TestLift Privacy Policy

Last updated: 17 August 2026

1. Data We Collect

TestLift collects the following data to provide A/B testing services:

• Store information: Shop domain, OAuth session records stored by Shopify's Remix app framework, subscription/plan state, and app settings connected to your shop.
• Visitor data: Pseudonymous visitor IDs stored in first-party cookies, hashed IP addresses captured on tracking requests, user-agent and referrer metadata, landing pages, and page-view counts tied to test assignments.
• Conversion data: Event records such as product views, add-to-cart events, purchases, order IDs, order values, currency codes, and related product or variant identifiers tied to pseudonymous visitor IDs.
• Test configuration: Test names, selectors, variant content, traffic split settings, results, and analytics you create inside the app. The listed product A/B tests purchase-button copy (Add to cart, Checkout, custom purchase buttons) and homepage section campaigns (slideshow image plus optional heading and copy). It does not compare Shopify product variants or change product catalog offerings.

We store test configuration and the aggregated and event-level analytics needed to run experiments, plus first-party cookies on the storefront (tl_vid and assignment cookies). We do not guarantee conversion lift or any other business outcome.

Important: TestLift is designed around pseudonymous storefront analytics. We do not intentionally collect customer payment details, and our own visitor tracking uses random visitor IDs plus hashed IP addresses rather than customer profiles. Shopify OAuth session storage may include merchant account fields supplied by Shopify during installation and admin authentication.

2. How We Use Your Data

• To assign visitors to test variants consistently.
• To calculate statistical significance and Bayesian probability metrics.
• To display conversion rates, revenue impact, and test performance in your dashboard.
• To provide auto-pause guardrails that protect against underperforming variants.

3. Data Retention

Test and analytics records remain in the app database until they are deleted by app actions or by uninstall/privacy cleanup. When Shopify sends an APP_UNINSTALLED or SHOP_REDACT webhook, TestLift deletes shop-owned app records from its database. We do not currently enforce an automatic 90-day purge window in application code.

4. Data Sharing

We do not sell, rent, or share your data with third parties for marketing or advertising purposes.

Data is only processed by our trusted infrastructure providers under strict data processing agreements:

• Hosting: Cloud infrastructure for app hosting and data storage
• Database: Encrypted database services for test results and analytics
• Shopify: Store data is accessed via Shopify's APIs under their Data Processing Addendum. TestLift complies with Shopify's App Store requirements and data handling policies.

All third-party processors are contractually obligated to maintain the same level of data protection described in this policy.

5. GDPR Compliance

For merchants and visitors in the EU/EEA:

• We process shop and storefront data to provide the app's A/B testing service.
• Shopify's privacy webhooks are the system hooks we currently rely on for shop-level deletion handling.
• Visitor data is pseudonymized using random visitor IDs and hashed IP data.
• If you need additional privacy support, contact support@testlift.app so we can review the request against the data actually stored for your shop.

6. Cookies

TestLift may set several first-party cookies for storefront testing, including a visitor ID cookie (tl_vid), per-test assignment cookies (for example tl_[slug]), the active-test list cookie (tl_tests), and optional preview-mode cookies used while configuring tests. The app's assignment endpoint may also issue a legacy testlift_visitor cookie for compatibility. These cookies are used for variant consistency, previewing, and event attribution; they are not advertising cookies.

7. Security

TestLift is intended to run over HTTPS, and app data is stored in the application's PostgreSQL database. Shopify OAuth sessions are stored through Prisma session storage. We do not claim separate application-layer encryption for access tokens in the current implementation. Administrative access to app infrastructure is limited to service operators and hosting controls.

8. Changes to This Policy

We may update this policy periodically. Significant changes will be communicated via the app dashboard. Continued use of TestLift after changes constitutes acceptance.

9. Contact

For privacy-related inquiries, contact us at support@testlift.app.