Privacy Policy

Last updated Oct 13, 2026

server-track-lab is a server-side conversion API operated by Marc Stevens in Ontario, Canada. This policy explains, in plain English, what data we handle and how. Questions: canada.site.ops@gmail.com.

Two kinds of data

Account data (you, our customer). When you sign up we collect your work email and workspace name. We use them to run your account, contact you about the service, and handle billing. We don't sell it.

Event data (your end users). You send us conversion events from your server (for example "demo booked") that may include identifiers about your own users, such as email, phone, IP address, and user agent. For this data you are the controller and we act as your processor/service provider: we handle it only to deliver the events to the ad platforms you configure.

What we do with event data

• Hashing. Email and phone are normalized and SHA-256 hashed on receipt. Raw email and phone are never stored. We keep only the hashes and a masked email preview (e.g. t***@example.com) so you can debug in your dashboard.
• Forwarding. We forward events to Meta Conversions API using the pixel/dataset and access token you provide. Google Enhanced Conversions support is planned; when added, it will work the same way. Once delivered, the ad platform's own terms and privacy policy apply to that data.
• IP address and user agent are passed through to the ad platform for matching, as the platform requires.
• Deduplication. We keep a record of each event_id for 72 hours so the same event isn't sent twice, then delete it.
• Event logs. Recent event logs (hashed/masked identifiers and delivery results) are kept for your dashboard and are trimmed automatically on a rolling basis.
• Credentials. Your API keys are stored only as hashes. Your Meta access tokens are encrypted at rest with AES-GCM.

Your responsibilities

You are responsible for having a lawful basis and any required consent from your end users (including under PIPEDA, Canada's anti-spam rules where relevant, GDPR, US state privacy laws, or other laws that apply to you) before sending their data to us and to ad platforms, and for your own privacy notice describing this.

Service providers

• Cloudflare hosts the application, database, and storage. Data may be processed in Cloudflare's global network, including outside Canada.
• Stripe handles payments. We don't see or store full card numbers. Billing is currently in test mode.
• Meta (and later Google) receive the events you choose to forward.

We may add privacy-friendly website analytics (e.g. Google Analytics) to our public marketing pages; it is not used on the dashboard or API.

Retention and deletion

Account data is kept while your account is active. You can ask us to delete your workspace and its data at any time by emailing us; we'll do so within 30 days, except where we must keep records (e.g. billing) by law.

Your rights

We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). You can ask to access or correct the personal information we hold about you, or withdraw consent, by emailing canada.site.ops@gmail.com. End users of our customers should contact the business they dealt with; we'll help that business respond. You may also complain to the Office of the Privacy Commissioner of Canada.

Security

We use HTTPS everywhere, hashing, encryption at rest for tokens, and access controls. No system is perfectly secure; if a breach affects your data we'll notify you as required by law. We do not hold security certifications such as SOC 2.

Changes

We'll update the date above when this policy changes and notify account holders of material changes by email.