Privacy Policy

Splitlab is a product of SB RESEARCH CORP. This policy covers everything we make under the Splitlab name:

• the web app at app.splitlab.io

• the Splitlab JavaScript snippet our customers install on their own websites

• the Splitlab Visual Editor browser extension

• our public API, the Splitlab MCP server, and the @splitlabio/nextjs-orchestrator SDK

It explains what we collect, what we do with it, where we keep it, who else sees it, and what you can ask us to do about it. We have written it in plain English rather than legal boilerplate.

1. Contacting us

SB RESEARCH CORP (trading as Splitlab) 1914 Thomes Ave, Ste 2 3040 Cheyenne, WY 82001 United States

Privacy questions and data rights requests: privacy@splitlab.io Everything else: team@splitlab.io

You can also write to us at the address above.

2. Two different relationships

How this policy applies depends on who you are, so it is worth sorting that out first.

If you have a Splitlab account, we are the controller of your data. You signed up, you log in, we bill you, and we decide what we collect and why. Sections 4 through 8 are about you.

If you visited a website that happens to use Splitlab, we are only a processor. The website owner decides what gets collected and why. We handle it for them, under their instructions. Section 9 is about you, and the short version is that your rights sit with the website owner rather than with us.

3. The browser extension

Our customers use the Splitlab Visual Editor extension to edit their own websites. Here is exactly what it does.

What it collects

Nothing personal, and no browsing data.

It does not read or record the pages you visit. It does not keep a history, build a profile of you, or look at any page other than the one you have deliberately opened for editing.

What it touches, and when

Nothing happens until you ask it to. When you install it, the extension has access to no website at all. Choose a campaign, click Edit, and your browser asks whether you will allow it on that one site. Only then does the editor appear. You can take that permission back whenever you like from your browser’s extension settings.

One small exception, on our own site. A tiny script runs on app.splitlab.io. Its whole job is to answer one question for our web app: is the extension installed? It reads nothing from the page and sends nothing anywhere.

Signing in. The extension uses the Splitlab session you already have in your browser. It never asks for your password and never sees it.

What stays on your computer. Your interface preferences, plus a short-lived editing token that your browser throws away when you close it.

What gets sent to us. Only the work you save on purpose: the edits you made to your own page, which campaign and variant you saved them to, and any images you chose to upload. That goes to our API so it can be stored against your account.

Seeing your teammates. While you are editing, you can see the cursors and names of colleagues working on the same variant, and they can see yours. That is sent live between browsers so you do not overwrite each other’s work. We do not record it.

What it never does

We do not sell extension data or hand it to anyone else. We do not use it for anything other than what the extension is for, which is building and editing A/B test variants. We do not use it to work out creditworthiness or for lending. There is no advertising in it, no analytics tracking, and no remote code: every line it runs shipped inside the package you installed.

4. What Splitlab does, so you can see why we need anything

It helps to know what the product actually does before reading a list of data. Splitlab lets our customers:

• Run A/B and multivariate tests on their own websites, splitting traffic between different versions of a page

• Build those versions visually, either in the web editor or the browser extension, without writing code

• Allocate traffic between versions by percentage, or let our multi-armed bandit shift traffic towards whichever version is winning

• Target who sees a test, by country, device, traffic source, returning versus new visitor, and similar rules

• Measure results using conversion rate, revenue per visitor, average order value, custom events, and guardrail metrics that flag when a test is doing harm

• Track conversions and revenue, including purchases and bookings

• Capture and attribute leads, connecting a sign-up or a purchase back to the test version that produced it, even across several visits and devices

• Import data from tools they already use, such as ClickFunnels, Calendly and Cal.com

• Work as a team, with organisations, workspaces, roles and invitations

• See an audit log of significant changes made in their account

• Connect programmatically through our API, our MCP server, and our Next.js SDK

5. What we collect about account holders

We never see your full card number. Our payment processor collects and holds that. All we get back is a token, the last four digits, and the expiry date.

Sensitive fields are encrypted where they are stored. That includes two-factor secrets and the access tokens for any service you have connected.

6. What we do with it

• Run the service you signed up for

• Check it is really you, and keep your account safe

• Bill you, and deal with payments that fail

• Send you service messages: invitations, security alerts, billing notices, and campaign reports you have asked for

• Help you when you ask

• Spot and stop abuse

• See which features people actually use, so we know what to improve

We do not sell your data. We also do not use your data, or your visitors’ data, to train machine learning models for anyone else. Our bandit algorithm optimises each customer’s own tests using only that customer’s own results.

Our legal bases, if you are in the UK, EU or EEA

• Contract: running the service, billing you, supporting you

• Legitimate interests: security, preventing abuse, improving the product

• Consent: optional marketing email, and only where we have asked you

• Legal obligation: tax and accounting records

7. Product analytics

We use a product analytics tool inside app.splitlab.io to see how the app gets used, such as which screens people open and what they do there. It is tied to your account.

It is not on our customers’ websites, and it is not in the browser extension.

8. Communication choices

We will always send you messages that are part of the service: security alerts, billing notices, invitations, and anything we are legally obliged to tell you. You cannot opt out of those while you have an account.

Anything promotional has an unsubscribe link, and you can turn scheduled campaign reports on and off in your account settings.

9. If you visited a website that uses Splitlab

This section is for you if you are not a customer and have landed here because a site you visited runs our snippet.

Depending on how the site owner has set things up, we may handle:

• A random visitor ID, kept in a cookie called mvt_visitor_id. It recognises a returning browser. It does not know who you are.

• A session ID, the page address, where you came from, and how long the page stayed open

• Your browser’s user-agent string, language, and rough device type

• Your IP address, which we use to work out an approximate country and for security. We do not build a picture of where you go.

• Which version of a test you were shown, so it stays the same on your next visit and so the results add up

• Click identifiers that arrive in the page address from advertising platforms, such as fbclid, used to reconnect a visit that would otherwise be counted twice

• Only if the site owner turned it on: contact details you typed into that site’s forms, such as your name, email address and phone number

• Only if the site owner connected a commerce or booking tool: purchases and bookings, including the amount, the currency, and what was bought, so they can see which version led to a sale

Joining visits together

To measure a test honestly, the site owner needs to know that the person who saw version B on Monday is the person who bought on Friday. We connect those visits using the visitor ID above and, where the site owner has enabled it, an email address. That connection is scoped to that site owner’s account. We never merge visitor data across different customers.

The site owner decides all of this, not us

We are working on their behalf. If you want to see, correct or delete that data, or object to any of it, go to the owner of the website you visited. If you write to us instead, we will pass your request along to them.

Cookies and consent on those websites

Splitlab can be set up so that it does nothing at all until a visitor agrees. When the site owner switches that on, our snippet sets no cookies and sends no data until consent is given through that site’s banner.

Whether it is switched on is the site owner’s choice, and getting consent where the law asks for it is their responsibility.

10. Who else sees your data

We share data only with companies that process it for us, under contract, for the reasons below. We do not sell personal data to anybody.

We also connect to other services when you tell us to, so we can bring in data you have asked for: ClickFunnels for orders and contacts, Calendly and Cal.com for bookings. Those connections only exist if you set them up, and you can disconnect them at any time.

We may also have to hand over data when the law requires it, or to bring or defend a legal claim. If the business is sold or merged, data may transfer as part of it, and we will tell you before that happens.

11. Links to other sites

Splitlab shows links to websites we do not run, including our customers’ own sites and the services listed above. We are not responsible for what they do with your data, and this policy does not cover them.

12. Where it lives, and how long we keep it

Everything sits on Microsoft Azure infrastructure in [CONFIRM: REGION]. When data moves outside the UK or EEA, we rely on the UK International Data Transfer Agreement and the EU Standard Contractual Clauses.

How long we keep things:

• Account data: while your account is open. After you close it, you have 30 days to export, and we then hold the data for a further 180 days in case you come back, after which it is permanently deleted.

• Visitor and test data: for as long as the campaign exists. Deleting a campaign or a workspace deletes the test and visitor data belonging to it.

• Audit and security logs: [CONFIRM: PERIOD]

• Billing records: as long as tax law requires, usually seven years

13. Children

Splitlab is a business tool. It is not aimed at anyone under 18, and we do not knowingly collect anything about them. If you think we have, tell us at privacy@splitlab.io and we will delete it.

14. Keeping it safe

• Everything in transit is encrypted with TLS

• Sensitive fields, including two-factor secrets and third-party access tokens, are encrypted where they are stored

• Passwords are hashed, and nobody can read them back, including us

• Access to production systems is limited and logged

• Our own internal services authenticate to each other in both directions

• Network access between internal systems is restricted to what each one needs

No system is perfectly safe and we are not going to pretend otherwise. If a breach affects your personal data, we will tell you and the regulator as quickly as the law requires.

15. If you are in Europe or the UK

You can ask us for a copy of your data, ask us to correct or delete it, tell us to stop or limit what we are doing with it, ask for it in a portable format, object to processing we base on legitimate interests, or take back a consent you gave.

Email privacy@splitlab.io and we will answer within one month. You can also complain to your local supervisory authority. In the UK that is the Information Commissioner’s Office.

16. If you are in California

Under the CCPA and CPRA you can ask what personal information we collect and why, ask for a copy, ask us to delete or correct it, and opt out of sale or sharing.

We do not sell or share personal information in the way those laws define it, and we do not use it for cross-context behavioural advertising. We will not treat you differently for exercising any of these rights.

To make a request, email privacy@splitlab.io.

California Shine the Light

We do not share personal information with third parties for their own direct marketing, so there is nothing to disclose under this law.

17. If you are in another US state

If you live in Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Texas, Florida, Montana, Oregon, Delaware, New Hampshire, New Jersey, Kentucky, Nebraska, Rhode Island, Minnesota or Maryland, your state gives you broadly the same rights: to know, to get a copy, to correct, to delete, and to opt out of targeted advertising, sale, and certain profiling.

We do not sell personal information, we do not use it for targeted advertising, and we do not make automated decisions with legal effects about you.

Email privacy@splitlab.io to exercise any of these. If we turn a request down, you can appeal by replying to our response, and you can complain to your state attorney general.

18. Updates to this policy

We will update this page when the way we work changes, and we will move the date at the top. If a change genuinely affects you, we will tell you by email or in the app before it takes effect, rather than quietly editing the page.