← Help center

Consent and privacy

How ROASaurus handles cookie consent, customer data and GDPR requests.

ROASaurus runs on your store as your processor. You decide whether a visitor's consent is needed. When a visitor declines, they get no visitor id, so their ad clicks and visits are not linked to them, and their browser events are not sent to ad platforms. The paid order itself is still sent server-side with hashed order data, as explained below.

The consent setting

Each store has a Consent setting under Store settings:

• Respect visitor consent (the default, and required in the EU). ROASaurus checks the visitor's marketing consent before it tracks them.
• Strict. Nothing is sent and nothing on the device is read or written until the visitor consents, and the server drops any browser event without explicit consent. When the visitor consents later, only that page's view is sent.
• Always track. Only for stores that sell where consent is not required.

Anonymous measurement is off by default. When you turn it on, visitors who declined or did not choose are counted, never tracked: one small request per page view, product view, add to cart and started checkout, without cookies, storage, ids or ad pixels, added to daily totals. Whether that is allowed for your visitors is a legal question, so ROASaurus never turns it on by itself. The Consent page in the dashboard shows the consent rate, and orders and revenue by consent state.

On Shopify

With Respect visitor consent, the storefront script and the checkout pixel read Shopify's Customer Privacy API, which your cookie banner (Shopify's own or a consent app) fills in. When a visitor has not given marketing consent:

• no visitor id cookie is set and no click ids or UTMs are stored from their browsing;
• the browser pixels (Meta, TikTok, Snapchat, Pinterest, Reddit and the others) are not loaded;
• page views, adds to cart and checkouts are logged without a visitor id, IP address, browser details or contact details, and without the query part of the page address, where click ids and campaign tags sit. They are not sent to ad platforms.

If the visitor changes their choice later, also during checkout, ROASaurus follows the new choice. If the store has no cookie banner at all, Shopify's API reports nothing and ROASaurus treats the visitor as consenting, except in strict mode, so install a banner before you sell in the EU.

Shopify includes the order's landing page address in the order data, and that address can contain campaign tags and click ids. ROASaurus uses it only in your own reports, as a fallback for attribution; it is not sent to ad platforms.

On other webshops

The ROASaurus script reads the visitor's choice from your consent tool: OneTrust, Cookiebot, Usercentrics, Didomi, CookieYes, iubenda, Termly, Complianz, Osano, TrustArc, any IAB TCF banner, Google Consent Mode or the WP Consent API (which other WordPress consent plugins fill in). In the store's consent settings you can pick the tool and map its own categories to analytics and marketing. With another tool, call tlq('consent', true) when the visitor accepts marketing cookies and tlq('consent', false) when they decline. Until the visitor accepts, the same rules apply as on Shopify: no visitor id, no click ids or contact details, and no browser pixels. If the page has no consent tool at all, ROASaurus treats the visitor as consenting, except in strict mode.

The WooCommerce plugin stores the tracking cookies on an order only when the visitor allowed marketing cookies.

Purchases sent from the server

Purchases come from your order data (Shopify's order webhook or your platform's connector), not from the browser. For an order whose visitor declined, there is no visitor id or click id to attach. The purchase event is still built from the order: it includes the customer details on that order, hashed, and the IP address and browser the order was placed from. It goes to Meta, TikTok, Snapchat, Pinterest, Reddit, X, Microsoft and Taboola; LinkedIn and the destinations added after it get nothing for such an order, and Google Analytics 4 gets it as an anonymous sale. If your legal advice says purchase events also need prior consent, contact us before you turn on server-side purchases.

What is stored and sent

• Emails, phone numbers and addresses are hashed with SHA-256 before they are sent to an ad platform.
• The visitor id cookie _tl is set on your store's domain for 365 days, only with consent. ROASaurus reads the platforms' own cookies (such as _fbp and _fbc) when they exist.
• No browser fingerprinting. Crawlers, link previewers and headless browsers are filtered out on the server.
• Platform tokens and API keys are encrypted at rest.
• Owners choose how long raw events and visitor data are kept, from 30 days to 2 years.
• Data is stored in Amsterdam, the Netherlands. Sub-processors are listed in the data processing agreement.

GDPR requests

Shopify's privacy webhooks are handled automatically. A customer redaction removes that customer's personal details from the orders ROASaurus stores, and the contact details, IP addresses and browser details of the visits linked to those orders. A shop redaction, 48 hours after you uninstall the app, deletes every record of the store. For a customer data request, ROASaurus compiles what it holds about the customer (orders, linked storefront events, ad clicks and survey answers), emails the store's owners and admins, and lets them download it from the store's Shopify page to send to the customer. Each request is listed there. Removing a store in the dashboard deletes its data right away. For other webshops, email hello@roasaurus.com with the customer's email address and we handle the request. Our own role and retention periods are in the privacy policy.

Still stuck? Email us.