Privacy Policy

Tracebird is operated by Scaling Adventures LLC, a Wyoming limited liability company ("we", "us"). This policy explains what data Tracebird collects, why, who we share it with, how long we keep it, and the rights you have. Questions or requests: brahim@scalingadventures.com.

Our role

For your Tracebird account (name, email, login and billing records) we are the controller. For the advertising and attribution data you connect or collect through a customer-installed Pixel (for example from Meta, HYROS, Google Sheets, CRM webhooks, or Pixel pageviews), we process it on your behalf and under your instructions as a processor (a "service provider" under California law); your business is the controller of that data. Business customers who need a data processing agreement can request one at brahim@scalingadventures.com.

Information we collect

• Account data: your name, email address, a hashed password (never the password itself), workspace name, website, logo, and team membership and role.
• Connected ad data: ad account, campaign, ad set, ad and creative details, and performance metrics from the ad accounts you authorize.
• Stripe conversion data: when you connect Stripe, payment and refund IDs, dates, amounts, currencies, and optional campaign, ad set, ad, Pixel visitor, CRM source, and order IDs that you explicitly add to payment metadata. We do not import card numbers or customer personal fields.
• Microsoft Clarity data: aggregated UX metrics for the last three days (sessions, users, scroll depth, engagement time, click and error rates) and your top pages by sessions, fetched with the Clarity Data Export API token you provide. We do not import session recordings, visitor-level or event-level records.
• Google Analytics data: the GA4 property name, currency and time zone, plus aggregated sessions, active users, key events and revenue for the last seven complete days when you view its report. We do not import visitor-level or event-level records.
• Customer-installed Tracebird Pixel data: pseudonymous visitor IDs, page-path and acquisition timestamps, referring origin, UTMs, URL-claimed Meta ad hierarchy IDs and optional fbclid, SHA-256 hashes of email addresses and phone numbers that visitors type into forms on the customer's site, and CRM or payment relationships supplied by the customer. See Customer-installed Tracebird Pixel for purpose, retention, and withdrawal details.
• Configuration and activity: automation rules, dashboards, reports, integration settings, and a log of automation runs and the changes they made.
• Technical and security data: a session identifier, a salted hash of your IP address, your browser's user agent and device type, and approximate location (city, region, country) derived from your connection by our host. We use these to keep you signed in, show your active sessions, and protect your account.
• Billing data: your plan, subscription status, and Stripe customer ID. Card details are collected by Stripe and never reach our servers.

In California privacy law terms, these are identifiers, commercial information, internet or network activity information, and approximate geolocation. We do not collect sensitive personal information, and Tracebird is not intended for children.

How we use it, and our legal bases

• To provide Tracebird (show reporting, run the automations you configure, send service emails): performance of our contract with you.
• To secure the service (sessions, rate limiting, fraud and abuse prevention, audit logs): our legitimate interest in keeping Tracebird and your accounts safe.
• To bill you and keep accounting records: contract and legal obligation.
• To answer support requests and tell you about material changes: contract and legitimate interest.

We do not sell or "share" personal information (including for cross-context behavioral advertising), we do not use your data to advertise to you, and we do not use it to train AI models.

Facebook / Meta data

When you connect Facebook, you sign in through Meta's login flow and choose which permissions to grant. We receive an access token and data from Meta's Marketing API about the ad accounts you choose to connect; we do not store or sync ad accounts you do not select. We use it only to show your ad reporting in Tracebird and to make the budget or status changes that you configure or approve. We do not sell, license, or transfer Meta data to anyone, use it for advertising or profiling, combine it with data about other customers, or use it for any purpose unrelated to providing Tracebird to you. Only the infrastructure providers below process it on our behalf.

Access tokens are encrypted at rest with AES-256-GCM. When you disconnect Facebook, we immediately delete the stored token and the campaigns, ad sets, ads, and metrics synced from your Meta ad accounts. Removing or disabling a single ad account deletes that account's synced data. Your automation rules and their run history stay in your workspace until you delete them or your workspace.

Google Analytics data

Connecting Google Analytics is optional and uses Google's sign-in and consent flow. Tracebird requests the read-only Analytics scope and reads only the GA4 property you select. We show aggregated sessions, active users, key events and revenue for the last seven complete days; visitor-level and event-level records are not imported or stored.

Google OAuth credentials are encrypted at rest with AES-256-GCM and scoped to your workspace. Disconnecting Google Analytics deletes the stored credentials and selected property details. To revoke Tracebird's access at Google as well, remove it from your Google Account's third-party connections.

Microsoft Clarity data

Connecting Microsoft Clarity is optional. A workspace admin pastes a Clarity Data Export API token for their own project. Tracebird reads only aggregated metrics for the last three days (sessions, users, scroll depth, engagement time, click and error rates, and top pages) and caches that snapshot, refreshing it at most every six hours; session recordings and visitor-level records are not imported or stored.

The API token is encrypted at rest with AES-256-GCM and scoped to your workspace. Disconnecting Microsoft Clarity deletes the stored token and snapshot. To revoke the token at Microsoft as well, delete it under Settings → Data Export in your Clarity project.

Stripe conversion data

Connecting Stripe is optional and uses Stripe's OAuth flow. Tracebird requests read-only access to charges and refunds so it can report successful captured payments, refunds, and revenue by currency. We do not make payments or change Stripe objects. Ad attribution can come from hierarchy IDs you supply in payment metadata, or from a customer-supplied Pixel visitor ID linked to consented acquisition evidence as described below. These links do not establish that an ad caused the payment. We do not import card numbers or customer names, email addresses, or other personal fields.

Stripe OAuth credentials are encrypted at rest with AES-256-GCM and scoped to your workspace. Disconnecting Stripe in Tracebird deletes the stored credentials and imported payment and refund records. To revoke Tracebird's authorization at Stripe as well, uninstall Tracebird in Stripe under Settings → Installed apps.

Customer-installed Tracebird Pixel

Tracebird Pixel is optional JavaScript that a business customer may install on its own website. It is separate from the Tracebird dashboard. By default, the script sends pageview and acquisition events to the customer's Tracebird workspace as soon as the page loads. The customer can instead enable consent mode, in which the script waits until the site's consent manager signals acceptance and, before then, does not read visitor or acquisition state, create an ID, or send Pixel events; an explicit denial callback removes a stale Pixel record without reading its value. The customer decides whether consent mode is required, configures the allowed website domains, and is responsible for the site notice, any consent that applicable law requires, and lawful instructions for this processing. The Pixel's consent callback is a collection gate; it does not itself establish that valid consent was obtained.

Pixel events may contain a random pseudonymous visitor ID, event and page-path timestamps, the referring site's origin, UTM values, Meta ad, ad-set or campaign IDs claimed in the URL, and a Meta fbclid value when present. Query strings and fragments are removed from stored page paths. These URL values are not independent proof of a paid click or that an advertisement caused a later sale. When a visitor submits a form, the Pixel hashes any email address or phone number entered (SHA-256, in the browser) and sends only the hashes with the visitor ID; Tracebird compares them with hashes of the same fields on the customer's CRM and Stripe records to link those records to the visit. Raw form values are not sent, and the hashes follow the same 35-day cutoff as other browser-level Pixel records. We do not use fingerprinting or build cross-device identity graphs for this Pixel.

If the customer sends a visitor ID with a CRM event or one-time Stripe Checkout metadata, we can associate the recorded acquisition evidence with backend-reported CRM outcomes or a Stripe payment confirmed by provider data obtained through signed-event handling or an authorized recovery sync. CRM lead, order, payment, refund and source IDs, amounts, currencies, and attribution evidence may be stored to provide that report. The visitor ID is pseudonymous, not anonymous, because the customer can link it to its CRM or payment records. Stripe source records remain separate from CRM amounts unless the customer supplies the explicit order and webhook-source relationship used for reconciliation.

CRM webhook records and Stripe charge or refund records may also be processed as server-side integration data without a browser Pixel ID. Such records stay separate from website-visit attribution unless a supported visitor or lead relationship exists. An explicit CRM order and webhook-source link reconciles financial records; by itself, it does not identify an advertising visit.

Raw browser-level Pixel pageviews and acquisition records have a 35-day timestamp cutoff. Aggregate collection-health diagnostics use a 35-day cutoff at UTC-day granularity. Housekeeping runs hourly in bounded batches, so cleanup can complete later when a backlog exists. Hashed IP rate-limit buckets are retained for one day. Conversion records and copied sale-to-lead attribution relationships may remain with the customer's workspace records under the customer's retention instructions and account lifecycle. Withdrawing consent stops future browser collection and clears the Pixel's local visitor ID; it does not by itself erase historical server-side events or financial records. The customer must handle applicable deletion, objection, and retention requests for its website visitors.

Who we share data with

We share data only with the service providers we use to run Tracebird (our subprocessors):

• Cloudflare (United States / global network): hosting on Cloudflare Workers, with data stored in Cloudflare D1 and R2.
• Stripe (United States): payment processing, subscription management, and the read-only conversion data you choose to connect.
• Resend (United States): delivery of transactional email.

When you connect them, we also exchange data with Meta, HYROS (we store your API key encrypted and read attribution and revenue data), Google Analytics (we read aggregate report metrics for the selected GA4 property), Microsoft Clarity (we read aggregate UX metrics for your project), and Google Sheets (we read the shared sheet links you add; we never modify your sheets). Those services are governed by their own terms and privacy policies. We may also disclose data if required by law or to protect our rights, or to a successor if Tracebird is sold or merged, subject to this policy.

International transfers

We and our providers process data in the United States and other countries. Where we transfer personal data from the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or an equivalent safeguard, such as the providers' certification under the EU-U.S. Data Privacy Framework.

Security

Data is encrypted in transit (HTTPS) and integration secrets are encrypted at rest. Access is scoped to your workspace, passwords are hashed, and session cookies are HTTP-only. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as required by law.

Cookies

Tracebird uses a single first-party session cookie to keep you signed in (it expires after 30 days), and your browser's local storage for interface preferences such as date ranges and layout. These relate to the Tracebird dashboard. We do not set analytics, advertising, or third-party tracking cookies on the dashboard. A business customer may separately install Tracebird Pixel on its own website; there, subject to the customer's consent settings, the Pixel uses browser local storage for its pseudonymous visitor ID and sends the events described under Customer-installed Tracebird Pixel. That customer-site processing is controlled by the customer and is not part of your Tracebird dashboard session.

Email

We send only transactional and service emails: email verification, password resets, team invitations, trial reminders, billing notices, and alerts you configure. We do not send marketing email. If we ever do, it will include an unsubscribe link.

Data retention

• Account and workspace data: kept while your account is active.
• Integration tokens and synced data: deleted immediately when you disconnect the integration. Synced data is refreshed on each sync and older snapshots are replaced.
• Customer Pixel browser evidence: pageview and acquisition records have a 35-day timestamp cutoff; aggregate health diagnostics use a 35-day cutoff at UTC-day granularity. Hourly bounded cleanup may take longer when there is a backlog. Hashed IP rate-limit buckets are kept for one day. Conversion records and copied attribution relationships remain with the customer workspace under its configured retention and account lifecycle; withdrawing browser consent does not erase them.
• Sessions: expire after 30 days or when you sign out or revoke them.
• Deleted accounts and workspaces: deleting a workspace stops all automations and access immediately; its data, its logo, and users who belong to no other workspace are permanently deleted automatically 30 days later. Encrypted backups roll off within a further 30 days.
• Billing records: kept as long as tax and accounting law requires.

Your rights

Depending on where you live (including under the GDPR, UK GDPR, and California law), you can ask to access, correct, delete, or receive a portable copy of your personal data, to restrict or object to its processing, and to know what we collect and how we use it. Email brahim@scalingadventures.com from your account address. We may need to verify your identity, and we respond within 30 days (45 days for California requests). You can use an authorized agent. We will not discriminate against you for exercising these rights.

If your data was added to Tracebird by a business customer (for example, you are a member of their workspace or appear in their ad data), please contact that business first; we will help them respond.

If you are in the EEA or UK and believe we have mishandled your data, you can complain to your local data protection authority (in the UK, the Information Commissioner's Office). We would appreciate the chance to address your concern first.

Data deletion instructions

To delete the data Tracebird holds about you, including data received from Facebook/Meta:

• Sign in to Tracebird, open Settings → Integrations, and disconnect Facebook, Google Analytics, Microsoft Clarity or Stripe. This immediately deletes the stored authorization and synced data for that integration.
• You can also remove Tracebird in Facebook under Settings & privacy → Settings → Business integrations, or send a deletion request from there. Meta notifies us and we automatically delete your stored Meta token and synced Meta ad data. For deletion requests, Facebook gives you a confirmation code and a link to check the status.
• To revoke Tracebird's authorization at Stripe, uninstall Tracebird in Stripe under Settings → Installed apps. Then disconnect Stripe in Tracebird to delete the locally stored credentials and imported conversion records.
• Workspace owners can delete the whole workspace in Settings. To delete your personal account, or if you cannot sign in, email brahim@scalingadventures.com from your account email address with the subject "Data deletion request". We confirm deletion within 30 days.

Changes

We will update this page when our practices change and revise the date above. For material changes we will also notify you by email or in the app. See also our Terms of Service.

Contact

Scaling Adventures LLC · 40 North Gould Street, Sheridan, WY 82801, USA · brahim@scalingadventures.com. We have not appointed a data protection officer because we are not required to; this address reaches the person responsible for privacy.