ResultsAiX Optimize measures how visitors use your pages without knowing who they are. This article lists exactly what is stored, where it lives and how long it stays, so you can describe it in your privacy policy.
Where to find it:
AiX Optimize, Settings, in the sections Tracking, Session replays and Privacy & retention.
Where the data lives:
Everything is stored in your own WordPress database. The tracker, on this site and on any page with your one line of code, sends its data to your own WordPress site only. Nothing goes to any other service, unless you connect your own AI key, which sends report numbers and page text to your AI provider when you press an AI button.
The two cookies:
- rao_vid: a random visitor id, kept for one year. It ties a visitor's views and conversions together.
- rao_a: which version of each test this visitor was given, kept for 180 days, so they see the same version every time.
Both are first-party cookies set by your own site. There is no fingerprinting.
On a page on another of your sites, the one line of code sets the same two cookies on that site and keeps a copy in the browser's local storage. With Recognise the same visitor across my sites on (Your sites tab), links between your own sites carry the visitor id and versions in the address, and Buy links carry the visitor id to the checkout so the sale is credited. These are random codes, never a name or an email address.
What is recorded:
- For each test: which version a visitor saw, their device type, a rough traffic source (paid, email, social, organic, referral or direct), and their conversions, leads and sales.
- At the end of a page view: seconds on the page, deepest scroll, clicks, rage and dead clicks and video progress.
- For heatmaps: click and mouse positions, scroll depth and seconds per part of the page, added together per page. A heatmap holds no visitor ids.
- For replays: a snapshot of the page, the cursor, scrolling and clicks. Text typed into forms is always shown as dots.
IP addresses:
Visitor IP addresses are never stored. While a beacon is received, the address is turned into a scrambled code used only to limit how many messages one address can send in a minute, and that code expires after a minute.
Who is never counted:
- Never count logged-in editors and administrators: on by default.
- Ignore bots, crawlers and link previews: on by default.
- Respect the browser's Do Not Track signal: off by default. Tick it to leave out visitors whose browser sends Do Not Track.
Masking replays:
Also mask all page text in replays (for pages showing personal data) turns every letter of page text into a block in replays. You can also switch Record session replays off completely.
Retention: what is kept and for how long:
Delete raw events and replays older than (days) is 90 by default, from 7 to 730. A daily clean-up removes per-visitor events, replays (except starred ones) and heat data from pages with no visits in that window. Test totals, such as each version's visitors and revenue, are kept. AI job records are removed after 180 days.
Consent banners:
If your site waits for consent before tracking, a developer can hold the tracker back with the rao_tracking_allowed filter: return false until the visitor agrees. Mention the rao_vid and rao_a cookies in your cookie policy.
A real example:
Yoursite Bakery School's privacy policy says: our site uses two first-party cookies, rao_vid and rao_a, to test page versions and measure how pages are used. We do not store IP addresses, form typing is never recorded, and visit details are deleted after 90 days.
Tips:
- Keep Never count logged-in editors and administrators on, so your own visits never move a result.
- On sites with members' pages, you can switch Record session replays off for those visitors' peace of mind.
- The Danger Zone in Settings removes all data at once. See The Settings Tab: Tracking, Replays, Privacy And Appearance.