YourTracking connects to Google Ads, Meta and Shopify to deliver server-side conversion tracking on behalf of each merchant. This page describes what each integration accesses, for what purpose, and the commitments that govern the data involved. It supplements our Privacy Policy and Terms of Service.
The company behind YourTracking is named in our Privacy Policy. For any end-customer data, YourTracking acts as a data processor on behalf of the merchant (the controller), under our Data Processing Agreement, which forms part of our Terms and applies from the moment the merchant creates an account.
Google Ads API
The Service connects to the Google Ads API for the Google Ads accounts a merchant chooses to connect, in order to:
What it does
- Conversion delivery: uploading purchase conversions with the real order value, using the click identifiers associated with each order.
- Setup: creating the conversion actions the Service needs on the connected account and switching auto-tagging on.
- Verification: checking that the conversions we send were accepted, so measurement stays accurate.
- Reporting: reading the connected account's spend and campaign results to show them on the merchant's dashboard.
What it never does
- No connections to Google Ads accounts a merchant has not connected.
- No resale, licensing or sharing of Google Ads data.
- No use of one merchant's data for the benefit of any other merchant or advertiser.
- No building of advertising profiles of individuals.
Data obtained through the Google Ads API is used only for these conversion-delivery and measurement purposes, in compliance with the Google APIs Terms of Service and the Google Ads API policies.
Shopify API
Our free Shopify app connects the store to the Service, which reads order data from the merchant's store (order identifiers, values, timestamps and status) as the source of truth that every conversion is matched and reconciled against.
To match a sale to the advertisement that produced it, the Service accesses the following Shopify Protected Customer Data fields: email, phone, name and address, and the store's own customer number for the buyer. These identifiers are used only for conversion matching and are put to the permitted Analytics and Advertising uses; they are hashed with SHA-256 before they are sent, except the postal code and country, which Google requires as they are.
What it does
- Reads orders for the connected store to detect purchases and their value.
- Uses email, phone, name, address and the store's own customer number only to match a purchase to the click that produced it (Analytics and Advertising).
What it never does
- Customer identifiers are hashed before they reach an ad platform, except the fields a platform requires as they are (such as postal code and country for Google, IP address and browser for Meta).
- No use of customer data for anything beyond conversion matching for that same store.
- No sale, rental or sharing of customer data.
Meta Conversions API (CAPI)
The Service sends completed purchases and the shopping steps before them to Meta's Conversions API. Each purchase carries its order id, so Meta counts it once. Personal details such as email addresses and phone numbers are hashed before they are sent. On stores that use them, the Service may also store Meta's own advertising cookies in a visitor's browser, and send a hashed visitor identifier with some of the shopping steps. Both follow the store's cookie setting: on “Follow my cookie banner”, only for a visitor who accepted marketing cookies (a cookie stored for them is removed if they decline later); on “Track everyone”, the merchant decides, and they may also apply to a visitor who declined.
What it does
- Delivers purchases and the steps before them to the merchant's Meta dataset, matched to the click.
- One purchase, one count: each purchase carries its order id, so Meta counts it once.
What it never does
- No refund, cancellation or adjustment events.
- Personal details such as email addresses and phone numbers are hashed before they are sent; the technical details an ad platform needs to work (such as the connection's IP address and browser) are passed on in the form the platform requires.
- No cross-merchant use of data.
Klaviyo (optional)
When a merchant adds a Klaviyo key, the Service reads the account's email results to show them and uses it to match sales. It never writes to Klaviyo.
Commitments
- Purchases and the steps before them. The Service sends completed purchases and the shopping steps that lead to them (a visitor's activity on the store before a purchase); it never sends refunds or cancellations to any ad platform. On Google it may correct the value of a purchase it already sent, when a paid order grows after checkout.
- Personal details hashed before they leave. Customer identifiers are hashed with SHA-256 before they are sent to Google or Meta, except the fields a platform requires as they are (such as postal code and country for Google, IP address and browser for Meta).
- No sale of data. Nothing the Service processes is sold, rented or shared with unrelated third parties.
- Per-client isolation. One merchant's data is never used for the benefit of another merchant or advertiser, and clients' data is isolated.
- Least privilege & security. Each integration carries only the access it needs; data is encrypted in transit and at rest, secrets are stored by reference, and access is audited. See our Privacy Policy for the full security and GDPR detail.
Sub-processors
The Service is hosted on Google Cloud (EU-resident hosting, managed database and TLS edge in europe-west1, Belgium). Our emails are sent through Resend, the bot check on our sign-in forms is Cloudflare's, and Stripe takes the payments of clients billed through it. Google, Meta, Shopify and Klaviyo receive or provide data because the merchant connects them. See our Sub-processors page.
Contact
Questions about our data practices can be sent to info@yourtracking.ai.