SessionSift privacy policy

Last updated: 17 October 2026

SessionSift ("the app") is provided by Elektraset, s.r.o. ("we", "us"). It helps Shopify merchants see which storefront sessions are automated (bots), report their traffic without those sessions and, if the merchant chooses, pause supported marketing pixels for sessions classified as bots. This policy explains which data the app processes, for whom and for how long.

Contact: help@elektraset.com · https://elektraset.com/

Roles

• For storefront visitor data, the merchant who installs SessionSift is the controller and we are a processor that acts on the merchant's instructions.
• For merchant account data (shop domain, plan, settings), we are the controller.

Data we process

From the merchant's Shopify store (via the Shopify API)

• Shop domain, shop name and whether the store is a development store.
• The app's subscription status from the Shopify Billing API.
• OAuth access tokens issued by Shopify, used only to call the Shopify API for this store.

SessionSift requests only the access scopes write_pixels and read_customer_events, to activate its web pixel. It does not read customers, orders, products or other store data through the Admin API.

From storefront visitors (theme app embed and web pixel)

When the merchant turns on the SessionSift app embed, a small script runs on the storefront. It sends these signals of the current session to the app:

• a random session identifier, kept in a first-party cookie _ss_sid for 30 minutes of inactivity;
• the page address (URL) and the referrer, including campaign parameters such as utm_* and ad click identifiers;
• technical browser characteristics:
  • user agent;
  • screen size;
  • time zone;
  • preferred languages;
  • whether the browser reports automation (navigator.webdriver);
• engagement counts: the number of clicks, taps, key presses and scroll gestures, maximum scroll depth and visible time. No key or form content is ever recorded;
• the visitor's IP address. We use it at receipt to look up the country and network (ASN) and to compute a keyed hash for rate checks. The IP address itself is not stored.

The SessionSift web pixel runs only when the visitor allowed analytics (Shopify Customer Privacy). It sends the session identifier and these shopping events: add to cart, checkout started, checkout completed. With each event it sends the amount and currency, plus the Shopify event or order identifier, which we use only to avoid counting an event twice.

SessionSift does not collect names, email addresses, phone numbers, postal addresses or payment data.

Cookies set on the storefront

When the merchant turns on the event gate and a session is classified as a likely bot, the app sets that session's marketing consent (and, if the merchant chose so, analytics consent) to "not allowed" with Shopify's Customer Privacy API. It does this only to stop advertising pixels from processing automated traffic. The app never grants consent.

Purposes and legal basis

We use the data only for these purposes:

• detecting automated and suspicious traffic;
• showing the merchant reports of raw and clean traffic, conversions per traffic source and reason codes;
• applying the merchant's event gate and Cloudflare rules;
• operating billing.

The legal basis is the merchant's legitimate interest in securing its store and in accurate measurement (Art. 6(1)(f) GDPR), and the performance of our contract with the merchant. The shopping-event pixel relies on the analytics consent that the store collects.

Third parties

• Shopify, which hosts the store, delivers the app embed and the pixel, and processes billing.
• Cloudflare, only if the merchant connects a Cloudflare zone. The app sends rule expressions (country codes, network numbers, the action) to the merchant's own Cloudflare account. It sends no visitor data. The merchant's API token is stored encrypted (AES-256-GCM).
• Our hosting provider, which runs the app server.
• IP Geolocation by DB-IP: free country and ASN databases (CC BY 4.0) are used locally on our server. No data is sent to DB-IP.

We do not sell or share personal data, and we do not use it for advertising.

Retention

• Session details: 7 days (Free), 30 days (Pro) or 90 days (Plus). After that, only aggregated daily counts remain, with no session identifiers.
• Deduplication keys: 7 days.
• After uninstalling the app: Shopify sends a shop/redact request about 48 hours later, and we then delete all session details, daily counts, audit entries, settings and the Cloudflare token of the store. Billing records (plan, amount, dates) are kept for accounting.
• Customer requests: SessionSift stores no customer-identifying data. Shopify's customers/data_request therefore finds no record we could link to a customer. For customers/redact we delete the deduplication keys of the listed orders.

Security

• All traffic uses HTTPS.
• Credentials are stored encrypted.
• Access to the server is restricted to Elektraset staff.

Your rights

Visitors can ask the merchant whose store they visited. Merchants can contact us at help@elektraset.com for access, correction, deletion or objection. You can also complain to your data protection authority; in the Czech Republic that is the Office for Personal Data Protection (uoou.cz).

Changes

We will post changes on this page and update the date above.