Who we are
SplitStat is a product of Mirat Soft Private Limited.
We make software that runs A/B tests, split URL tests and feature rollouts on other companies' websites. That shapes everything below, so it is worth saying at the top.
Two kinds of people
This policy covers two groups, and the rules are different for each.
Our customers. The people who sign up, log in and pay. We decide what we hold about them and why, so in data protection language we are the controller, or the data fiduciary. Everything we do with that information is our responsibility.
Visitors to our customers' websites. When a customer puts our snippet on their site, we record what happened there so we can tell them which version won. We do that on their instructions and for their purposes, not ours. They are the controller. We are the processor. If you are a visitor and you want your data removed, the company whose website you were on is the one who can order it, and we will act on that order.
If you came here from a website running SplitStat and want to know exactly what we saw, skip to what we record about visitors. It is a short list, and shorter than you expect.
What we hold about you, if you have an account
| What | Why we have it | Legal basis |
|---|---|---|
| Name and email address | To create the account, sign you in and reach you about it | Contract |
| Password, stored hashed | To sign you in. We cannot read it and cannot tell you what it is | Contract |
| Two-factor secrets and passkeys, if you set them up | To let you sign in more safely | Contract |
| Your Google account email, if you sign in with Google | To recognise you. We do not read your Gmail, Drive or contacts | Contract |
| IP address and browser of your login sessions | To keep you signed in, and to let you spot a session that is not yours | Legitimate interest: keeping accounts secure |
| Billing details held by Stripe or Paddle, and a copy of your invoices | To charge you and to show you what you were charged. Card numbers stay with them and never reach us | Contract, and the tax law that makes us keep invoices |
| A record of who changed what in your workspace | So your own team can answer "who turned this off" | Contract |
| Support messages, live chat conversations and demo requests you send us | To answer you. If you are signed in when you open the chat, your name and email address go with it, so you do not have to type them | Legitimate interest: answering you |
We do not buy lists, we do not enrich your profile from other sources, and we do not sell any of it.
What we record about visitors to our customers' sites
We never store a visitor's IP address with what we record about their visit. The country is read from a header at the network edge, and the address is left out before anything about the visit is written down. This is built into the database, not into a policy we could quietly change.
Our web server does log it, for a short time. Like almost every web service, our server writes each request it receives to a log, and that line includes the address it came from. We keep those logs for 14 days, then they are deleted automatically.
We keep them for two reasons only: to spot attacks, such as somebody flooding the service with fake visits, and to trace a fault when something breaks. The logs are never joined to visitor data, never used for tracking or reports, and never shared with our customers.
Here is everything that is written down, per visit:
| Recorded | Never recorded |
|---|---|
| A random visitor id and session id | IP address |
| The page address and the referring address | Name, email or phone number |
| Device type: desktop, mobile or tablet | The full browser user agent string |
| A two letter country code | City, region or coordinates |
| Which version of a test was shown | Anything from another website |
| Time of the event, and a currency if there was a value | Keystrokes, form contents, screen recordings |
The visitor id is a random string. It is not derived from anything about the person, it means nothing outside the website that set it, and we cannot use it to recognise the same person on a different customer's site. There is no shared identity graph here, and building one is not on the roadmap.
One thing is up to our customer. A customer can attach their own details to an event, for example the plan a purchase was on. Our terms forbid them from putting names, email addresses, payment details or anything sensitive in there, but we cannot inspect every field of every customer. If you are worried about what a particular website sent us, ask that website. They have the list.
Cookies
On this website. We run no advertising trackers. We set one cookie of our own, which keeps you signed in after you log in. Two outside tools set cookies of theirs:
- Google Analytics, loaded through Google Tag Manager, counts visits to this website and sign-ups.
- Our live chat, run by Zoho SalesIQ, remembers your conversation as you move from page to page.
On our customers' websites. Our snippet stores up to three cookies. They
belong to the website you are visiting rather than to us, and their names start with
splitstat followed by that website's project key.
| Name ends in | What it holds |
|---|---|
v | The random visitor id |
s | The session id and when you were last seen, so a visit can be told apart from the next one |
e | How the visit began: the address you landed on and the page that sent you, so a test aimed at a campaign keeps working as you move around the site |
Each lasts up to 400 days, which Safari shortens to 7 days on its own. Their job is to keep showing you the same version of a page instead of a different one on every visit.
The snippet keeps a copy of the same three values in the website's local storage, along with the website's test settings. So clearing your cookies alone does not make you a new visitor. Clearing the website's stored data in your browser does, and you may then see a different version of the page. Before it writes anything, the snippet also sets a test cookie to see whether cookies work, and deletes it straight away.
Consent banners
Whether a consent banner is shown is our customer's decision, because it is their website. When a customer turns consent on, our snippet waits and stores no identifier until their banner says yes. We listen for the answer from the IAB Transparency and Consent Framework, Google Consent Mode, OneTrust and Cookiebot, so a customer does not have to wire up anything by hand.
If the banner is never answered, that counts as a no and no identifier is stored.
Why we are allowed to process it
For our customers: because we have a contract with them, and because we have a legitimate interest in keeping the service running, secure and paid for. The table under what we hold about you gives the basis for each item.
For visitors: our customer decides the lawful basis and is responsible for it, usually consent through their banner or their own legitimate interest. We act on their instructions.
For the web server logs: a legitimate interest, ours and our customers', in keeping the service secure and working.
We do not use any of it to train machine learning models, ours or anyone else's.
We make no automated decisions about you that have a legal or similarly serious effect. A test result is a measurement of a page, not a judgement about a person.
Emails we send
We send no newsletters and no marketing email. Every email is about your account or your tests: a welcome, a trial ending, a team invitation, the install snippet sent to your developer, a demo you booked, a test that needs a look.
Emails about your tests can be switched off in Notification settings. Emails about the account itself, such as a trial ending or a password reset, cannot, because they are part of running the service you signed up for.
Who else touches it
We use a small number of outside companies to run the service. They may process data on our behalf, under contract, and for no purpose of their own.
| Company | What they do | What they see |
|---|---|---|
| DigitalOcean | Runs our servers and database | Everything we store |
| Cloudflare | Sits in front of the service and tells us the country | Visitor IP addresses in transit. They pass the address and the country on to our servers |
| Stripe | Takes payments for some plans | Your name, email, billing address and card. We see the invoice, never the card |
| Paddle | Sells and bills some plans as the merchant of record, which means Paddle is the seller on your invoice and handles sales tax | Your name, email, billing address, tax number if you give one, and card. Paddle acts as a controller of that data in its own right, under its own privacy policy |
| our email delivery provider | Sends our email | Your name, email address and the contents of the message |
| Sign in with Google, if you use it. Google Analytics, to count visits to this website | That you signed in, for which we ask your email address and nothing else. For analytics, the pages you visit on this website and, once you are signed in, your account id | |
| Zoho | Runs our live chat | What you write in the chat, the page you opened it on and, if you are signed in, your name and email address |
| Anthropic | Writes suggestions in the visual editor, if a customer uses its AI features | The page open in the editor, its text and layout, and the test's hypothesis and goal. Nothing from our records of visitors: no events and no test results |
Before we add a company that would handle customer or visitor data, we will email account owners ahead of the change, so there is time to object. If you object and we cannot resolve it, you can close the account and we will charge you nothing further.
We will also hand data over if a court or a law that applies to us requires it. If that happens and we are allowed to tell the customer, we will.
If we are ever bought or merged, the data moves with the business, and we will say so here before it does.
Where it is stored
Our servers are in the United States. That means data about customers and visitors in India, the European Union and elsewhere is transferred to and stored in the United States.
We use standard contractual clauses with our sub-processors for those transfers. If you need a data processing agreement for your own records, write to [email protected] and we will send you one.
How long we keep it
| What | Kept for |
|---|---|
| Individual visitor events | 90 days, then deleted automatically every night |
| Daily totals built from those events | As long as the account exists. They are counts, with nothing about any one person in them |
| Which version a visitor was shown | As long as the test exists, because a result cannot be recomputed without it |
| Your account, workspaces and tests | Until you close the account |
| Everything, after you close the account | 90 days, then deleted |
| Web server logs, which include IP addresses | 14 days, then deleted automatically |
| Invoices and payment records | As long as tax and company law require us to keep them |
The 90 day window on raw events is enforced by a job that runs every night, not by a promise to get round to it.
How we protect it
Traffic is encrypted in transit. Passwords are hashed and cannot be recovered by us. Access to production is limited to the people who need it. Every change inside a workspace is written to an audit trail your own team can read.
We will tell affected customers about a personal data breach without undue delay, and the relevant authority within the time their law requires.
Found a security problem? Write to [email protected] before telling anyone else, and we will work with you.
Your rights
Wherever you live, you can ask us to show you what we hold about you, correct it, delete it, give you a copy you can take elsewhere, or stop a particular use of it. You can also withdraw a consent you gave, which does not undo what was lawful before you withdrew it.
Write to [email protected]. We answer within 30 days. We will ask you to prove who you are first, because handing your data to somebody claiming to be you is the failure that matters most.
We will never charge you for asking, and we will never treat you worse for having asked.
If you are a visitor to a customer's website rather than a customer of ours, send the request to that website. They instruct us and we act on it. If you cannot work out who to ask, write to us and we will point you at them.
If you are in California
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We never have. There is no opt-out link here because there is nothing to opt out of.
The categories we collect, why, and how long we keep them are listed above. We do not collect sensitive personal information as California defines it. You have the right to know, to delete, to correct and to opt out, and you can ask through an authorised agent. Use the address in your rights.
If you are in India
Under the Digital Personal Data Protection Act 2023, we are the data fiduciary for account data and a data processor for the visitor data we handle for our customers.
You can ask us what we hold, have it corrected or erased, nominate somebody to act for you if you cannot, and complain if you are not satisfied with our answer. Our grievance officer is the person to write to:
[email protected]
Mirat Soft Private Limited
We respond to grievances within 30 days. If you are still not satisfied, you may complain to the Data Protection Board of India.
Children
SplitStat is a business tool. It is not for anyone under 18, and we do not knowingly create accounts for them. If you believe a child has an account with us, tell us and we will delete it.
Changes to this policy
When we change this page we move the date at the top. If a change actually affects what we do with your data, we will email account holders before it takes effect rather than leave you to notice.
How to reach us
Privacy and your rights:
[email protected]
Grievances:
[email protected]
Everything else:
[email protected]
Mirat Soft Private Limited