Last updated: 27 September 2026
abtestkit operates abtestkit.io, the abtestkit WordPress plugin and the connected abtestkit service. For privacy questions or requests, email support@abtestkit.io. We will provide an address for formal correspondence on request.
1) What this policy covers
This policy explains information handled when you visit abtestkit.io, create an abtestkit account, connect a WordPress site, use the plugin, receive service emails or ask for support. A site owner separately controls the detailed A/B testing records kept in its own WordPress database and must give its visitors appropriate privacy and cookie information.
We decide how to use account information, service security data, product and reliability information, and support requests. For these activities, we act as a data controller. Where we handle customer-directed connected data on a site owner’s behalf, our Data Processing Agreement applies. A site owner normally controls its own visitors’ detailed experiment data.
2) Required account and connected-service information
To create or launch new experiments under the connected version of the plugin, an authorised administrator must verify an abtestkit account, connect the site and accept the current Terms. The service records the agreement version and acceptance time. Connection is a condition of these functions; it is not consent to all processing under data-protection law. Turning off service emails does not turn off connected-service data.
After connection, the plugin sends account and site identifiers, the site origin and path, environment type, connection state, selected WordPress/PHP/plugin and integration versions, registered experiment references and status, a daily service-contact heartbeat, bounded experiment lifecycle milestones, and latest aggregate result and environment snapshots. Aggregate snapshots can contain impressions, conversions and revenue totals by variant. A bounded test display name is sent only while at least one result or health email preference is enabled. We use this information to operate accounts and connected functions, secure the service, deliver selected notifications, diagnose compatibility and understand product reliability and usage.
The automatically connected stream does not upload individual visitor event rows, shopper identities, WooCommerce order IDs, raw visitor IP addresses or user-agent strings, local test IDs, page content, selectors or custom code. Some connected records are linked to account email and site origin. They are not anonymous.
The former optional anonymous-telemetry description does not describe this connected service. If you have a question about information collected under the earlier system, contact us at the address above.
3) Information kept on a customer’s WordPress site
The plugin stores detailed experiment events and reports in the site owner’s WordPress database. Depending on the experiment, these can include test and variant references, event times, impressions, clicks, conversions, purchases, order IDs, attributed amounts, device class, country code and site-keyed truncated hashes derived from visitor IP address and user agent. Those hashes may still be personal data. The plugin does not deliberately store raw visitor IP addresses or full user-agent strings in its experiment-event table.
First-party cookies remember a visitor’s test variant and limited audience context. Variant assignment usually lasts 30 days, but the site owner may configure its duration per test. The plugin also uses limited deduplication cookies and, for some click events, browser session storage. The site owner must assess and provide any visitor notice, consent or objection control required in its jurisdictions. An administrator’s acceptance of abtestkit Terms does not replace a visitor’s choice.
The plugin has no general timed deletion of local experiment-event rows. The site owner can reset results or remove plugin-owned data through the relevant controls or a clean uninstall. Deactivation alone does not delete local reports. The site owner is responsible for deciding a justified local retention period and handling visitor requests relating to its database.
4) Website visits and support requests
Our website hosting and security services can process IP address, requested URL, time, browser/user agent, authenticated username where relevant, and sometimes referrer and error details. If you email us, we use your address and message to respond. We may use abtestkit on our own website; section 3 then also describes the local experiment data and browser storage we use there.
Administrators may choose to send deactivation feedback or request compatibility help. These optional submissions can include their written message and bounded diagnostic information about WordPress, PHP, theme, selected integrations and recent tests. Compatibility help can include a raw local test ID and bounded test configuration or aggregate results. A site identifier derived from its URL can be included. Please avoid putting unnecessary personal or confidential information in free text. Skipping a feedback form does not stop a connected site from attempting a minimal service deactivation event.
5) Email and suppression
We use your verified account email for verification, account and security messages. Result-ready, health/recovery and weekly-digest messages initially start enabled and can be switched off individually or together. These preferences are not consent to marketing. When production email is enabled, Resend handles email delivery and receives the recipient address, message content and delivery information.
For a permanent bounce or complaint, the service keeps a peppered hash of the recipient address and a reason so it does not send to that address again. The suppression record does not contain the raw address or provider webhook payload, but it can be matched to an address later supplied to the service. It is therefore pseudonymous personal data. The current service keeps this suppression record permanently, even after an account is deleted. We use it to prevent unwanted or undeliverable mail and assess requests about it individually under applicable law.
6) Why we process information
Where applicable, we rely on contract to provide an account and requested connected functions to an individual customer. For administrators acting for another organisation, we rely on legitimate interests in providing and securing the service. We also rely on legitimate interests to prevent abuse, maintain essential logs, understand bounded product and reliability data, respond to requested support, and prevent further delivery to bounced or complaining addresses. We consider necessity and effects on individuals for these activities. We rely on legal obligation where a specific duty applies. Optional marketing, if introduced, will use its own lawful basis and controls.
7) Providers and locations
Soup Digital Ltd manages our website and connected-service hosting. It reports UK cloud hosting with primary infrastructure in Worcestershire, automated website-file and database backups every four hours, and hourly off-site replication. We have been told that the replica is in the UK. Cloudflare supports website delivery and security. Resend is designed for transactional email delivery. Our separate diagnostic receiver handles optional administrator submissions. These providers and their infrastructure can process information needed for their functions, including ordinary network and security metadata.
The primary UK hosting location does not establish where every supplier’s staff, subcontractor or service processes information. If a transfer outside the UK or EEA requires a safeguard, we will use an applicable adequacy arrangement or contractual mechanism. You can ask us about the relevant arrangement at support@abtestkit.io.
8) Retention and deletion
| Information | Current retention |
|---|---|
| One-time connection link and record | The link expires after 20 minutes. The hosted record is removed by daily cleanup after 90 days. |
| Raw connected lifecycle events | Removed by daily cleanup after 90 days. |
| Notification delivery/outbox records and webhook replay receipts | Removed by daily cleanup after 90 days, allowing an actively processing delivery to finish or its short lock to expire. |
| Local unsent connected events | Removed when acknowledged or after at most 90 days; disconnect clears the pending connected queue. |
| Latest hosted snapshots, registrations, account, site and preferences | Retained while the relevant account or hosted site history exists; deleted by account erasure or removal of disconnected site history. |
| Bounded site and experiment journey summaries | Retained until the relevant hosted site history is removed or its account is deleted. |
| Bounce/complaint suppression hash | Kept permanently for the prevention purpose described above, including after account deletion. |
| Soup Digital server access/security logs | Normally retained up to 12 months. Logs relevant to an operational or security matter may be kept longer while needed for that matter. |
| Optional diagnostic submissions and support correspondence | Retained while needed to handle the request and any related follow-up, then removed under the applicable support/receiver process. You may request deletion when it is no longer needed. |
| Website experiment records | No automatic time-based deletion; retained until results or plugin-owned data are reset or removed. |
Soup Digital reports four-hour website/database backups and hourly off-site replication. We have been told that the UK replica has a 12-month retention period. Backups are used for recovery, access is restricted, and they are removed under the host’s recovery schedule. A deletion from live service may remain in an older recovery copy until that copy expires. Before a restored system resumes service, deletions and revoked access must be reapplied. We do not claim that all recovery copies expire within 30 days.
Disconnecting a site stops its connected access and clears pending local connected data; it does not itself delete hosted site history. The account holder can remove a disconnected site to delete that hosted history. Account deletion removes owned hosted account and site records, subject to the separate suppression record, recoverable copies and any legal requirement. It does not reach into experiments, reports or visitor data on a customer’s own WordPress installation.
9) Your rights
Depending on the law and our role, you may ask to access, correct or delete personal data, restrict or object to processing, or obtain portable data where applicable. We may need to verify your identity. Email support@abtestkit.io. For detailed visitor records held only on a customer’s WordPress site, contact that site’s owner first; we will assist our customer where our DPA applies. You may complain to the [UK Information Commissioner](https://ico.org.uk/) or another competent authority.
10) Changes
We will update the date above when this policy changes. We will give appropriate advance notice of material changes to connected processing and seek a new agreement acceptance where required. A new version does not retrospectively turn an earlier optional data stream into a mandatory one without the appropriate notice and contractual step.