Privacy Policy

1. Who we are

Salestracked ("we", "us") is the controller of the personal data described in section 3 under the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Portuguese data protection law (Law 58/2019). We have not appointed a data protection officer, as we are not required to; any privacy question or request can be sent to the email address at the end of this Policy.

2. Our two roles

We are the controller for data about our customers: the people who sign up, the members of their organisations and visitors to salestracked.io. We are a processor for data about the visitors and customers of the online stores that use Salestracked: the store is the controller and we act only on its instructions under our Data Processing Agreement (salestracked.io/dpa), which forms part of our Terms. If you shopped at one of those stores, please contact the store to exercise your rights; if you contact us, we will pass your request on to it.

3. Data about our customers

Account data: name, email address, password (stored only as a salted hash), organisations, roles and invitations. Billing data: plan, subscription status, payment status, amount, currency and transaction identifiers; payments are handled by our payment provider, Whop, and we never receive or store full card numbers. Technical data: IP address, browser and device information in security logs, and counters that limit repeated sign-in attempts. Communications: support tickets, emails you send us and the service emails we send you. Usage data: the settings, stores and integrations you configure in Salestracked.

4. Purposes and legal bases

We use customer data: (a) to create and run your account, provide the Service, process payments and give support, based on the performance of our contract with you (Article 6(1)(b) GDPR); (b) to keep the Service secure, prevent fraud and abuse, fix errors and improve features, based on our legitimate interest in operating a secure and reliable service (Article 6(1)(f)); (c) to keep invoices and accounting records and answer lawful requests from authorities, based on our legal obligations (Article 6(1)(c)); and (d) to send you service and billing notices, based on our contract, and any other communication only with your consent where the law requires it. We do not sell personal data, do not use it for our own advertising, and do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

5. Data we process for stores

When a store installs Salestracked we process, on its behalf: visits and events (pages viewed, referrer, campaign parameters, ad click identifiers such as gclid, gbraid, wbraid, fbclid, ttclid and epik, visitor and session identifiers, IP address, browser, and products added to cart or checked out with their value); and orders received from the store platform (order identifier and number, value, currency, items, landing page, IP address and browser, and the customer's email, phone, name, city, postcode and country). Customer email, phone, name and address fields are stored only as SHA-256 hashes. The store decides which ad platforms receive purchase events and is responsible for having a lawful basis, including any consent required for cookies and tracking, and for informing its own customers.

6. Ad platforms and store platforms

When a store connects Meta, Google Ads, Pinterest or another platform, we send that platform the purchase, its value and order identifier, the click identifier, IP address, browser and the hashed customer identifiers, never the plain email or phone number. Store platforms such as Shopify send us order data through the webhooks the store configures. These platforms act under their own terms and privacy policies and their own agreements with the store; they are not our service providers.

7. Service providers

We use the following providers, each bound by data processing terms: Vercel Inc. (hosting and serverless functions, United States); Neon Inc. on Amazon Web Services (database, United States); Whop Inc. (subscriptions and payments, customer data only, United States); and Resend (service emails, customer data only, United States). We may also disclose data where required by law, to protect our rights or the security of the Service, or to a successor in a merger or acquisition subject to this Policy.

8. International transfers

Some of our providers process data outside the European Economic Area, mainly in the United States. Those transfers rely on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses (Article 46 GDPR) with any supplementary measures needed. You can ask us for a copy of the relevant safeguards using the email address below.

9. How long we keep data

Account data is kept while your account is open and deleted or anonymised within 30 days after it is closed. Store data is kept while the store's account is open and deleted within 30 days after it is closed or on the store's request. Security logs and sign-in counters are kept only as long as needed for security, normally no longer than 90 days. Invoices and billing records are kept for as long as tax and accounting law requires (10 years in Portugal). Backups are overwritten on their normal cycle.

10. Security

We apply technical and organisational measures appropriate to the risk (Article 32 GDPR): encryption in transit, encryption at rest of ad platform credentials and webhook secrets (AES-256-GCM), hashed passwords, hashing of customer identifiers before storage, rate limiting, and access to production systems restricted to the people who operate Salestracked. No online system is completely secure; if a personal data breach is likely to result in a risk to you, we will notify the authority and, where required, you, as the GDPR requires. You are responsible for keeping your credentials secure.

11. Your rights

Under the GDPR you have the right to access your personal data, have it corrected, have it erased, restrict its processing, receive it in a portable format, and object to processing based on our legitimate interests (Articles 15 to 21). Where processing is based on consent you can withdraw it at any time without affecting earlier processing. To exercise these rights, email us; we answer within one month, which may be extended by two further months for complex requests, and may ask you to confirm your identity. You also have the right to lodge a complaint with the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt), or with the supervisory authority where you live or work.

12. Cookies

salestracked.io uses only strictly necessary cookies, which do not require consent: ap_session keeps you signed in (30 days) and ap_store remembers the store you selected (1 year). We use no analytics or advertising cookies on our own site. On the stores that install Salestracked, the tracking script sets first-party cookies on the store's behalf: _st_vid recognises a returning visitor (400 days, also kept in local storage by the non-Shopify script); _st_sid groups page views into a visit (30 minutes); _st_gclick remembers a Google Ads click (90 days); _st_bc and _st_pi avoid counting a reloaded checkout twice (1 day); _fbc and _fbp are Meta identifiers (90 and 390 days); and _epik is the Pinterest click identifier (1 year). Each store decides, through its cookie banner and platform settings, whether these wait for the visitor's consent.

13. Children

Salestracked is intended for businesses and is not directed to children. We do not knowingly collect data from anyone under 16.

14. Changes

We may update this Policy as the Service, our providers or the law change. We will post the new version here with its date and, if a change is significant, tell our customers by email or in the app before it takes effect.

15. Contact

For any question about this Policy or to exercise your rights, write to us at the email address below.

Email: hello@salestracked.io