Legal

Data processing agreement

When you use Whence on your store, you decide what is recorded and why. We carry it out. This sets out what that means in practice.

Last updated September 27, 2026. This agreement forms part of the terms of service. You accept it by checking the box when you create an account or first open the Whence app in Shopify; the date and the version you accepted are recorded. No signature is required, though we will sign a copy on request.

This page is also available in French, Spanish, Italian and German for convenience. If a translation differs from this English version, the English version prevails.

1. Roles

For the data recorded from your store's visitors and imported about your customers, you are the controller and Frondia LLC is your processor. You decide the purposes and the means; we act only on your documented instructions, which are these terms plus what you configure in the product.

Your documented instructions include each feature you turn on, in particular connecting a store, a Klaviyo account, or an ad or email platform to which Whence sends your orders, and keeping on the setting that links visits to the contact details visitors type, and turning on the setting that sends those contact details to the customers of your own Shopify store.

If we ever believe an instruction of yours breaks data protection law, we will tell you rather than carry it out silently.

2. What we process, and for whom

Subject matter	Recording and analysis of visits to the stores you connect, and linking them to the orders they lead to.
Duration	For as long as your account is open, plus the deletion period in clause 7.
Nature and purpose	Recording visits to your stores and replaying them to you; measuring clicks, scrolling, mouse movement, form use, page speed and events to show you heatmaps, form analytics, page speed and event reports; naming the source of each visit; linking visits by the same person; importing your store's orders, abandoned checkouts and, if you connect it, Klaviyo profiles, to tie sales and carts to visits; receiving cart and checkout events from the Whence Shopify web pixel; writing optional AI summaries of a visitor; and, if you turn it on, sending your orders to the ad and email platforms you connect, and creating customers in your own Shopify store from the contact details visitors type.
Categories of data	Interaction data and page content as displayed; click positions and the labels of clicked elements, scroll depth, mouse movement on desktop computers, how form fields are used (field names, time spent, whether a field was left empty or filled in more than once, whether the form was submitted, never the values typed), page speed measures, and events, including the events you define and the data you attach to them; page addresses, referring address, utm tags and advertising click identifiers; browser user agent, device characteristics and country (and region and city where your store provides them); a random visitor identifier; the email address, phone number, first name and last name a visitor types into your store's forms, and the email address in Klaviyo's browser cookie, after consent and while you keep that setting on; cart and checkout events, checkout and order identifiers and consent choices reported by Shopify; consent records already collected, without network address or user agent; advertising cookies (only with marketing consent); order number, date, amounts, currency and products; customer email address, phone number, city, postal code, state or region and country; Klaviyo profile email, first name and sign-up date.
Categories of data subject	Visitors to your stores; your customers, including people who started a checkout; your Klaviyo contacts.
Special categories	None. You must not use Whence on pages displaying special category data.

In recordings, text typed into form fields is masked in the visitor's browser before it reaches us. Passwords and payment card numbers are never read. The only typed values we receive are the contact details listed above. Form analytics contain field names and counts, never the values typed.

2A. Your obligations as controller

Before Whence records anyone or sends any order to a platform, you must:

(a) where the law requires consent, collect it before the script runs and before contact details are read, using Shopify's cookie banner or a consent tool connected to Shopify's Customer Privacy API or to the Whence script as documented; Whence provides no cookie banner of its own and reads the consent your store collects;
(b) tell visitors and customers in your privacy notice that visits are recorded by Whence, what is recorded, including clicks, scrolling, form use and events, and the contact details the script reads, which items are stored in their browser, and which platforms receive their orders;
(c) make sure the marketing consent you collect covers sharing purchase data with the ad platforms you connect, including for ad measurement and personalization where a platform requires it;
(d) have a lawful basis for every processing you instruct;
(e) if you turn on "Record without waiting for consent", Whence records visits, reads the contact details typed and sends events to the platforms you connect without waiting for the visitor's consent, on your instruction. You alone decide this and you are responsible for it: in the EU, the UK and some US states it is unlawful without consent. We log each change of this setting with who made it and when, and we mark each visit recorded this way; a visitor's explicit refusal is still respected.
(f) "Record even when a visitor declines" is off by default, and you can turn it on only by confirming that you take responsibility for it. If you turn it on, Whence also records, on your instruction, the visitors who decline on your store's cookie banner or consent tool, notwithstanding the last sentence of (e). You alone decide this and you are responsible for it: recording a visitor who declined is forbidden by the GDPR in the EU, the EEA, the UK and Switzerland. We log each change of this setting with who made it and when, and we mark each visit recorded this way. Nothing about a visitor who declined is sent to the ad platforms you connect: not their network address, not their click identifiers, and no marketing consent is presumed for them.

3. Confidentiality

Everyone with access to your data is bound by confidentiality obligations that survive the end of their engagement, and access is granted only where the work requires it.

4. Security

We maintain measures appropriate to the risk, including: encryption in transit; recordings held in private storage rather than at a public address; removal of sensitive parameters and of the fragment from the page addresses stored for a visit, as described in our privacy notice; database rules that limit each account's access to its own stores; background jobs that need wider access run only on our servers, with credentials that are never sent to a browser; and restricted access to production systems.

We may update these measures, but not in a way that materially reduces the level of protection.

5. Subprocessors

You authorize us to engage the subprocessors listed on the subprocessors page. Each is bound by obligations no less protective than these.

We will announce a new subprocessor on that page at least thirty days before it begins processing your data. If you object on reasonable data protection grounds within those thirty days, and we cannot offer an alternative, you may terminate the affected part of the service and receive a refund of the unused period.

We remain responsible to you for what our subprocessors do.

5A. Recipients you direct

When you connect an advertising or email platform in Whence (Meta, Google, TikTok, Snapchat, Pinterest, Microsoft, Reddit, Taboola or Klaviyo), you instruct us to send your order data, and the store events you choose for that platform (product views, carts, checkouts and, if you turn it on, page views), to your account on that platform. When the visitor allowed marketing, the IP address their browser used on your store goes with the order and with these events: Whence keeps it only when the visitor allowed marketing and your store sends events to at least one platform, and it is cleared after 7 days. When you ask Whence to run that platform's pixel in the browser, its own script is loaded on your store under its terms. That platform is not our subprocessor: you have your own agreement with it, you are responsible for accepting and following its terms, and it processes the data under those terms. We send an order only when the consent signals described in our privacy notice allow it. For ad platforms, contact details are hashed where the platform requires it; Klaviyo receives them unhashed, in your own account. We cannot recall data a platform has already received; erasure requests for that data must be made to the platform. You can stop sending to any platform at any time.

When you turn on sending captured contacts to your Shopify customers (off by default), you instruct us to create, in your own Shopify store, a customer for each contact captured on your storefront after the visitor's consent and after you turned the setting on, with their email address, phone number, first name and last name, the tag whence-captured and a note. We never change a customer that already exists in your store, apart from adding that tag, and we set no marketing consent. Shopify is your store platform, not our subprocessor. Turning the setting off stops sending and deletes nothing; erasing a person in Whence does not delete the customer created in your store, which you erase in Shopify.

The same applies when you connect Google Analytics 4, HubSpot or Zapier: you instruct us to send the events you choose, with the Google Analytics client identifier (only after an explicit statistics consent) or the visitor's email address (only after marketing consent) as described in our privacy notice, to your own account on that tool. And when you connect WooCommerce or BigCommerce, you instruct us to read your orders from it with the read-only keys you provide. These tools are recipients you choose, not our subprocessors.

6. International transfers

Your visitors' and customers' data is stored in the European Union, in the locations named on the subprocessors page. It is accessed from the United States by Frondia LLC and by some subprocessors, and parts of the network layer are global. Where a transfer requires a safeguard, the parties incorporate the European Commission's standard contractual clauses of June 4, 2021 by reference, module two (controller to processor), with you as data exporter and Frondia LLC as data importer, together with the United Kingdom addendum issued by the Information Commissioner's Office where the transfer is subject to United Kingdom law.

For those clauses, the description in clause 2 serves as Annex I, the measures in clause 4 as Annex II, and the subprocessors page as Annex III. The supervisory authority is that of the member state in which you are established. Clause 17 is governed by the law of Ireland and clause 18 gives jurisdiction to the courts of Ireland.

For transfers subject to the Swiss Federal Act on Data Protection, the same clauses apply, the Swiss Federal Data Protection and Information Commissioner is the competent authority, and references to the GDPR are read as references to that Act.

7. Deletion and return

Recordings and visits, with the clicks, form analytics, page speed measures and events measured during them and the daily counts built from them, are deleted automatically once your plan's retention period has elapsed. Cart and checkout events are deleted after 90 days, AI summaries on the same schedule as recordings, consent records after 24 months, and imported orders, abandoned checkouts and contacts within a day of the store being disconnected or the Shopify app being uninstalled. The details are in our privacy notice.

When your account is canceled, you may export your data during the thirty days that follow, after which we delete it. If you use the Shopify app, uninstalling it also leads Shopify to ask us to erase the store's data 48 hours later; export anything you need before uninstalling.

You can export or erase an individual visitor or customer at any time from the Privacy requests section of your settings. An erasure that cannot remove every part fails visibly rather than reporting success: you are never told a deletion happened when it did not.

8. Helping you meet your own obligations

We will assist you, so far as is reasonable and taking into account what we know:

With requests from data subjects. The Privacy requests section of your settings lets you find a person by email address, phone number, first and last name, visitor identifier or order number, and export or erase what Whence holds about them. Requests Shopify sends us appear there with their due date. Where a request reaches us directly, we will forward it to you rather than act on it ourselves.
With impact assessments and consultations concerning the processing described here.
With security incidents. We will notify you without undue delay, and where possible within 48 hours and in any event within 72 hours of becoming aware of a personal data breach affecting your data, with what we know at the time, what we are doing about it, and what we advise you to do.

9. Audit

We will make available the information reasonably needed to demonstrate compliance with this agreement, and will answer a written security questionnaire once in any twelve month period. Where that is genuinely insufficient, you may audit us on thirty days' notice, once in any twelve month period, at your cost, during business hours and without disrupting the service or the confidentiality of other customers' data.

9A. US state privacy laws

Where the California Consumer Privacy Act or a similar US state law applies, we process personal information only for the business purposes described in clause 2 and your instructions. We will not sell it, share it for cross context behavioral advertising on our own behalf, retain, use or disclose it outside our direct business relationship with you, or combine it with personal information we receive from others, except as those laws allow. We will comply with those laws, provide the same level of protection they require, and tell you if we can no longer meet these obligations. You may take reasonable steps to stop and remedy any unauthorized use.

10. Precedence

Where this agreement conflicts with the terms of service on the processing of visitor or customer data, this agreement prevails. Where it conflicts with the standard contractual clauses, those clauses prevail.

11. Contact

Frondia LLC, New Mexico, United States. contact@usewhence.com.