Your conversion data, treated as such
Server-side tracking handles the most sensitive thing a store has: the identity of its buyers. Here is exactly what Trackful stores, in what state, for how long, and what we do not claim.
Last updated: July 2026
Where the data lives
The application, the database and the cache are hosted in Switzerland with Infomaniak, under a European Commission adequacy decision. Nothing is replicated to the United States.
Switzerland and the European Union
Primary hosting in Switzerland. No shopper data leaves that perimeter beyond the ad platforms a merchant enables themselves.
Dedicated infrastructure
The MariaDB database has no public port: it accepts no remote connection, and no admin panel is exposed to the internet.
Carbon-neutral hosting
Infomaniak runs its data centres on renewable energy and reuses the heat they produce. Not a security criterion, but a deliberate choice.
What we store, and in what state
Most of the protection here is not a procedure, it is a design decision: identity is hashed or encrypted before it is written. A copy of our database does not yield a customer list, it yields fingerprints.
| Data | State at rest | Retention |
|---|---|---|
| Email, phone, name and postal code used for matching | SHA-256 hashed, normalised first. Never in plain text. | While the store uses the service, deleted on uninstall or on an erasure request |
| Match keys attached to a conversion (needed for a resend) | AES-256-GCM encrypted | 60 days after the order, then purged automatically |
| IP address and user agent on events | Plain text. This is the one exception, which is why it expires. | 60 days |
| Anonymous sessions and advertising click identifiers | Platform technical identifiers, no personal data | 90 days |
| Access tokens for the merchant's ad platforms | AES-256-GCM encrypted | Until the channel is disconnected |
Sixty days is not a round number picked at random: it is past the point where any platform would still accept a resend (Meta 7 days, Google Analytics 4 about 72 hours, Google Ads adjustments about 54 days). Keeping it longer would buy nothing and risk something. These purges are scheduled jobs, not a rule anyone has to remember.
In transit
HTTPS and TLS everywhere: between the store and our servers, between the dashboard and the API, and out to every ad platform. No plain-text entry point.
Consent and opt-outs
Consent is read before capture, not filtered afterwards. Trackful distinguishes three states, and never collapses "refused" into "never asked".
- Google Consent Mode v2 is honoured across all four signals, in all three states: granted, denied, unspecified.
- When ad_user_data is not granted, the conversion is forwarded with the advertising click identifier alone: no personal data at all, hashed or otherwise.
- On Shopify, a shopper who opts out of the sale or sharing of their personal information (CCPA/CPRA) has that decision applied: their data goes to no platform.
- On WooCommerce, six consent platforms are detected automatically: Axeptio, Didomi, Cookiebot, OneTrust, Complianz and WP Cookie Consent.
Individual rights
The merchant is the controller, Trackful is the processor. Requests are handled automatically when the platform forwards them, and every action is logged.
- Shopify's three GDPR webhooks are implemented: data request, customer erasure, shop erasure.
- On WooCommerce, the native WordPress privacy tools trigger the same handling.
- Every data request and every erasure leaves a timestamped record, with the email masked.
- Uninstalling the app deletes the store's data.
Sub-processors
The full list of who touches personal data on our behalf. No third-party analytics and no session replay on the merchant dashboard.
| Sub-processor | Role | Location |
|---|---|---|
| Infomaniak Network SA | Hosting, database, backups | Switzerland |
| Cloudflare | DNS, TLS termination, CDN. No application storage. | Global network |
| Postmark | Email to merchants only, never to their shoppers | USA (Standard Contractual Clauses) |
| Stripe | Billing for WooCommerce merchants. Shopify merchants are billed by Shopify. | EU / USA (Standard Contractual Clauses) |
Ad platforms are not sub-processors
Google Ads, Meta, Google Analytics 4, TikTok, Pinterest and Snapchat are recipients the merchant chooses, under their own agreements. A platform that is switched off is never contacted. What reaches them is SHA-256 hashed, never plain text.
Access
- One person has access to production: the founder. Access control is simple because the list is short, and the day it grows, each person gets their own credentials.
- SSH access only, from a single machine. No shared account.
- Secrets are never in the code repository. The encryption key lives in the server environment rather than the database, so database access alone decrypts nothing.
- No production data is exported to a local machine. Debugging happens against logs and against a separate development environment.
What we do not claim
A security page that only asserts good news cannot be checked. Here are the limits, written by us rather than discovered by you.
No SOC 2 and no ISO 27001
We do not have either, we display no badge that might suggest otherwise, and we will say so on the day that changes.
Backup encryption is not yet confirmed
Our host takes automatic backups. We do not yet have their written confirmation on encryption, so we do not assert it.
IP addresses are kept in plain text for 60 days
They are needed for attribution and deduplication. We would rather say so than talk about "end-to-end encryption".
A small company, not a large security team
Trackful is published by ECOM FR LLC. The trade-off is direct: the person who answers an incident is the person who wrote the code.
A question, or a vulnerability to report
We reply within 24 business hours. A vulnerability report is handled first, and we will not pursue anyone for a good-faith disclosure.
Get in touch