ob.session is a behavioural recommender that runs on merchant storefronts to personalize what shoppers see. We are built around a single principle: personalization should not require identification. We hold no shopper's name, email address, phone number or account link, and we do not retrieve a merchant's customer records.
For shopper data we act as a processor on the merchant's behalf under GDPR; this page summarizes, in plain language, what our App Privacy Policy and Data Processing Agreement say in full. Our security questionnaire responses are available on request at legal@ob-session.com.
§1 · What we process on behalf of merchants
When ob.session is installed on a storefront, we process the following categories of data on the merchant's behalf:
- Pseudonymous identifiers — random identifiers for the visitor and the session. Never linked to a customer account, scoped to a single store.
- Interaction signals — how the shopper interacts with pages and products.
- Content and commerce context — the products, collections, and on-storefront cart context involved, and where a recommendation appeared.
- Navigation and traffic context — page type, navigation path, referrer, campaign parameters. URLs are recorded path-only.
- Search signals — store search terms, used as an intent signal, never to identify a shopper.
- Device and locale characteristics — basic properties of the shopper's device, browser, and locale.
- Catalog data — the merchant's products, collections and variants, synced read-only from Shopify.
- Order records — order-level records used for attribution, billing, and training the merchant's model, together with the association between an order and the pseudonymous identifier of the visitor it is attributed to. No customer fields (name, email, phone, address, or Shopify customer ID) are ever requested or stored.
Three properties apply:
- Storefront collection follows the store's own consent settings. The script collects only where Shopify's Customer Privacy API reports that the processing is permitted for that shopper. In a region the merchant has configured to require consent, nothing is collected and no identifier is set until the shopper consents. In a region the merchant has not configured that way, the API reports that processing is permitted by default and the script collects on that basis. Where the API is unavailable or returns no signal, the script does not collect. Order records are the exception: they are read from the store through Shopify's Admin API rather than from the storefront, so they are read for every order while the app is installed.
- A visitor is remembered for up to a year, and never by name. The visitor identifier is random, host-only, scoped to one store, and retained up to 365 days on a rolling basis; session and per-tab identifiers expire with the session or the tab. Shorter-lived configurations — session-only, or cleared when the tab closes — are available on request; where agreed, the configuration is recorded for that store in the app admin and forms part of Annex 1 of the merchant's Data Processing Agreement.
- The script stays in its lane. Our first-party storefront script operates only on permitted catalog pages and does not read account, checkout, or form-input fields.
Collection runs while the app is installed and its storefront extension is enabled in the theme. It is independent of whether recommendations are currently switched on: turning recommendations off stops them reaching shoppers and stops billing for them, and collection continues so the store's model stays current. Disabling the extension in the theme stops all storefront collection; order records continue to be read until the app is uninstalled. Uninstalling stops all collection.
Full category descriptions are in our Privacy Policy and in Annex 1 of our Data Processing Agreement. We do not publish our internal field list or derived feature set.
§2 · What we don't process
- No directly-identifying information. No names, email addresses, phone numbers, or postal addresses of shoppers.
- No payment or credential data. No payment details, no account credentials. Order records hold no customer fields.
- No active device fingerprinting. No canvas signals, no audio-context probing, no font enumeration.
- No cross-site tracking. Identifiers are scoped to ob.session and to a single store, and are never shared with third parties for tracking.
- No cross-merchant data sharing. No merchant's catalog, products, orders, or shopper data is ever shared with, or made visible to, another merchant.
- No sale or sharing of data for third-party advertising. We do not sell, rent, or trade merchant or shopper data.
- No IP-based shopper profiling. We do not log shopper IP addresses to identify or profile shoppers. Infrastructure-level access logs may contain IPs for operational and security purposes and are retained for no longer than 30 days.
- No segments or audiences. Personalization is based on each shopper's own on-store behaviour; we do not group shoppers into segments, build demographic profiles, or perform any processing with legal or similarly significant effects (Article 22 GDPR).
§3 · Where data lives
| Infrastructure | Amazon Web Services — our sole sub-processor; all processing runs on AWS-native services |
| Default region | United States (us-east-1) |
| Alternative residency | An AWS region in the European Union, available on request |
| Encryption in transit | TLS on all public endpoints and the event pipeline |
| Encryption at rest | AES-256 for databases, storage and backups |
§4 · International transfers
ob.session is an EU company (Cyprus), and we contract with Amazon Web Services EMEA SARL, which is established in the EEA — so engaging us, and our engaging AWS, is not itself a restricted international transfer.
Our default region is the United States (us-east-1). Where data is processed there, the restricted transfer is the onward transfer from Amazon Web Services EMEA SARL to Amazon Web Services, Inc. We instruct that hosting and remain fully liable to the merchant for it. It relies on AWS's certification under the EU-US Data Privacy Framework (with the UK Extension for UK data) and/or the EU Standard Contractual Clauses with the UK Addendum in our agreement with AWS. A copy of the relevant instrument is available on request.
If the adequacy decision for the EU-US Data Privacy Framework ceases to apply, we will within 30 days either move affected processing to an AWS region in the European Union or tell affected merchants which alternative safeguard we rely on.
Where a merchant opts for EU data residency, no such transfer occurs.
§5 · Per-merchant data isolation
Each merchant's data is processed in isolation:
- All data is keyed by store; a shop-level purge deletes across all tables.
- The recommendation model trained for one merchant is never shared with, or applied to, another merchant, and is deleted on uninstall or on the merchant's request.
- One merchant's catalog, products, orders, and shopper data are never shared with, or made visible to, other merchants.
- Identifiers are host-only and scoped to a single store — they never cross stores, and are never shared with third parties.
Isolation is enforced in the architecture rather than by policy: data is keyed by store at the storage layer, and a model trained for a specific store serves that store alone.
Models that underlie the service generally may be trained on data from more than one store. Where they are, they are built so that they do not reproduce or expose any individual merchant's catalog, products or shoppers, and the recommendations served to a merchant are drawn only from that merchant's own catalog. A merchant that requires a stricter commitment can agree one with us in writing.
§6 · Security measures
The technical and organisational measures we commit to contractually (GDPR Art. 32, DPA Annex 2):
- Consent gating — storefront collection runs only where Shopify's Customer Privacy API reports that the processing is permitted for that shopper, and does not run where that signal is absent (§1).
- Pseudonymisation and minimisation by design — randomly generated identifiers; no customer-identifying fields requested; order queries restricted to financial and attribution fields; URLs recorded path-only.
- Encryption — TLS in transit; AES-256 at rest.
- Least-privilege access — restricted to personnel who require it; secrets in a managed secrets store; access events logged.
- Tenant isolation — see §5.
- Fail-safe by design — if a recommendation cannot be served within the time limit, the merchant's default content is served, so a service interruption cannot break a page or checkout.
- Operational security — environment separation between development and production; dependency management and patching.
- Retention enforcement — deletion on a defined schedule (§7).
- Breach management — procedures to detect, investigate, mitigate and notify (§10).
§7 · Retention and deletion
Shopper data is retained only as long as needed for the purpose. Maximum periods:
| Data | Retention |
|---|---|
| Recommendation state — the pseudonymous record of a visitor's activity used to personalize their visits, and the current cart | Up to 365 days |
| Behavioral event data, A/B measurements and test assignments | Up to 12 months (rolling) |
| Derived behavioral signals and recommendation inferences | Up to 365 days |
| Attribution records (visitor identifier ↔ order ID) | Up to 12 months, and deleted on a customers/redact request for the order |
| Order records (billing, attribution, model training; no customer fields) | Up to 24 months, or earlier on a customers/redact request. Financial fields evidencing a fee charged to a merchant are kept for as long as accounting and tax law requires |
| On-device identifiers, consent state and pending-event queue | Up to 365 days for the visitor identifier; session identifier expires after 60 minutes of inactivity or with the session; per-tab identifier cleared when the tab closes; pending events discarded if unsent after 7 days |
| Infrastructure access logs (may contain IPs) | Up to 30 days |
| Records of access to shopper data by our personnel | Up to 12 months |
| Catalog/config and model artefacts | While the App is installed; deleted on uninstall |
Where a merchant has agreed a shorter-lived identifier configuration with us (§1), the first, third and sixth rows shorten accordingly. Deletion extends to backups on the next backup cycle, and in any event within 35 days of the deletion being actioned.
On uninstall, all of a merchant's data is deleted within 30 days of uninstallation, following Shopify's shop/redact request. We honour Shopify's customers/data_request and customers/redact compliance webhooks, and where a merchant gives us an order ID or a pseudonymous visitor identifier we will locate, export or delete the associated records within 30 days. Aggregated or anonymised data that can no longer be linked to any device or shopper is not personal data and may be retained.
Merchants may request export or deletion of their data at any time at legal@ob-session.com; exports are provided in a structured, machine-readable format within 30 days. A merchant that wants its data returned should ask before uninstalling, because uninstalling triggers deletion.
§8 · Sub-processors
We rely on a single sub-processor:
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services | All cloud infrastructure | United States (default us-east-1); an AWS region in the European Union on request |
Shopify is the platform on which the App runs and is an independent party with its own agreement with the merchant — not our sub-processor. We engage no other sub-processor, and we do not send shopper data to any third-party or third-party-hosted model API. The current list is Annex 3 of our Data Processing Agreement at ob-session.com/legal/dpa; merchants receive at least 30 days' notice of a change, with an opportunity to object.
This page covers the App. The ob-session.com marketing website is operated separately and uses its own processors, described at ob-session.com/privacy.
§9 · Compliance posture
| Operating entity | OBSESSION ECOMMERCE DATA TOOLS LTD, registered in Cyprus (Reg. no. HE 496073) |
| Supervisory authority | Office of the Commissioner for Personal Data Protection (Cyprus) |
| GDPR role | Processor for shopper data (Art. 28 DPA, entered into at install); controller only for merchant account contacts |
| International transfers | See §4 — AWS Data Privacy Framework certification and/or Standard Contractual Clauses with AWS |
| US state privacy laws | We act as a service provider; we do not sell or share personal information (CCPA/CPRA) |
| Automated decision-making | None with legal or similarly significant effects (Art. 22 GDPR) |
| SOC 2 Type II / ISO 27001 / other formal attestations | Not currently certified. Our infrastructure provider maintains its own certifications, which cover the infrastructure layer only and are not a substitute for the controls we are responsible for. We are happy to walk through those controls on request. |
| UK representative (Art. 27 UK GDPR) | ASAO DS LTD, 86-90 Paul Street, London EC2A 4NE, United Kingdom (company number 15072782) |
| Data Processing Agreement | Published at ob-session.com/legal/dpa; questions to legal@ob-session.com |
§10 · Vulnerability disclosure and incident response
Reporting a vulnerability. Security researchers may report vulnerabilities to legal@ob-session.com. We commit to:
- Acknowledging your report within 5 business days.
- Investigating in good faith and keeping you informed of remediation progress.
- Treating good-faith security research as authorised and not subject to legal action — provided you have not accessed data beyond what is necessary to demonstrate the vulnerability, have not disrupted service, and have given us reasonable opportunity to remediate before any public disclosure.
Personal data breaches. For shopper data we process on a merchant's behalf, we notify the affected merchant without undue delay after becoming aware of a personal data breach — within 72 hours, and in sufficient time for the merchant to meet its own Article 33 deadline — with the information the merchant needs for its GDPR Article 33/34 notifications, and we cooperate with the merchant's response. For the limited data we hold as a controller (merchant account contacts), we notify the supervisory authority and affected individuals as Articles 33/34 require.
§11 · Contact
One address covers all of it — security questionnaires, vendor risk reviews, vulnerability reports, sub-processor inquiries, data subject requests, privacy questions, and Data Processing Agreement and legal correspondence: legal@ob-session.com.
OBSESSION ECOMMERCE DATA TOOLS LTD Nikola Tsadioti, Pearl Park Block 6, Apartment 115 8035 Paphos Cyprus Reg. no. HE 496073