounts, shipping, tax, refunds, financial status, checkout token, up to 100 line items (product id, title, quantity, price), whether it was the customer’s first order (yes/no), and only the App’s own cart attributes (names starting with pati_). The customer’s e-mail address is read only to compute a SHA-256 hash (customer_hash) that recognises a returning customer; the e-mail itself is never stored. This hash is a pseudonymous identifier, not anonymous data. The App never reads customer names, phone numbers or addresses, and does not store order tags or customer-entered cart attributes.

3. How We Use Information

Only to assign visitors to experiment arms, check traffic splits, attribute order revenue and refunds to experiments, and show the merchant aggregate results in the Shopify admin. We do not sell or share personal data, do not build cross-merchant profiles, and do not make automated decisions about customers.

4. Retention, Privacy Webhooks & Deletion

• Retention: store data is kept while the App is installed and deleted after uninstall (see shop erasure). A customer’s data is deleted when the merchant’s customer erasure request arrives. Customer data exports are deleted 30 days after they are created.
• Customer data request (customers/data_request): the App queues the request, builds a JSON export of the customer’s matching orders, visitor ids, experiment exposures and funnel events, stores it encrypted, and shows it to the store owner in the App inside the Shopify admin, where only that store’s signed-in staff can download it. The request and every download are recorded in an audit log that holds counts, not customer identifiers.
• Customer erasure (customers/redact): removes the customer hash, visitor id, checkout token, cart attributes and stored order metadata from the customer’s orders, deletes the customer’s visitor, exposure and event records, and deletes any export made for that customer.
• Shop erasure (app/uninstalled, shop/redact): on uninstall the store’s sessions are deleted and the store stops collecting. When Shopify sends shop/redact (48 hours after uninstall), every store-scoped row in every App table is deleted; the store record keeps only its domain, name, currency and timezone, marked uninstalled, with its access token and settings cleared.

5. Security

Traffic to the App uses HTTPS. Shopify webhooks are verified with HMAC-SHA256 before any processing. Customer data exports and per-store webhook secrets are encrypted with AES-256-GCM. Access to the embedded admin requires a Shopify login for the store. State changes and customer data access are recorded in an append-only audit log.

6. Contact Us

For privacy questions or data subject requests, contact PATI Group at privacy@patigroup.com or visit Support & Onboarding.