Privacy & security

In short

• Collected: a random visitor ID, pages viewed, clicks, scroll depth, add to carts and orders with their value. No names, email addresses or form contents.
• IP addresses: used to serve requests and tell country and bots apart, not kept in Dalton's data.
• Where: EU and UK.
• Roles: you are the controller, Dalton the processor, under our Data Processing Agreement.

This page is for whoever reviews Dalton for privacy, legal or security. The technical reference (every cookie and storage key, consent tools) is Cookies & storage. Allowing Dalton in a strict Content Security Policy is below.

What Dalton collects

Data	Example	Why
Random visitor and session IDs	3f9c… (a UUID)	Count visitors and keep each one in the same test variant
Pages viewed	/products/serum	Know which pages a visitor saw and which test was on them
Clicks	The button or link clicked: its id, classes and link. Not its text.	Click maps and click-based goals
Scroll depth and time on page	70% of the page, 45 seconds	Engagement in results and scroll maps
Add to carts and orders	Order value, currency, order ID	Conversion rate and revenue per variant
Custom events you send	newsletter_signup	Your own goals
Device and browser	Mobile, Chrome, screen size, language	Split results by device
How the visitor arrived	Referring site, UTM parameters	Split results by channel
Country	BE, derived from the IP address	Split results by country
Which tests and variants the visitor saw	Test 1204, variant B	The test results

Not collected: names, email addresses, phone numbers, postal addresses, form contents, payment details, the text of what visitors click or type, and cross-site identifiers. IP addresses are processed by our edge network to serve each request, detect bots and look up the country, and are not kept in Dalton's data. Our edge provider (Cloudflare) may hold them briefly in its logs, then deletes them.

Keep personal data out of your URLs

Dalton stores page paths, including query strings. If your site puts an email address or name in a URL (for example ?email=… on an order confirmation page), Dalton would receive it. This is the same rule Google Analytics applies.

Consent

Dalton follows your consent banner automatically: OneTrust, Google Consent Mode, and the common consent cookies (how). You choose how strictly Dalton waits for it:

	Standard (default)	Consent-first
Tests run	For every visitor	After the visitor accepts
Cookies	Only after consent	Only after consent
Measurement (random IDs, no names or contact details)	For every visitor, so results include everyone	After the visitor accepts
Results	Based on all your traffic	Based on visitors who accept, so tests take longer
How to set it up	Snippet in your <head>	Load the snippet through your consent manager, for example a OneTrust or Google Tag Manager trigger on analytics consent

Which one fits depends on your consent policy. As with any analytics tool, how you classify Dalton in your banner is your decision as the controller; contact us if you want to talk it through. In Standard mode, Dalton keeps a small experiment cache in the visitor's browser storage so each visitor sees one consistent version; the exact entries are on Cookies & storage.

With Consent-first, a tested element can briefly show the original on the first page after the visitor accepts.

Where data is stored

What	Where	Provider
Account data, experiments and results	EU, Frankfurt	Supabase
Event streaming to the database	EU, Frankfurt	Redpanda (AWS)
Visitor events used for analytics and results	UK, London	Tinybird (Google Cloud)
Dalton's API and algorithm	EU	Vercel
Receiving tracking requests at the edge	Global edge, passed on to the EU, no persistent storage of personal data	Cloudflare

The UK has an EU adequacy decision. Other transfers are covered by Standard Contractual Clauses (Module Three, with the UK Addendum), and Cloudflare and Vercel are also certified under the EU-US Data Privacy Framework. Details per provider are on the sub-processor list.

How long data is kept

• In the visitor's browser: cookies for 24 hours. The dalton_device ID in browser storage stays until the visitor clears it.
• On our servers: visitor data is kept for as long as you are a customer, so you can compare results over time. After the contract ends, it is returned or deleted at your choice. Without instructions, visitor data is deleted within 45 to 90 days (DPA, section 6.2).
• Anonymised statistics that no longer relate to any person may be kept, as the DPA allows.

Your role and ours

• You are the controller of your visitors' data. Dalton is your processor and acts only on your instructions, under our Data Processing Agreement.
• Sub-processors are listed publicly. Email team@getdalton.com to be notified of changes; you then have 14 days to object.
• Requests from your visitors (access, deletion) reach you as controller. Dalton passes on any it receives and helps you answer them.
• Audits: we provide documentation and answer security questionnaires. An independent audit is possible with 4 weeks' notice, as set out in the DPA.
• Your privacy notice should mention that you use an A/B testing and analytics tool. Declare Dalton's cookies in your banner as shown in Cookies & storage.
• The Dalton AI (CRO agent, editor agent) works with your pages and aggregated statistics, not with individual visitors' data. It uses models from Google (Gemini), OpenAI and Anthropic; see the sub-processor list.

Security

• Encryption: in transit (TLS) and at rest (AES-256).
• Access: production systems require multi-factor authentication. Access follows need-to-know.
• Testing: continuous security scanning and periodic penetration testing via Aikido. The latest report is available under NDA.
• Policy: a written Data Protection & Security Policy, logging and monitoring of access, backups, and security training for staff.
• Breaches: we notify you without undue delay, with the information you need to inform the authority.
• Certifications: Dalton is not SOC 2 or ISO 27001 certified. Our hosting providers are; see the sub-processor list. We complete security questionnaires on request.
• Insurance: professional indemnity and cyber insurance. Certificates on request.
• Availability: if Dalton is slow or down, your site loads as normal and no test runs. See Reliability.

CSP and firewalls

If your site sends a Content-Security-Policy header (or sits behind a firewall/content filter), allow Dalton's two domains:

Domain	Used for	CSP directive
https://cdn.getdalton.com	Loading the Dalton script	script-src
https://global.dalton-cdn.com	Session & tracking API calls	connect-src

Example policy additions:

Content-Security-Policy:
  script-src 'self' https://cdn.getdalton.com;
  connect-src 'self' https://global.dalton-cdn.com;

For the fastest load, also preconnect to both (Dalton's standard snippet already includes these):

<link rel="preconnect" href="https://cdn.getdalton.com" />
<link rel="preconnect" href="https://global.dalton-cdn.com" />

Trusted Types: if your CSP includes require-trusted-types-for 'script', Dalton (like most experimentation tools) cannot apply DOM changes. Exclude that directive on pages where Dalton runs.

Contact

Privacy or security questions, a questionnaire, or the pentest report: team@getdalton.com. See also our Privacy Policy.