Egenverk Conversion Relay · Documentation
Data and privacy
Conversion Relay sends nothing about visitors and customers without marketing consent, and nothing at all until an administrator has configured and switched it on. There is no licence server, no telemetry and no export of past orders.
What is sent to OpenAI
The recipient is OpenAI, which operates ChatGPT Ads.
The pixel in the browser
- The script is loaded from
https://bzrcdn.openai.com/sdk/oaiq.min.jsand sends events tohttps://bzr.openai.com. - Only when measurement and the browser pixel are on, the mode is Production and the visitor has given consent. Consent is passed to the pixel before it starts, and it is switched off at once if consent is withdrawn.
- Contents: the event name, the page slug and title, product IDs, names, quantities and prices, the cart total and currency, and the browser information the pixel sends itself. A search page sends a fixed name, never the search term.
Purchases from the server
- Sent to
https://bzr.openai.com/v1/events. - Only when measurement and the Conversions API are on, once the payment is confirmed or the order reaches Processing or Completed, and only if the order was placed with marketing consent.
- Contents: an event ID, the payment time, the order total and currency, the products (ID, name, quantity, unit price and, for variations, the purchased attributes), the store's home URL and the ad clicks stored with consent.
- Only if you switch them on: a SHA-256 hash of the billing email, the customer's IP address and user agent, the billing country, city, region and postal code.
Never sent
The customer's name, phone number, street address, order key and raw email. The thank-you page URL is not sent either.
Validate synthetic API event sends one invented test purchase with no customer data at all.
OpenAI's terms and privacy policy:
- Ad Tools Terms
- Conversion Terms
- Privacy policy, with a separate one for Europe
You are responsible for describing this processing in your own privacy policy and cookie declaration.
Cookies
Conversion Relay sets cookies only when the visitor has given consent. All of them are limited to your own host, with SameSite=Lax, and Secure on https.
| Cookie | Contents | Lifetime |
|---|---|---|
egenverk_conversion_relay_click | The ad click from the landing page | 30 days from the click, never extended |
egenverk_conversion_relay_added | Recent cart additions, for the pixel | Two minutes |
egenverk_conversion_relay_record | A signed reference to the consent record, not readable by scripts | While the server holds a valid consent |
egenverk_conversion_relay_marker | Only the same expiry, so the script knows a consent exists | As above |
The pixel also sets its own cookies, __oppref and __obref, to remember the ad click. Declare them as marketing cookies in your consent banner. Conversion Relay does not control their domain, path or lifetime.
A denied or withdrawn consent removes Conversion Relay's cookies.
The server reads consent from the banner's own cookie (CookieConsent for Cookiebot, wp_consent_marketing for the WP Consent API) on the requests WooCommerce makes anyway.
What is stored in the store
| Where | What | How long |
|---|---|---|
Table convert_relay_consent | Consent status, when it was seen and the ad click, encrypted | Deleted 30 days after the record was last written |
Table convert_relay_events | An encrypted snapshot of each queued purchase, and its status | Contents and the link to the customer are cleared after seven days, the whole row after 90 days |
| The order | An opaque event marker, a keyed hash linking the order to the consent record, consent status and time | As long as the order |
| Options | The settings, the encrypted API key and the latest 100 validation results | Until you remove them |
| WooCommerce session | A copy of the consent status and recent cart additions | As long as the session |
Table names start with the database table prefix, for example wp_. They keep the names from when the plugin was called Convert Relay.
Cleanup runs every five minutes while the plugin is active, even with measurement off. Deactivating the plugin pauses cleanup too. Backups follow your own retention.
Encryption
The API key, ad clicks and purchase contents are encrypted with AES-256-GCM using a key derived from the WordPress security keys (salts). Someone with access to the database alone cannot read them. Someone who takes over the whole WordPress installation can. If you change the security keys, the old data can no longer be read: save the API key again and use fresh test orders.
Logs
Diagnostics are written to the WooCommerce log with the source egenverk-conversion-relay. WooCommerce protects, rotates and removes the files according to its own settings. The log never contains API keys, customer details or event contents. An order ID may appear for troubleshooting. IP addresses are only used as keyed hashes in short-lived counters and are never written to the log.
Uninstall
By default, settings, tables and delivery history are kept when you uninstall. To remove them:
- Switch on Delete plugin tables and settings on uninstall under Advanced settings on the Settings tab and press Save settings.
- Deactivate and delete the plugin under Plugins.
This removes both tables, all settings, the saved API key, the validation history and log files from versions before 1.2.0. On a multisite network, each site is handled by its own choice.
What remains:
- The data on the orders. It is kept on purpose, so that past purchases are not sent again if the plugin is reinstalled.
- Entries in the WooCommerce log, which expire with WooCommerce's own retention.
- A key in
wp-config.phpor an environment variable.
WooCommerce orders are never modified or deleted.