Visitor Profiles

StorePilot builds a profile for each unique visitor to your WordPress site, linking all their activity — pageviews, errors, recordings, and leads — under one identifier.

Visitor Identification

Visitors are identified by a random ID (a UUID on modern browsers) stored redundantly in a first-party cookie (sp_vid, 2 years, rolling) and in localStorage under the key wpelVisitorId. Whichever copy survives re-seeds the other, so clearing just one store does not create a new visitor. The ID is:

• Created on first visit
• Persisted across page loads and browser restarts (until both stores are cleared)
• Not derived from IP, User-Agent or any fingerprint — those are stored as auxiliary analytics data only
• Not tied to any personally identifiable information unless the visitor also submits a lead form

A visitor ID identifies a browser, not a person. A private/incognito window partitions both stores and legitimately appears as a new visitor. Recognising the same person across browsers happens server-side: when a visitor is logged into WordPress, their visitor profile is linked to the WP user ID, and every browser that logs into the same account is shown as "the same person on N devices".

If a visitor clears both their cookies and their site data, they will appear as a new visitor on their next visit.

---

What a Visitor Profile Contains

Section	Data
Identity	Display name (from a submitted lead, else Visitor #id), visitor ID, first seen, last seen, linked WP user
Location	Country (resolved from IP), timezone. The IP address is stored on the profile and shown on the detail page
Device	Browser, OS, device type, screen resolution, language (from User-Agent and the browser)
Activity	List of pageviews with timestamps and durations
Errors	All errors encountered by this visitor
Recordings	All session recordings for this visitor
Leads	Lead captures (if visitor submitted a form or checkout data)

---

Session Stitching

A single visitor may create multiple recording sessions across different page loads (e.g. multiple visits over several days). The Platform links these sessions chronologically under one visitor profile.

API endpoint:

GET /dashboard/visitors/:id/sessions

Response:

[
  {
    "id": "session-uuid-1",
    "startedAt": "2024-01-15T10:00:00Z",
    "duration": 180,
    "pageUrl": "https://mysite.com/shop/"
  },
  {
    "id": "session-uuid-2",
    "startedAt": "2024-01-17T14:30:00Z",
    "duration": 420,
    "pageUrl": "https://mysite.com/checkout/"
  }
]

This allows you to reconstruct the complete visitor journey from first touch to checkout.

---

Right to Erasure (GDPR Article 17)

Visitors can request deletion of all their data. The Platform supports this via the Erase Data button in Dashboard → Visitors → [Visitor].

The erasure operation:

1. Anonymises all errors linked to this visitor (clears identifying context)
2. Deletes all recording sessions and their segments
3. Deletes all pageviews for this visitor
4. Deletes all lead captures for this visitor
5. Deletes the visitor profile itself

This is performed as a database transaction — either everything is deleted or nothing is if an error occurs.

API endpoint:

DELETE /dashboard/visitors/:id/data

---

Privacy

Visitor profiles are inherently privacy-sensitive. Consider:

• Setting a data retention period — automatically delete visitor records older than a defined threshold (requires a scheduled job, see LAUNCH_CHECKLIST)
• Displaying your Privacy Policy link prominently on your WordPress site
• Providing a data erasure request form for GDPR compliance — use the API endpoint above to process requests