Privacy Policy

Last updated: 28 October 2026

This policy explains what personal data TrackPilot ("we") processes when you use TrackPilot (the "Service") and our website, and when visitors browse websites that use the Service.

1. Two roles

• Our customers' data (account holders): we are the controller.
• Visitors of our customers' websites (event data): our customer is the controller and we act as a processor on their behalf, under our Data Processing Agreement.

2. Data we collect about customers

• Account: name, email, password (stored as a one-way hash), workspace and team details.
• Billing: plan, invoices, payment references (for example bKash transaction ID and sender number). We do not store card numbers.
• Configuration: sites, domains, Meta Pixel IDs and Conversions API access tokens (encrypted at rest).
• Technical: IP address, browser, log-in times and security logs; messages you send us.
• If you connect a Facebook account for ads analytics (when available): the ad account data you grant, with tokens encrypted at rest.

3. Event data processed for customers

When a website uses the Service, our script and servers receive events such as page views, add-to-cart and purchases, with: event name, ID and time, page URL, IP address, user agent, Meta cookies (_fbp, _fbc), purchase details, and — if the customer sends them — email, phone, name, address and customer ID. Email, phone, name, address and customer ID are normalised and SHA-256 hashed on arrival, before storage or queueing. Events are forwarded to the advertising platforms the customer configured (currently Meta). Event logs are deleted automatically after 7 days; monthly event counts are kept for billing.

4. Why we use data (legal bases)

• To provide the Service and support (contract).
• Billing, tax and accounting (legal obligation).
• Security, abuse prevention and service improvement (legitimate interests).
• Service emails such as usage alerts and invoices (contract); marketing emails only with your consent, and you can unsubscribe any time.

5. Sharing

We share data only with: the advertising platforms our customers configure (Meta Platforms); hosting, email and payment providers that process it for us; and authorities where the law requires it. We do not sell personal data.

6. Cookies on our website

Our own website uses only cookies needed for log-in, security (CSRF) and your currency choice. The tracking script sets _fbp, _fbc and, where consent is required, _trk_consent on our customers' websites; customers are responsible for their consent banner.

7. Retention

Account data: while your account is active and up to 30 days after deletion (backups up to 30 more days). Invoices: as long as tax law requires. Event logs: 7 days. Contact messages: up to 2 years.

8. Security

TLS for all traffic, encryption at rest for secrets and access tokens, hashed passwords and customer PII, admin access with two-factor authentication, and least-privilege access.

9. International transfers

Our servers are in the European Union. Event data is sent to Meta, which may process it in other countries under its own terms.

10. Your rights

You can ask to access, correct, export or delete your data, or object to processing. Visitors of our customers' websites should contact the website owner first; we will help them. See Data Deletion.

11. Children

The Service is for businesses and not directed to children under 16.

12. Changes

We will post changes here and email customers about important ones.

Contact

TrackPilot, Dhaka, Bangladesh · [email protected] · contact form