Privacy Policy

Optik ("we," "our," or "us") operates the optik-app.com website, the Optik dashboard, API, and the Optik browser SDK (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our Service.

This policy applies to two categories of individuals: (a) customers who create Optik accounts and use our dashboard to run A/B tests, and (b) visitors to customer websites where the Optik SDK is installed. We handle data from each group differently, as described below.

2.1 Account Data (Customers)

When you create an Optik account, we collect:

• Name and email address
• Organization name
• Password (stored as a bcrypt hash; we never store plaintext passwords)
• Role within your organization (admin, editor, viewer)

2.2 SDK Visitor Data (End Users of Customer Websites)

When the Optik SDK runs on a customer's website, it collects the following about the website's visitors:

• Anonymous visitor ID — a randomly generated UUID stored in the visitor's browser localStorage. This is not linked to any personal information.
• Experiment assignments — which variant of each experiment the visitor was assigned to
• Conversion events — event names and timestamps for goals defined by the customer (e.g., "clicked_signup", "completed_purchase")
• Browser metadata — user agent string, viewport size, and page URL (used for targeting rules and debugging)

The SDK does not collect names, email addresses, IP addresses, or any other personally identifiable information. We do not fingerprint visitors or track them across different websites.

2.3 Usage Data

We automatically collect information about how you interact with the Optik dashboard, including pages viewed, features used, and actions taken. This helps us improve the product.

• Provide the Service — run experiments, calculate statistical results, display dashboards
• Authenticate users — verify identity via JWT tokens and manage role-based access
• Improve Optik — analyze usage patterns to improve features and performance
• Communicate — send account-related notifications (never marketing without consent)
• Ensure security — detect abuse, prevent unauthorized access, and enforce rate limits

With respect to SDK visitor data, Optik acts as a data processor. Our customers (the website operators who install the SDK) are the data controllers. This means:

• Customers decide what experiments to run and what data to collect via the SDK
• Optik processes visitor data solely on behalf of and under the instructions of the customer
• We do not sell, rent, or share visitor data with third parties
• We do not use visitor data for our own advertising or profiling purposes
• Upon customer request, we will delete all visitor data associated with their projects

Customers who require a formal Data Processing Agreement (DPA) can request one by contacting us.

The Optik SDK uses browser localStorage (not cookies) to store:

• The anonymous visitor ID (a random UUID)
• Experiment variant assignments (to ensure consistent experiences)
• A configuration cache with ETag (to reduce network requests)

We do not use third-party cookies. We do not share localStorage data with any advertising networks or third-party trackers. The Optik dashboard uses a secure, httpOnly JWT cookie for authentication.

• Account data — retained while your account is active and for 30 days after deletion
• Experiment event data — retained for 90 days by default, after which it is automatically purged. Customers can request shorter retention periods.
• Experiment configuration — retained while the associated project exists
• Audit logs — retained for 1 year for security and compliance purposes

We implement industry-standard security measures to protect your data:

• Passwords are hashed using bcrypt with salt rounds
• Authentication uses signed JWT tokens with expiration
• All data is transmitted over HTTPS/TLS
• Database is encrypted at rest
• API endpoints are rate-limited to prevent abuse
• Role-based access control enforces least-privilege access
• Input validation on all API endpoints prevents injection attacks

Optik's infrastructure is hosted in the United States. If you access our Service from outside the United States, your data may be transferred to and processed in the United States. We take appropriate safeguards to ensure your data is protected in accordance with this Privacy Policy regardless of where it is processed.

For customers subject to the GDPR who require Standard Contractual Clauses (SCCs) for international transfers, please contact us to arrange appropriate transfer mechanisms.

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Restriction — request that we limit processing of your data
• Data portability — request your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests

To exercise these rights, contact us at [email protected]. We will respond within 30 days. Note: for SDK visitor data, end users should contact the website operator (our customer) who is the data controller.

If you are a California resident, you have the right to:

• Know — what personal information we collect, use, and disclose
• Delete — request deletion of your personal information
• Opt-out — opt out of the "sale" of personal information (we do not sell personal information)
• Non-discrimination — we will not discriminate against you for exercising your rights

We do not sell personal information as defined under the CCPA. To make a request, contact us at [email protected].

Optik is not directed at individuals under 16 years of age. We do not knowingly collect personal information from children. If we become aware that a child under 16 has provided us with personal information, we will take steps to delete that information. If you believe a child has provided us with personal data, please contact us at [email protected].

We may update this Privacy Policy from time to time. We will notify customers of material changes by email or via a notice in the Optik dashboard at least 30 days before the changes take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.

If you have questions about this Privacy Policy or our data practices, contact us at:

• Email: [email protected]
• Website: optik-app.com