Privacy policy

Who we are

Soran provides marketing attribution and analytics software to ecommerce businesses and the agencies that serve them. This policy explains what personal data we handle, why we handle it, and what rights you have over it.

Questions about this policy, and any request to exercise the rights set out below, go to marketing@soran.ai. We answer every one of them, and the address is read by a person.

The two roles we play

Almost every question about this policy resolves once you know which of two positions Soran is in, because they are governed differently.

• For your account, we are the controller. We decide what to collect about the people who sign in to Soran and why, and this policy is the full description of that.
• For your store's data, we are the processor. The events, orders, and customer records you send us belong to your business. You decide what is collected and why; we act on your instructions and nothing else. Those terms are in the data processing agreement.

If you are a shopper who visited a store that uses Soran, that store is the controller of your data and not us. See If you shopped at a store that uses Soran below.

Data we process on our own behalf

When you or your colleagues use Soran, we handle the following about you.

• Identity and contact data. Name, email address, and the organizations and properties you belong to. We need it to give you an account and to contact you about the service. Without it there is no account to give.
• Authentication data. Password hashes, session records, sign-in times, and the tokens behind any connection you authorize. We need it to let you in and to keep everyone else out.
• Billing data. Plan, subscription status, and invoice history. Payments for Shopify stores are processed by Shopify, and card details never reach our systems. We need this to charge for the service and to meet our accounting obligations.
• Support correspondence. Messages you send us by email or through the support chat, kept so that we can answer you and so that the next person to help you can see what was already said.
• Product and diagnostic data. Which screens are used and what errors occur, so we can find faults and decide what to build. We keep this to the minimum that answers the question.

Where the law requires a lawful basis, ours is the performance of our contract with you for the first three, and our legitimate interest in supporting, securing, and improving the service for the last two.

Data we process on your behalf

When you connect a store or install the tracker, Soran receives data about your visitors and customers. We hold it for you, and we do not use it for our own purposes, sell it, or use it to train models.

• Behavioural events. Pages viewed, products viewed, cart actions, checkouts started, and purchases, with the page, referrer, device, and approximate location each one arrived with.
• Order records. Order totals, line items, discounts, refunds, and currency, taken from your store.
• Customer records. The identifiers your store attaches to an order, which may include an email address, a name, and a customer reference, used to recognise a repeat buyer as one person.
• Marketing data. Campaign, ad set, and ad names, spend, and click identifiers pulled from the ad accounts you connect.

You decide how long this is kept, and you can delete a property and everything in it at any time.

Identifiers the tracker sets

On a store that has installed Soran, the tracker stores a small number of first-party values in the browser. They are readable only by that store's own domain, they are not used for advertising, and they are never combined across the stores of different customers.

• soran_distinct_id identifies the browser so that repeat visits can be recognised as the same person.
• soran_session_id groups activity into a single visit.
• soran_click_ids and soran_fbc hold the click identifiers an ad platform added to the link that brought the visitor in, so an order can be matched back to the ad that produced it.

Whether these are set, and whether consent is collected first, is decided by the store you are visiting.

Cookies on soran.ai

Our own website and app set only what they need to work. A sign-in cookie keeps you logged in and tells the site whether to show you the marketing page or your dashboard. Our support chat sets a cookie so that a conversation survives a page reload. We do not run advertising cookies on our own site.

The Soran AI assistant

When you ask the assistant a question, the question and the report data needed to answer it are sent to a model provider listed below. The assistant is scoped to the property you have open, so it can only reach that property's data.

Our providers are contractually bound not to train their models on what we send them. If you would rather no data left for a model at all, the assistant can be left unused and the rest of the product is unaffected.

Sending data to ad platforms

Soran can send conversions back to an ad platform, but only for a destination you have set up yourself, and only for the conversions the goal you chose already counts. What leaves is the conversion, its value, and the identifiers needed for the platform to match it to a click.

You are responsible for having a lawful basis for that transfer, including any consent your visitors need to give. You can switch a destination off at any time, which stops the sending immediately.

Who else handles the data

We use the following providers to run the service. Each one is bound by a contract that limits what it may do with the data, and we do not sell personal data to anyone.

We may also disclose data where the law requires it, and to a buyer or successor if the business is sold, in which case this policy travels with it until it is replaced by one no less protective.

International transfers

Some of the providers above are outside the European Economic Area. Where data moves there, the transfer is covered by the European Commission's standard contractual clauses together with the additional measures those clauses require. A copy is available on request.

How long we keep it

Nothing here expires on a timer. Data goes when the thing it belongs to goes, which means you decide the timing in every case that matters.

• Store data lives as long as the property that holds it. Delete a property and its events, orders, and customer records go with it. Close your account and all of them go.
• Account data is kept while your account is open, and deleted when you close it apart from what we are required to keep.
• Support messages are kept while they are useful to answering you, and deleted on request.
• Billing records are kept for as long as tax and accounting law requires us to keep them, which is longer than the rest and is not ours to waive.

Backups age out on their own cycle, so a deletion takes a short while to work through every copy. Nothing is restored from a backup into live use after you have asked for it to go.

How we protect it

Data is encrypted in transit and at rest. Access inside Soran is limited to the people who need it to do their job and is logged. Each property is scoped separately, so one customer's data cannot be reached from another customer's account. Credentials for connected platforms are stored encrypted and are never shown back to you in full.

Your rights

If you have a Soran account, you can ask us to give you a copy of your data, correct it, delete it, hand it over in a portable form, restrict what we do with it, or object to a use that rests on our legitimate interest. Write to marketing@soran.ai and we will answer within one month.

If you are in the European Economic Area or the United Kingdom you may also complain to your data protection authority. We would rather you came to us first, but that is your right and not ours to grant.

If you shopped at a store that uses Soran

Your data reached us because that store asked us to hold it. The store decides what is collected and for how long, which makes the store, and not Soran, the right place to send a request about it.

Write to the store you visited. If you write to us instead we will pass it on to them, and we will act on their instruction as soon as we have it.

Children

Soran is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16 on our own behalf. If you believe we hold such data, tell us and we will remove it.

Changes to this policy

When this policy changes we update the date at the top of the page. If a change materially affects you, we will tell you by email or in the app before it takes effect rather than leaving you to notice.