All data stays in your own WordPress database. Nothing is sent to a third party unless you connect your own AI key, and then only page copy and totals are sent, never individual visitor records.
The cookies:
Two first-party cookies are set.
- rao_vid. A random visitor id with no personal meaning. It lasts one year.
- rao_a. Which version of each test this visitor was given, so they see the same one next time. It lasts 180 days.
There is no fingerprinting. Mention both cookies in your cookie or privacy policy.
What is recorded:
- For tests: that a visitor saw a version, their device type (desktop, mobile or tablet), a broad traffic source (paid, email, social, organic, referral or direct), any conversion with its value, and a summary of the visit: seconds on the page, scroll depth, clicks, rage clicks, dead clicks and how much of a video was watched.
- For heatmaps: grouped totals per page area, not a record per visitor.
- For replays: a page snapshot with scripts removed and form fields emptied, plus cursor, scroll and click positions. Typed text is only ever stored as dots.
IP addresses:
IP addresses are never stored. A salted hash of the address is held for about a minute to limit how fast one source can send data.
Who is left out:
By default, logged in editors and administrators and known bots, crawlers and link previews are never counted. Feeds, previews of unpublished content and "not found" pages are skipped too. "Respect the browser's Do Not Track signal" is available in Settings under Tracking and is off by default.
How long data is kept:
"Delete raw events and replays older than (days)" is 90 by default and can be set from 7 to 730. The screen explains: "Test totals are kept forever; only the per-visitor detail and replays are purged by the daily cleanup." Starred replays are kept. The AI job log is kept for 180 days.
Replays on sensitive pages:
Tick "Also mask all page text in replays (for pages showing personal data)" to replace every character of page text in new replays, or switch replays off.
Consent banners:
A developer can hold back the tracking script, which covers engagement, heatmaps and replays, until the visitor agrees. The Training tab names the filter under Privacy. On a page with a running test, the version is still chosen on the server and the two cookies above are still set, so account for that in your consent setup.