Help › Privacy and consent
Privacy and consent
Data minimization is part of the design. In the default mode, ChurnReturn works without cookie consent.
What is stored
| Data | Where | Purpose |
|---|---|---|
| Product data and vectors | on our servers | calculating recommendations |
| Page path without query, recognized product, products shown | on our servers, raw data for a limited time | statistics, troubleshooting |
| Impression, click, dismissal | on our servers, raw data for a limited time | measuring success per product |
| Daily, hashed visitor identifier | on our servers | linking impressions and clicks without identifying a person |
| IP address, user agent, profiles | are not stored | |
| Page text for text detection | is discarded after vectorization; only the vector stays briefly in the cache | |
Raw data is aggregated into totals after a configurable period (30 days by default, under Team & settings).
Storage modes in the browser
| Mode | Stores | Enables | Consent |
|---|---|---|---|
| store nothing | nothing, only the page's memory | all triggers except page count; repeat protection only within the page view | not required |
| this session only | sessionStorage, ends with the tab | page count, pause and daily limit within the session, “first visit” | depending on your assessment usually not required, technically necessary for the function |
| persistent | localStorage with expiry in days | everything, including across days | recommended |
You set two modes: one without consent and one that applies after consent. Your site reports consent with a single line, directly from the consent tool or via Tag Manager:
ChurnReturn.consent(true);
Before the script loads, you can also use window.crConsent = true. Both switch to the second mode without reloading the page.
Detected automatically (Settings, “Detect consent”, on by default): Google Consent Mode (analytics_storage, or functionality_storage for the purpose “Preferences”), IAB TCF v2 (purpose 1, storing on the device) and the Shopify Customer Privacy API. Consent only counts if at least one source grants it and none denies it; an explicit call always takes precedence.
Consent tools that prefer to send an event use document.dispatchEvent(new CustomEvent('churnreturn:consent', {detail: {granted: true}})); granted: false withdraws consent, as does ChurnReturn.consent(false).
What the script does not do
- No cookies, not even in persistent mode (localStorage instead of cookies).
- No sharing with third parties, no ad networks, no fingerprinting.
- No requests to our servers before a trigger fires, apart from loading the configuration.
Sample text for your privacy policy
A suggestion to start from, not legal advice. Adjust the details in square brackets; include the paragraphs on session and persistent storage only if you use those modes.
Product recommendations (ChurnReturn)
On our website we use the recommendation service ChurnReturn, operated by [provider, address]. When a visitor appears to be leaving the page or stays on a page for a longer time, the service shows matching products from our own range. For this purpose, your browser transmits the address of the page viewed (without additions such as search terms or campaign parameters) and, where applicable, an excerpt of the visible page text to the service, which uses it to determine products with similar content. The page text is discarded after processing; only the page path, the recognized product, the products shown and whether the display was viewed, clicked or closed are stored. The service does not store IP addresses, browser identifiers or referrers; the IP address is only used briefly in hashed form to prevent abuse. We delete this raw data after [30] days and afterwards keep only daily totals without any personal reference.
The legal basis is our legitimate interest in presenting matching products from our range (Art. 6(1)(f) GDPR). In standard operation, the service stores nothing on your device.
[Only with storage mode “session”:] To avoid showing you the recommendations several times during one visit, the service stores, with your consent, a random identifier in your browser's session storage, which is deleted when you close the browser (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).
[Only with storage mode “persistent”:] With your consent, the service stores a random identifier in your browser's local storage, which is valid for up to [30] days and is used to limit how often the recommendations are shown. On the server, this identifier is only processed in hashed form with a random value that changes daily; there is no recognition across several days. You can withdraw your consent at any time via [cookie settings].
A data processing agreement is in place with the provider. Processing takes place on servers in [Germany/EU].
Next: Team and accounts →