What Whence records, and what it refuses to

Two different relationships

Whence handles two kinds of data, under two different responsibilities, and they should not be confused.

Your own account data is data we hold about you as a customer: your email address, your organization name, your stores, your billing record. For this we are the controller, and this page describes what we do with it. We use it to provide the service under our contract with you, and we keep billing records to meet our tax and accounting obligations.

Your visitors' and customers' data is processed on your instructions when you install Whence on your store. For that data you are the controller and we are your processor: we act on your instructions, not our own. The terms governing that relationship are in the data processing agreement, which forms part of our contract with you.

What the recording script collects

When a visitor loads a page carrying the Whence script, and after they have accepted it as described below, we collect:

• What was displayed and what was done. The structure of the page, clicks, scrolling, mouse movement, page changes and browser errors, in a form that lets the visit be replayed.
• Where the visit came from. The referring address, utm tags, and any advertising click identifier in the page address, so the source can be named rather than guessed.
• Technical context. The browser's user agent, device type, window size, and the visitor's country as reported by our network provider. If your store passes region and city to the script, we store those too. We do not store the network address.
• An identifier for the visitor, generated at random, so repeat visits can be recognized. It is kept in the visitor's local storage and in a first party cookie named cvb_vid on your store's domain, which expires after 365 days. It is not shared between stores and means nothing outside your store.

Heatmaps, forms, page speed and events

From the same visits, and only after the same consent, the script also measures the following, so you can see heatmaps, form analytics, page speed and event reports:

• Clicks. For each click: its position on the page and within the clicked element, the window width, a short technical description of the element (its tag, id and classes), and the element's visible label, up to 60 characters. The label is left out when it looks like an email address or a phone number, and on account pages.
• Scrolling and mouse movement. How far down each page the visitor scrolled. On desktop computers only, where the mouse moved, sampled a few times per second and counted by area of the page.
• How forms are used, never what is typed. For each form a visitor interacts with, and for each of its fields, named by the field's name, id or autocomplete attribute: how many times the field was selected, how long it was used, whether it was left empty, whether it was filled in more than once, which field was used last, and whether the form was submitted. For this, the script only checks whether a field is empty. It never reads or sends the value of a field.
• Page speed. For each page viewed, the measures reported by the browser: first contentful paint, largest contentful paint, interaction to next paint and cumulative layout shift.
• Events. Page views, clicks on buttons and links, form submissions, searches, the length of text a visitor selects (never the text itself), rapid back and forth mouse movement, page reloads, the mouse leaving the page window, and adding to cart or starting checkout. A search term is kept only as it appears in the page address, after the sensitive details described below are removed. On Shopify, payment and purchase steps come from the Whence web pixel described below.
• Events you define. A visit to a page address, a click on an element you choose, or an event your store sends with window.whence.track, with the data you attach to it. Attached data is limited to 20 short values; values that look like an email address or a phone number, and fields whose name refers to personal or secret data, such as email, phone, address, password, token or card, are dropped before they leave the browser and again when Whence receives them. An event can carry a value in money that you set; only members of your team with access to revenue can see it.

These measurements are stored with the visit they come from, and Whence also keeps daily counts per page (clicks by area of the page, clicks by element, scroll depth) that are not linked to any visit or visitor. No network address is stored, and page addresses are cleaned as described below.

Surveys and announcements

If you create surveys or announcements in Whence, a separate script shows them on your store. Like the recording script, it shows nothing, stores nothing in the visitor's browser and sends nothing to Whence until the visitor's consent allows it.

• When a visitor answers a survey, Whence stores the answers with the time, the page path, and the identifiers of the visit and of the visitor when the recording script is running, so you can watch the visit and so the answers can be exported or erased with the rest of that person's data. Answers are also recorded as a "Survey answered" event of the visit.
• Written answers are limited to 1,000 characters. Anything that looks like an email address or a phone number is replaced with "[removed]" in the visitor's browser and again when Whence receives it. Written answers can still contain personal details a visitor chooses to share; only members of your team with access to customer details can read them.
• For each survey and announcement, Whence counts per day how many times it was shown, clicked and closed. These counts are not linked to any visit or visitor.

Contact details a visitor types

Whence can link a visit to the person behind it. When this setting is on, the script reads the email address, phone number, first name and last name that a visitor types into your store's form fields, including when the form is not submitted. If your store uses Klaviyo, it also reads the email address stored in Klaviyo's __kla_id cookie in the visitor's browser.

• It runs only after the visitor's consent, read from your store's cookie banner or consent tool, unless you turn on "Record without waiting for consent" or "Record even when a visitor declines" (see "Consent" below).
• It is on by default. You can turn it off at any time in your Whence settings, and the script then stops reading these fields.
• These details are stored as fields of the visit, so you can see which visits belong to the same person. In the replay itself, what the visitor typed stays masked.

Sending captured contacts to your Shopify customers

This is optional and off by default. Only a team member with both the Store settings and the Customer data permissions can turn it on, in your Whence settings. When it is on, Whence adds the contacts captured as described above to the customers of your own Shopify store, on your instructions: the email address, phone number, first name and last name.

• Only contacts captured after the visitor's consent, and after you turn the setting on, are sent. Contacts captured earlier, or while the setting was off, are not.
• A contact is sent only with a valid email address or phone number. Passwords and card numbers are never read, so they are never sent.
• Each new customer gets the tag whence-captured and a note saying the contact was captured on your storefront and is not a newsletter signup. No one is subscribed to your emails or text messages: their marketing status stays not subscribed.
• A customer who already exists in your store with the same email address or phone number is never changed. At most, the tag is added.
• Turning the setting off stops sending and deletes nothing. The customers already created belong to your store and stay in Shopify.

Shopify is your own store platform, not a Whence subprocessor: the customers created there are processed under your agreement with Shopify.

What it does not collect

Some of this is enforced by the script itself rather than left to good intentions.

• Passwords and payment card numbers are never read. In the recording, text typed into form fields is masked before it leaves the browser. The only typed values Whence reads are the contact details described above, and only while that setting is on. Form analytics record how fields are used, never their values.
• Any element you mark with the class cvb-replay-block is not recorded at all. Use it on anything you do not want captured, including content that is not a form field.
• Checkout pages are never replayed. On Shopify, Whence only receives the checkout steps described in the next sections.
• Sensitive details are removed from page addresses. Before Whence stores the page addresses, referring address and address parameters of a visit, it removes from them: parameters whose name refers to personal or secret data, such as email, phone, name, address, password, token, key, signature or card, and any parameter whose value looks like an email address; advertising click identifiers such as gclid, fbclid, msclkid and ttclid, when the visitor has declined marketing; and the part of the address after "#". Other parameters, such as utm tags, are kept.
• Whence does not sell visitor data, does not use it for its own advertising, and does not combine data from different stores. Data goes from Whence to an ad or email platform only when you connect that platform, as described in "Sending sales to your ad and email platforms".

What is stored in the visitor's browser

The script and the Whence web pixel use these items on your store's domain. List them in your own cookie notice.

• cvb_vid (cookie, 365 days, and local storage): the random visitor identifier.
• _shopify_y (Shopify's own cookie, set by Shopify's servers): on Shopify stores, read but never written, after consent, so a returning visitor is recognized after Safari clears the script's storage (7 days). Whence keeps only a hash of it, salted per store.
• whence_vid (cookie, 390 days, HttpOnly, only with the Whence WordPress plugin's first-party tracking): a random visitor identifier set by your own server, only for a visit your consent settings allow. It is never extended.
• cvb_rid, cvb_rid_t, cvb_smp, cvb_seq_*, cvb_vid_bridged (session storage): the current visit, sampling, and linking the cart to the visit.
• cvb_clic (local storage, 90 days): the last Google Ads click identifier, so a later order can be credited to it.
• whence_off (local storage): set when someone opens the store with ?whence=off, so that browser is not recorded.
• cvb_replay_consent (local storage): the visitor's consent to recording, when a consent tool records it there.
• whence_engage (local storage) and whence_engage_v (session storage), only when you run surveys or announcements and after consent: which of them the visitor has already seen, answered or closed, and a count of visits, so each one is shown only as often as you chose.
• whence_clics (local storage, 90 days, only with marketing consent): advertising click identifiers read by the Whence web pixel.
• Cart attributes cvb_vid, gclid, gbraid, wbraid and utm tags: added to the Shopify cart so the order can be linked to the visit.

With first-party tracking, the script and everything it sends go through your store's own domain: on Shopify, through the Whence app proxy at /apps/whence, which Shopify signs; on WordPress, through the Whence plugin on your site. The data and the consent rules stay the same; only the address changes. If that address does not answer, the script uses the Whence domain.

Consent

By default, Whence reads the consent your store already collects: on Shopify, Shopify's cookie banner and any consent app connected to Shopify's Customer Privacy API; elsewhere, Google Consent Mode, Cookiebot, OneTrust, or your own banner through the whence.consent() function. Whence does not show a cookie banner of its own. Recording, the reading of contact details and sending to ad platforms start only once that consent allows them. A visitor who declines is not recorded and their contact details are not read, unless you turn on "Record even when a visitor declines" (see below), and nothing about them is ever sent to your ad platforms.

You can turn on "Record without waiting for consent" in your Whence settings. Whence then records every visit, reads the contact details typed and sends events to your ad platforms without waiting for consent; a visitor who explicitly declines is still respected, unless you also turn on "Record even when a visitor declines", and passwords and card numbers are still never read. In the EU, the UK and some US states, recording visitors and collecting their email without consent is illegal: you are responsible for this choice. Each change is logged with who made it and when, and each visit recorded this way is marked "recorded without consent request", including in the data you export for a person.

"Record even when a visitor declines" is off by default, and a store can turn it on only by confirming that it takes responsibility for it. Whence then also records the visitors who decline on the store's cookie banner, and reads the contact details they type, as for any other visit. Recording a visitor who declined is forbidden by the GDPR in the EU, the EEA, the UK and Switzerland: the store is responsible for this choice. Each change is logged with who made it and when, and each visit recorded this way is marked as recorded despite a refusal, including in the data exported for a person. A visitor who declined is never sent to ad platforms: not their network address, not their click identifiers, and no marketing consent is presumed for them.

Cart, checkout and purchase events (Shopify)

When the Whence app is installed, a Shopify web pixel runs on your storefront, cart and checkout pages. For each of these steps (page viewed, product viewed, product added to cart, checkout started, payment information submitted, checkout completed), the pixel sends Whence the step, the products involved (product and variant identifiers, SKU, title, quantity and price), the checkout and order identifiers, the total and currency, the page address, the browser's user agent, Shopify's client identifier, the Whence visitor identifier, and the visitor's consent choices as reported by Shopify.

Only when the visitor has allowed marketing, and only if your store sends events to at least one ad platform through Whence, Whence also keeps the IP address the pixel's request came from, so the platform can match the event to the ad that brought the visitor. It is cleared after 7 days.

Only when the visitor has allowed marketing, the pixel also reads advertising click identifiers in the page address and these advertising cookies: _fbp, _fbc, _ttp, _scid, _epik, _uetmsclkid, _uetvid, _rdt_uuid, _gcl_aw, _gcl_gb, _pin_unauth, twclid and _tt_enable_cookie.

Shopify does not load the pixel for a visitor who has not allowed analytics, or who has opted out of the sale or sharing of their personal data.

Orders and customers from your store

When you connect a Shopify store, through the Whence app or with your own app credentials, Whence reads from it, on your instructions and as your processor:

• Orders: order number, date, amounts and currency, the products bought, the landing page and referral that Shopify reports, the cart attributes our script adds (visitor identifier, advertising click identifier, utm tags), the customer's email address and phone number, and the city, postal code, state or region and country of the order's shipping address (or of its billing address when there is no shipping address).
• Abandoned checkouts: the email address, the date and the products left in the cart.

If you connect WooCommerce or BigCommerce instead, Whence reads the same order fields through their APIs, with read-only keys you create: order number, date, amounts and currency, the products bought, the customer's email address and phone number, and the city, postal code, state or region and country of the order. The Whence visitor identifier ties the order to its visit: on WooCommerce, the Whence plugin copies it from the cvb_vid cookie onto the order; on BigCommerce, a script on the order confirmation page sends the order number to Whence as an event, after the visitor's consent.

If you connect Klaviyo, Whence also reads the email address, first name and sign-up date of the profiles in your Klaviyo account.

This is used to tie a sale or an abandoned cart to the visit that led to it, to list those people as contacts in your account, and, if you turn it on, to send your sales to the platforms you connect. It is never shared between stores. Whence reads only the Shopify fields your store has approved for the app: phone numbers and postal codes are protected fields in Shopify, and when one of them is not approved, Whence reads the orders without it. Whence does not read names, street address lines or map coordinates from orders.

Sending sales to your ad and email platforms

If you connect an advertising or email platform in Whence, Whence sends each new order to the account you connected, on your instructions. You can also choose, for each platform, to send the steps before the order: product viewed, product added to cart, checkout started, payment information submitted and, if you turn it on, page viewed. The platforms available are Meta, Google, TikTok, Snapchat, Pinterest, Microsoft, Reddit, Taboola and Klaviyo.

An order or a step is sent only if the Whence web pixel recorded that the visitor allowed marketing and did not opt out of the sale or sharing of their data. Otherwise it is not sent.

What is sent: for an order, the order identifier and number, date, total, currency and products, and the customer's email address, phone number, city, postal code and country; for a step, its name, time, value, currency and products; for both, the page address, the browser's user agent, the IP address when Whence kept it (see above), advertising click identifiers and advertising cookies, the Whence visitor identifier, and, for a step, the email address, phone number and name the visitor typed on your store if identity capture is on and allowed.

If you ask Whence to run a platform's pixel in the browser (the custom pixel you add to Shopify, or the Whence pixels script on other stores), that platform's own script is loaded on your store, only after the visitor allowed marketing, and receives the same steps with the same event identifier, so the platform counts each one once. That script is the platform's, under its own terms.

Whence keeps a log of what it sent to each platform (the step, the status, the platform's answer and the names of the matching keys, never their values): 7 days for steps and tests, 90 days for orders.

For ad platforms, the email address, phone number, location and Whence visitor identifier are normalized and hashed with SHA-256 before they leave Whence, where the platform requires it. Click identifiers, advertising cookies and the user agent are sent as they are, because the platforms need them in that form. Hashing is not anonymization: the platform can match the result to its own users. For Klaviyo, the data is sent unhashed, into your own Klaviyo account. Sending an order to Klaviyo does not subscribe anyone to email; whether a flow emails the customer depends on their email consent in Klaviyo.

These platforms are not Whence subprocessors. You have your own agreement with each of them, and each uses the data under its own terms with you. You choose which platforms receive data and can turn each one off at any time. Orders already sent stay with the platform.

Sending events to your analytics and automation tools

If you connect Google Analytics 4, HubSpot or Zapier in Whence, Whence sends the events you choose to the account you connected, on your instructions:

• Google Analytics 4: the event name, time, page path and value, with the Google Analytics client identifier read from the _ga cookie and the Google Analytics session number read from the _ga_ cookie of your property, so the event joins the visitor's Google Analytics session. An event is sent only if the visitor explicitly allowed statistics cookies; without that consent the identifier is not read and nothing is sent. Google's ad consent fields are marked as granted only if the visitor also allowed marketing. With the Google Analytics import turned on, the events your pages already send to Google Analytics are also recorded in Whence, under the same consent as every other Whence event.
• HubSpot: the event name, time and page path, with the visitor's email address, so HubSpot can add the event to that contact. An event is sent only if the visitor allowed marketing cookies and Whence knows their email address. With form capture turned on, Whence records that a HubSpot form was sent and which one, never the answers; the email address typed in it is kept only under the same rules as any email typed on your store.
• Zapier: when a visit shows signs of frustration, is ranked as one to watch, or triggers a key event, Whence calls the Zapier address you entered with the visit and visitor identifiers, the page, the signals and the event name. Never an email address, phone number, name or amount.

These tools are not Whence subprocessors. They are recipients you choose: you have your own agreement with each of them, and each uses the data under its own terms with you. You can turn each one off at any time. Data already sent stays with the tool, and requests to erase it must be made there.

AI summaries

If you ask Whence for an AI summary of a visitor, facts from that visitor's visits in your store (page addresses, sources, devices, countries, order amounts, and on-page events such as the label of a clicked button) are sent to the AI model provider listed on the subprocessors page. Whence does not send the email addresses, phone numbers or names it holds, nor text typed into form fields. No summary is written before that provider's notice period has ended.

If someone on your team asks Whence a question, or uses a quick AI action (such as Performance summary, Frustration summary or Conversion changes), the same provider receives the question, or the fixed wording of the action, together with the evidence Whence has already computed for your store: the open problems it detected (their type, page, severity, how many visits they affected and the identifiers of a few of those visits), the latest daily report (numbers of analyzed visits and of each frustration signal), and, for traffic actions, visits by source for the last two weeks (visits, carts, checkouts, time on site, pages, countries and devices). No email address, phone number, name, text typed into form fields or order amount is sent. When the person asking does not have the Revenue & orders permission, nothing derived from orders is sent either: no abandoned checkout or cart counts and no scores that take purchases into account.

Where it is stored

Recordings and account data are held on infrastructure operated by our subprocessors, listed in full with their locations on the subprocessors page. The database runs in Frankfurt, Germany. Recordings are stored by Cloudflare in a bucket restricted to the European Union. The website and the network layer are served from Cloudflare's global network.

Frondia LLC is a company in the United States. Its staff and some of its subprocessors access the data from the United States. For data from the European Economic Area, the United Kingdom and Switzerland, these transfers rely on the standard contractual clauses incorporated into our data processing agreement.

How long it is kept

• Recordings and visits are deleted automatically at the end of your plan's retention period, shown on the pricing page and in your settings, or earlier if you choose a shorter period. Deletion covers the stored recording and the database records that point to it.
• Cart and checkout events from the Whence web pixel, with the advertising cookies they carry, are deleted after 90 days.
• Recognized visitors: the salted hash of the identifier set by the store's server, and the click identifiers and utm tags of the first and latest paid visit, used to credit an order to the ad click that brought the visitor, within the attribution window you choose (7 to 90 days, 30 by default). The hash is deleted 13 months after the first visit, the click identifiers after 90 days.
• AI summaries are deleted on the same schedule as your recordings.
• In-app notifications (the bell) are kept for 90 days, then deleted. They are never kept longer than your recordings, and those that describe a visit are exported and erased with the visitor's data.
• Clicks, scroll depth, form analytics, page speed and events are deleted on the same schedule as your recordings, and so are the daily counts per page built from them. Events you define in Whence are settings: they stay until you delete them or the store is deleted.
• Survey answers and the daily counts of surveys and announcements are deleted on the same schedule as your recordings, and an answer is deleted with the visit it belongs to. The surveys and announcements you write are settings: they stay until you delete them or the store is deleted.
• Orders, abandoned checkouts and contacts imported from your store are kept while the store is connected to Whence. When you disconnect the store or uninstall the Shopify app, they are deleted within a day.
• Privacy requests and what was done about them are kept for 12 months, so you can show a request was answered.
• Consent records are kept for 24 months, then deleted. Whence no longer collects new ones, as it reads the consent your store collects; each record already collected states a visitor's choice: the choice itself, how and when it was made, the banner layout shown, the region and country, the page path, the version of the texts and the visitor identifier. Keeping them longer than the choice itself lasts lets you show a visitor's consent if it is ever questioned. They do not include the network address or the browser's user agent.
• When your account is canceled, we keep its data for 30 days so that an account closed by mistake can be restored, then delete all of it: stores, visits, recordings, orders, contacts, settings, and the sign-in of every user who belongs to no other Whence account.
• When you uninstall the Shopify app, Shopify also asks us, 48 hours later, to erase the store's data, and we do.
• Your account and billing records are kept for as long as you have an account. Invoices and payment records are then kept only as long as tax and accounting law requires.

Answering your visitors and customers

If one of your visitors or customers asks you for their data or asks you to erase it, you can answer from the Privacy requests section of your Whence settings. Search for the person by email address, phone number, first and last name, visitor identifier or order number: Whence shows what it holds about them in that store, lets you download it as a JSON or CSV file, and lets you erase it. Erasure covers their visits and recordings, the clicks, form analytics, page speed measures and events measured during those visits, checkout events, contact record, AI summary, consent records, the in-app notifications that describe their visits and the link between their orders and their visits; the order amounts stay in your figures without anything that identifies the customer. An erasure that cannot remove every part fails visibly rather than reporting success.

If you turned on sending captured contacts to your Shopify customers, erasing a person in Whence also erases the record that their contact was sent, but it does not delete the customer Whence created in your Shopify store: that customer belongs to your store. Erase it in Shopify too if the person asks.

When a Shopify customer asks for their data or for its erasure, Shopify tells Whence. An access request appears in your Privacy requests section with its due date; an erasure request is carried out automatically in that store. Answer each request within one month. Data already sent to an ad or email platform must be erased with that platform.

For data we hold about you as a customer, write to contact@usewhence.com.

Your rights

Depending on where you live, you may have the right to access the data we hold about you, correct it, have it deleted, object to how it is used, or receive it in a portable form. Write to contact@usewhence.com and we will answer within one month. If you are in the European Economic Area or the United Kingdom and you are not satisfied with our answer, you may complain to your national data protection authority.

If you are a visitor to a store using Whence rather than one of our customers, the store is the controller of your data. Contact the store directly; if you cannot reach them, write to us and we will forward your request.

Security

Traffic is encrypted in transit. Recordings are stored in a private bucket, not on a public address. Your team's access runs through database rules that limit each account to its own stores. Background jobs that need wider access run only on our servers, with credentials that are never sent to a browser. Access to production systems is limited to those who need it.

If you believe you have found a vulnerability, write to contact@usewhence.com before disclosing it publicly. We will not pursue anyone who reports a genuine issue in good faith.

Changes

If we change this page in a way that materially affects what we do with your data, we will tell you by email before the change takes effect. The date at the top always reflects the current version.

Contact

Frondia LLC, New Mexico, United States. contact@usewhence.com.