How Variantix handles your data.

What we collect

Three categories, in plain terms:

• Account data. When you sign up we store an email address and, optionally, a display name. If you subscribe we hand billing to Stripe — we never see or store your card number, and the only payment data we retain is the last four digits and the brand of the card on file.
• Experiment data.Visitors to a site running an experiment land on the public redirect endpoint, which writes a per-experiment cookie to pin them to a variant. The cookie holds the assigned variant id; nothing else from the visitor’s session is read or sent to Variantix.
• Operational telemetry. Server logs capture request paths, response codes, and approximate timezone. We use these to keep the service healthy — they are not sold, shared, or used to build a profile of any individual visitor.

What we don’t do

• We don’t sell or rent data. The list above is the list — there is no third-party advertising profile built from it.
• We don’t fingerprint visitors. The variant cookie is the single piece of visitor state, and it is HttpOnly on a per-experiment basis. polsia_exp_<experimentId> carries the assigned variant id and nothing else.
• We don’t train foundation models on your experiment data, your visitors, or your copy. The AI that generates variants runs against the page URL and the goal you set; the page content you point us at is fetched once per experiment and not retained beyond the life of the experiment.

Your controls

You can ask us to delete or export your account at any time, and you can stop a running experiment from the dashboard. Each experiment page exposes a Pause control; selecting it halts variant assignment immediately and keeps the experiment visible in read-only mode. Cancelling a subscription pauses billing at the end of the current month and preserves experiment history so a resubscribe picks up cleanly.

Questions or a deletion request

Write to variantix@polsia.app — usually a one-line email is enough. We read every privacy request ourselves; nothing is delegated to a third-party processor.