Privacy Policy

This Privacy Policy explains how Web Cue LLC (“TrackCrown”) ("we", "us", "our") collects, uses, shares and protects personal data in connection with the TrackCrown performance-marketing tracking platform — the click-tracking domains we operate for our customers, the TrackCrown web application, partner and advertiser portals, APIs and landing-page script (together, the "Service") — and the TrackCrown website.

1. Who we are and what this policy covers#

Web Cue LLC operates TrackCrown, a software service that advertisers, agencies, affiliate networks and lead-generation businesses (our "customers") use to measure their advertising and partner-marketing campaigns. Web Cue LLC, 16192 Coastal Highway, Lewes, DE 19958, USA, is responsible for the processing described in this policy.

This policy applies to:

• people who click or view an ad, tracking link or pixel served from a tracking domain we operate ("visitors");
• users of the Service — our customers' staff and the partners (affiliates) and advertisers they invite to the panel, portals or API;
• visitors to our website and people who contact us.

It does not cover the websites our tracking links lead to, or how our customers, their advertisers or their partners use data in their own systems. Those businesses publish their own privacy notices.

2. Our role: controller and processor#

• Campaign data — the click, impression and conversion records described in section 4 — is processed on behalf of the customer that runs the campaign. For this data the customer is the controller (under the EU and UK GDPR) or the business (under US state privacy laws), and Web Cue LLC is its processor or service provider, acting only on the customer's instructions under our Data Processing Addendum.
• Web Cue LLC is the controller of account data, website and contact-form data, and of the limited data we use across the Service to keep it secure and to prevent fraud and abuse (section 6).

If you have a question about a campaign you interacted with, the advertiser or network whose ad or link you clicked is usually the best first contact. You can also contact us and we will pass your request to the customer concerned (section 12).

3. How click tracking works#

When you click an ad or link that uses one of our tracking domains, your browser sends a short request to our server. The server records the click and answers with a single redirect (HTTP 302) to the destination website, or with a short notice page if the link is not active. Tracking domains host no content of their own, show no ads and never ask you to enter information.

Links used in Google Ads and other transparent tracking set-ups carry the next destination in a visible url parameter. Our server redirects to exactly that address in one step, or shows an error page if the customer has not approved the address; for these links the destination never depends on who you are, where you are or which device you use. Partner (affiliate) links and smart links without a url parameter lead to the offer the customer has configured, which may differ by country or device. Opening the home page of any of our tracking domains shows who operates it.

4. Personal data we process#

4.1 Click and impression data#

When a tracking link, impression pixel or conversion pixel is requested, we record:

• Request details: the time, the tracking domain and link requested, the destination address the visitor was sent to, and the outcome (redirected, refused or shown a notice page).
• Network data: your IP address and, derived from it, an approximate location (country, region and city) and network operator (autonomous system number and organisation name). The location is looked up on our own servers in an offline database from DB-IP; no data is sent to DB-IP. We do not collect precise (GPS) location.
• Browser and device data: the user-agent string your browser sends and, derived from it, the device type, operating system, browser and their versions, and the device brand and model where the user agent reveals them; your browser's preferred language; and the referring page (the "referrer"), when your browser sends it.
• Click identifiers: the random click ID we generate for each click, and identifiers that advertising platforms add to links, including Google click identifiers (gclid, gbraid and wbraid), the Meta click ID (fbclid), the Microsoft Advertising click ID (msclkid) and the TikTok click ID (ttclid).
• Campaign parameters: values the customer, its partners or the ad platform add to the link, such as campaign, ad group, ad, keyword, match type, network, device, placement, location and target identifiers (for example Google Ads ValueTrack parameters), sub IDs (sub1 to sub10), a source ID and any other parameters in the link.
• Fraud and quality signals: flags such as whether a request appears to come from a bot, automation tool, headless browser or data-centre network, carries proxy headers, is a browser prefetch, lacks the headers browsers normally send, contains unexpanded link placeholders or exceeds rate limits, and whether it was the first click from the same IP address and browser for the campaign within 24 hours.

We ask customers not to put names, e-mail addresses, phone numbers or other directly identifying information into link parameters; our Acceptable Use Policy prohibits it.

4.2 Conversion events#

When a customer, its advertiser or a pixel on its website reports that a visitor completed an action — for example a sign-up, lead or purchase — we store the event type, time and status (approved, pending or rejected); the advertiser's order or transaction reference; the sale amount, revenue, payout and currency; up to five advertiser values (adv1 to adv5) and other parameters the reporting system sends; the IP address of the system that reported the conversion (for a browser pixel, the visitor's IP address; for a server-to-server postback, the reporting server's); and, copied from the matched click for reporting, its campaign parameters, click identifiers, approximate location, device type, operating system and browser.

4.3 Data stored in your browser#

Tracking links do not set cookies by default. A customer may enable a first-party click-ID cookie on its own tracking domain, and customers may install our landing-page script on their own websites, which stores the click ID in a first-party cookie and local storage on that website. Both hold only the random click ID, for up to 30 days. See our Cookie Policy.

4.4 Postbacks, conversion uploads and feeds a customer configures#

Customers can configure the Service to notify their partners' or their own systems when a conversion happens ("postbacks"), to make conversion data available to their own Google Ads account as an offline-conversion feed or upload it to a Google Ads account they connect, and to send conversions to the conversion APIs of Meta, TikTok and Microsoft Advertising. We send only the values the customer chooses — for example a click ID, Google click ID, conversion time, value or sub ID — to the addresses the customer sets, and keep a delivery log of each request (the address called, the response status and the first 500 characters of the response).

A Google Ads upload or conversion-API request carries the conversion event the customer configured: the event name, time and identifier, the value, currency and order reference, the advertising platform's own click identifier and, where the conversion includes an e-mail address or phone number, a SHA-256 hash of it. Conversion-API requests also carry the IP address and user agent recorded with the click, a hash of our click ID and the address of the page where the conversion happened, when known. For these requests the delivery log keeps the request without the customer's access token and the first 2,000 characters of the platform's response.

4.5 Account and usage data#

For people who use the panel, portals or API we process: name, e-mail address, password (stored only as an argon2id hash), optional two-factor authentication secret (stored encrypted), workspace memberships and roles, display time-zone preference and last sign-in time; for each sign-in session, a random session token stored only as a SHA-256 hash, the browser's user agent and a keyed hash of the IP address; API keys (stored only as hashes) and when they were last used; and an audit log of actions taken in the workspace (who did what and when, with a keyed hash of the IP address). Customers also store business contact details of their partners and advertisers in the Service, such as company and contact names, e-mail addresses, phone numbers, messaging handles and payout details.

4.6 Website and contact data#

Our website sets no cookies and loads no third-party analytics, advertising or social-media scripts. When you send a message through our contact, demo-request, abuse-report or privacy-request forms, we store your name, e-mail address, company, the topic and your message (including any details you add, such as your role or approximate traffic volume), and a keyed hash of your IP address that we use to limit spam. If you buy a paid plan we process the billing contact and company details needed to invoice you; we do not collect payment-card numbers through the Service.

4.7 Technical logs#

Our servers record operational events and errors, such as a failed postback delivery or a configuration problem, so that we can run and secure the Service. These logs rotate automatically and are overwritten as new entries are written.

4.8 What we do not collect#

We do not ask visitors for their name or contact details, do not collect precise location, do not knowingly process special categories of personal data (such as health, religion or sexual orientation), and do not combine tracking data across customers to build profiles of individuals.

5. Where the data comes from#

• Your browser or device, when it requests a tracking link, pixel or script.
• Our customers, their advertisers and their partners, who add parameters to links and report conversions through postbacks, pixels, file imports, the API or the panel.
• Advertising platforms, which add click identifiers and campaign values to the links you click.
• You, when you create an account, use the Service or contact us.
• Our own servers, which derive approximate location, network and device information from each request.

6. Why we use personal data and our legal bases#

We use personal data for these purposes:

• Attribution: connecting clicks and impressions to later conversions, so customers can see which campaigns, ads and partners produced results.
• Fraud prevention and security: detecting bots, duplicate and invalid traffic and abuse of the Service, and investigating abuse reports.
• Reporting: giving customers aggregated and per-click statistics about their own campaigns.
• Billing: calculating what customers owe their partners and what advertisers owe customers, and invoicing our own service.
• Operating the Service: providing accounts, sign-in, the API and support, keeping the platform running and answering enquiries.

For campaign data we act as a processor: the customer decides why the data is processed and is responsible for having a legal basis — typically its legitimate interest in measuring and paying for advertising, or consent where it collects consent. Where the EU or UK GDPR applies to our own processing, we rely on the following legal bases under Article 6(1):

Where we rely on legitimate interests we have weighed them against your rights: we limit the data to what measurement and security need, set no cookies by default, keep raw click records for a limited time and never use them for our own advertising. You can object to this processing (section 12).

Automated processing. The Service flags clicks that look automated or invalid. Flags are recorded for reporting and conversion review; they never change where a link redirects and do not produce legal or similarly significant effects for visitors. We do not make decisions based solely on automated processing within the meaning of Article 22 GDPR.

7. How long we keep data#

Data deleted from our live systems disappears from backups when those backups expire.

8. How we share personal data#

We disclose personal data only to:

• the customer that runs the campaign and the people it authorises in its account: its staff according to their role, its partners (limited to their own traffic and conversions) and its advertisers (limited to their own offers);
• recipients the customer configures: the destination website receives the click ID and any values the customer places in the destination address, partner or customer systems receive postbacks, the customer's Google Ads account receives conversions through an offline-conversion feed or a connected upload, the conversion APIs of Meta, TikTok and Microsoft Advertising receive the conversion events described in section 4.4, storage the customer connects receives the raw click and conversion exports it sets up, and PayPal receives the partner's PayPal e-mail address and the amount when the customer pays partners through PayPal Payouts;
• sub-processors that host and operate our infrastructure, under written contracts that require them to protect the data and use it only to provide their services to us — the current list is on our Sub-processors page;
• optional service providers, only where we have configured them for the Service: an e-mail delivery provider (the recipient's address and the content of the e-mails the Service sends), S3-compatible object storage (files uploaded to the Service, such as partner documents and creatives) and Anthropic, which powers the optional in-app assistant and receives the questions a signed-in user asks and the workspace data the assistant reads to answer them — each is listed on our Sub-processors page when in use;
• professional advisers such as lawyers, accountants and auditors, who are bound by confidentiality;
• authorities and others where the law requires it, or where necessary to establish, exercise or defend legal claims, or to protect the rights, property or safety of our customers, visitors, advertising platforms or us — for example to investigate fraud, phishing or malware;
• a successor business if we are involved in a merger, acquisition or sale of assets; the successor must continue to protect the data as this policy describes.

To protect visitors, we check the hostnames that tracking links redirect to against Google Web Risk, and our own tracking domains against Google Web Risk and the Spamhaus and SURBL blocklists. These lookups contain only hostnames and the IP addresses of our servers — never data about visitors.

We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not use tracking data for our own marketing or advertising. We have not done so in the past 12 months.

9. Advertising platforms#

Our tracking links work with advertising platforms such as Google Ads, Meta, Microsoft Advertising and TikTok. Web Cue LLC is not affiliated with or endorsed by these platforms. Each platform processes data about your interaction with its ads under its own privacy policy. We send click or conversion data to an advertising platform only when the customer that runs the campaign configures it (section 4.4).

10. Cookies and similar technologies#

Our tracking domains do not set cookies unless a customer turns on the optional click-ID cookie described in section 4.3. Our website sets no cookies. The TrackCrown web application uses one strictly necessary cookie to keep you signed in and stores a few display preferences you choose. Our Cookie Policy lists each cookie and storage key.

11. International transfers#

The Service's servers and databases are hosted in India (see our Sub-processors page), and personal data may be accessed from other countries where we or our service providers operate, including the United States. Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), with the UK International Data Transfer Addendum and the Swiss amendments where they apply, as incorporated in our Data Processing Addendum and in our agreements with sub-processors, together with the security measures in section 13. You can ask us for a copy of the relevant safeguards.

12. Your rights and how to exercise them#

12.1 EU, UK and Swiss rights#

If the EU or UK GDPR or the Swiss Federal Act on Data Protection applies, you have the right to access your personal data, to have it corrected or erased, to restrict its processing, to receive it in a portable format, to object to processing based on legitimate interests, and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with a supervisory authority — in the EU, the authority where you live, work or where the alleged infringement took place; in the UK, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner.

12.2 US state privacy rights#

Depending on your state of residence, and to the extent those laws apply to us, you may have the right to know what personal data we hold about you and to access it, to delete it, to correct it, to obtain a portable copy, to opt out of its sale, sharing for cross-context behavioural advertising, targeted advertising and profiling (we do none of these), to limit the use of sensitive personal information (we use account sign-in credentials only to authenticate you), not to be discriminated against for exercising your rights, and to appeal our decision on your request. California residents can find our notice at collection and request options on our Your Privacy Choices page.

12.3 Requests about campaign data#

Because we process campaign data on behalf of our customers, we pass requests about it to the customer that runs the campaign and help that customer to respond. Where we cannot identify the customer, or where we hold the data as a controller (for example security records), we respond to you directly.

12.4 How to make a request#

Use the privacy request form or contact us using privacy@trackcrown.com. Tell us what you are asking for. Tracking records are not linked to names, so to help us find them please include as many of these details as you can: the full link you clicked or the click ID, the approximate date and time (with your time zone), the public IP address you were using, and the browser and device. If we cannot find the records, or cannot confirm that they relate to you, we will tell you.

12.5 Verification and authorised agents#

We verify requests to access, delete or correct personal data before acting on them, using information proportionate to the request — for account holders, by confirming the request from the e-mail address on the account; for tracking data, by matching details about the click that only the person who made it is likely to know. You may use an authorised agent: we will ask for your signed permission and may ask you to confirm your identity with us directly, unless the agent holds a valid power of attorney.

12.6 Timing, fees and appeals#

We respond within one month under the GDPR (extendable by two further months for complex requests) and within 45 days under US state laws (extendable by a further 45 days where reasonably necessary), and we tell you if we need the extension. Requests are free of charge unless they are manifestly unfounded or excessive. If we decline your request you may appeal by replying to our decision; we answer appeals within the period your state's law requires. If you are not satisfied with the outcome you may contact your state attorney general or your supervisory authority.

13. Security#

Traffic to every tracking domain, website and application hostname is encrypted with TLS. Passwords are hashed with argon2id, session tokens and API keys are stored only as SHA-256 hashes, two-factor secrets are encrypted, access to customer data is restricted by role and by workspace, databases are reachable only on a private network, account changes are written to an audit log, and backups are taken daily. No method of transmission or storage is completely secure; if a personal data breach occurs we will notify affected customers and authorities as the law and our Data Processing Addendum require. See our Security page.

14. Children#

The Service is a business tool and is not directed at children. Accounts are for people aged 18 or over acting for a business. We do not knowingly collect personal data from children under 16, and customers must not use the Service for campaigns directed at children where the law requires parental consent for tracking. If you believe we hold data about a child, contact us and we will delete it or pass the request to the customer concerned.

15. Do Not Track and Global Privacy Control#

There is no common standard for responding to "Do Not Track" browser signals, so our tracking links behave the same whether or not one is sent; we do not track visitors across unrelated websites. We treat a Global Privacy Control (GPC) signal as a valid request to opt out of the sale or sharing of personal data for the browser that sends it. Because we do not sell or share personal data, honouring the signal does not change how our tracking links work.

16. Representatives and data protection officer#

We have not appointed a representative in the European Union or the United Kingdom under Article 27 of the EU or UK GDPR, or a data protection officer. Please send any data protection question or request directly to us using privacy@trackcrown.com.

17. Changes to this policy#

We update this policy when the Service or the law changes, and post the new version on this page with a new "Last updated" date. If a change materially affects how we process personal data, we notify customers' account owners by e-mail or in the panel before it takes effect.

18. Contact#

Web Cue LLC
16192 Coastal Highway, Lewes, DE 19958, USA
Registration: Delaware State File No. 7576591
Country of incorporation: United States
Privacy enquiries: privacy@trackcrown.com