TrackAff Privacy Policy
Effective date: 6 August 2026 · Version 2.2 · TrackAff is operated by AVDA LTD
1. Who We Are
TrackAff (“we”, “us”, “our”) is a server-side conversion tracking platform operated by AVDA LTD, a company registered in England and Wales (Company number: 16966342), with its registered office at 20 Wenlock Road, London, England, N1 7GU, United Kingdom.
This Privacy Policy applies to the websites trackaff.io and trackaff.io, the application at app.trackaff.io, and all hosted opt-in pages operated through the TrackAff platform (together, the “Service”).
For questions about this policy or your personal data, contact us at sales@trackaff.io.
2. Our Two Roles: Controller and Processor
TrackAff acts in two distinct legal roles under the UK GDPR and equivalent laws, and your rights depend on which role applies:
Data Controller. For data about our customers (account holders) and visitors to our websites, we are the data controller. This covers account details, billing information, and website usage data.
Data Processor. For personal data submitted by end users (“leads”) through opt-in pages operated by our customers, we are a data processor acting on the customer’s documented instructions. The customer (the business whose opt-in page the lead completed) is the data controller for that data. If you submitted your details through an opt-in page, the business named on that page is responsible for your data, and privacy requests should be directed to them; we will assist them in fulfilling such requests.
3. Data We Collect as a Controller
3.1 Account data
When you register for TrackAff we collect your name, email address, phone number, password (stored hashed), timezone, and system currency preference.
3.2 Billing data
Payments are processed by Stripe. We do not store full card numbers on our systems. We retain billing records, subscription status, invoices, and, for fraud-prevention purposes, payment method fingerprints and signup IP addresses provided by Stripe.
Stripe’s own privacy policy (stripe.com/privacy) and terms of service govern their processing of your payment details.
3.3 Website and usage data
We collect standard technical data when you use our websites and application: IP address, browser and device information, and pages viewed. Our marketing website uses the Meta Pixel for advertising measurement, subject to your cookie consent (see Section 11).
3.4 Communications
If you contact us for support or sales, we retain the correspondence.
4. Data We Process as a Processor (Lead Data)
When a lead completes a customer’s opt-in page, the platform collects on the customer’s behalf:
Hashing before transmission. Before any conversion event is transmitted to Meta, all directly identifying personal data — email, first name, last name, phone number, and country — is one-way hashed using SHA-256. Meta receives hashed match signals together with technical identifiers; it does not receive readable personal information from us.
5. Purposes and Lawful Bases
As controller: we process account and billing data to provide the Service under our contract with you (Article 6(1)(b) UK GDPR); to meet legal and accounting obligations (Article 6(1)(c)); and for fraud prevention, service security, and product improvement under our legitimate interests (Article 6(1)(f)). Advertising cookies on our website are used only with your consent (Article 6(1)(a)).
As processor: we process Lead Data solely to provide the Service to the relevant customer — storing submissions, transmitting conversion events to Meta’s Conversions API, and delivering data to destinations the customer configures (such as CRM webhooks). The customer, as controller, is responsible for establishing the lawful basis for this processing. We never use Lead Data for our own purposes, never sell it, and never use it to build advertising profiles.
6. How Lead Data Flows Through the Service
1. A lead completes a customer’s branded opt-in page and is redirected to the customer’s chosen destination.
2. The submission is stored in the customer’s TrackAff dashboard.
3. A conversion event containing hashed identifiers and technical data is transmitted server-to-server to Meta Platforms via the official Conversions API endpoint, either automatically or upon the customer’s manual approval.
4. If the customer has configured a CRM webhook, the lead record is transmitted to the customer’s chosen endpoint, signed with HMAC-SHA256. Webhook destinations are selected and controlled entirely by the customer; the customer is responsible for the privacy practices of those destinations.
Meta Business Tools compliance. Our transmission of conversion events via Meta’s Conversions API is carried out in accordance with Meta’s Business Tools Terms and Meta’s Commercial Terms for the use of Business Tools. As set out in Section 4, we do not transmit readable personal information to Meta — only one-way hashed identifiers and technical signals.
7. Sharing and Sub-Processors
We share personal data only with the service providers necessary to operate TrackAff:
A current list is maintained at trackaff.io/sub-processors. We will update that page at least 14 days before adding a new sub-processor that handles Lead Data. We do not sell personal data to anyone.
8. International Transfers
Our infrastructure is hosted on Amazon Web Services in the United States (US East / N. Virginia, us-east-1). Where personal data originating in the United Kingdom or European Economic Area is transferred to the United States, we rely on appropriate safeguards, including the UK International Data Transfer Addendum and EU Standard Contractual Clauses with our sub-processors, and, where applicable, the UK–US Data Bridge and EU–US Data Privacy Framework certifications held by those providers.
9. Retention
Account and billing data: retained for the life of the account and thereafter as required for legal, tax, and accounting purposes.
Lead Data: retained while the customer’s account remains active and in use, so that customers keep access to their submission history. Customers can delete individual leads or export and purge their data at any time from the dashboard. Lead Data held in accounts that are no longer actively using the Service is automatically purged 12 months after collection. When an account is closed, all associated Lead Data is deleted within 30 days.
Technical logs: event transmission and webhook delivery logs are retained for up to 12 months for troubleshooting and audit purposes.
10. Security
We protect personal data with encryption in transit (TLS) and at rest, SHA-256 one-way hashing of identifying fields before transmission to Meta, role-based access controls, encrypted storage of Pixel access tokens, and HMAC-SHA256 signing of webhook payloads. In the event of a personal data breach affecting your data, we will notify the relevant supervisory authority and affected parties as required by law, and will notify affected customers without undue delay where Lead Data they control is involved.
11. Cookies
Our marketing website uses essential cookies required for the site to function, and, with your consent, the Meta Pixel for advertising measurement and retargeting. You can accept or reject non-essential cookies via the consent banner, and change your choice at any time through the banner settings. Hosted opt-in pages set only the cookies necessary to provide the tracking service the page exists to perform; the customer operating the page is responsible for any disclosures required on it.
12. Your Rights (UK GDPR and EU GDPR)
Where we act as controller, you may request access to, rectification of, or erasure of your personal data; restriction of or objection to processing; and data portability. You may withdraw consent at any time where processing is based on consent. To exercise these rights, email sales@trackaff.io. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk, or with your local supervisory authority.
Where we act as processor, please direct requests to the business that collected your data; we support our customers in fulfilling all data subject requests.
13. How to Request Deletion of Your Data
If you are a TrackAff customer, you can delete individual leads, or export and purge your data, at any time from your dashboard, and you may close your account to have all associated Lead Data deleted within 30 days.
If you are an end user (a lead) and wish to have your data deleted, please contact the business whose opt-in page you completed, as they control that data. You may also email us at sales@trackaff.io and we will action the request and assist the relevant customer in fulfilling it. Where a deletion request relates to data already transmitted to Meta, deletion within Meta’s systems is subject to Meta’s own processes; we will not send further events for the affected record.
14. California and US State Privacy Rights
If you are a California resident, the California Consumer Privacy Act (CCPA/CPRA) provides you with rights to know what personal information we collect, to request deletion or correction, and not to be discriminated against for exercising these rights. The categories of personal information we collect are described in Sections 3 and 4: identifiers, commercial information, and internet activity information. We do not sell personal information and do not share personal information for cross-context behavioural advertising, other than the consent-based Meta Pixel on our marketing website, which you can decline via the cookie banner. To exercise your rights, email sales@trackaff.io. Residents of other US states with comparable privacy laws hold equivalent rights and may use the same contact.
15. Children
The Service is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a minor’s data has been submitted through the Service, contact us and we will delete it.
16. Changes to This Policy
We may update this policy from time to time. Material changes will be notified to customers by email or in-app notice at least 14 days before taking effect. The effective date at the top of this page reflects the latest revision.
17. Contact
AVDA LTD, 20 Wenlock Road, London, England, N1 7GU, United Kingdom. Email: sales@trackaff.io.
