This translation is provided for convenience. For Users in Brazil, the Portuguese version prevails in case of any discrepancy (Terms of Service, Section 17.6).

TRACKNANA PRIVACY POLICY

Version: 1.0
Last updated: October 22, 2026
Contact: [email protected] | Legal and privacy channel: [email protected]

1 | SUMMARY TABLE

This table exists only for immediate transparency and does not replace reading the corresponding sections. Each topic is developed in detail throughout the document, and the wording of the sections prevails in case of doubt.

2 | INTRODUCTION

This Privacy Policy (“Policy”) describes the practices of Tracknana Software Development Ltda., registered under CNPJ No. 66.059.324/0001-03, trading as Tracknana, headquartered in the city of Mamborê, state of Paraná, Brazil (“Company”, “Tracknana”, “We”), regarding the collection, use, storage, sharing and protection of personal data when You use the Tracknana application, the website www.tracknana.com and all related services (together, the “Service”).

This Policy applies to all Users of the Service (“User”, “You”). Tracknana is headquartered in Brazil and operates primarily under the Brazilian General Data Protection Law (Law No. 13,709/2018, LGPD). The Service may be accessed by users in different countries, especially in the Americas, and Tracknana seeks to respect the fundamental privacy rights provided for in the applicable local laws, without prejudice to Brazilian law as the governing law.

We use the terms “Personal Data” and “Personal Information” interchangeably throughout this Policy, unless applicable law requires a specific term.

3 | CONSENT AND RECORD OF ACCEPTANCE

By creating an Account and using the Service, You acknowledge and declare that You have read, understood and accepted this Policy, as well as the Terms of Service and the Data Processing Agreement.

Acceptance is given through a specific checkbox, shown before sign-up is completed, with the following wording:

“I declare that I have read, understood and unequivocally accepted the Privacy Policy, the Terms of Service and the Data Processing Agreement, and I CONSENT to the COLLECTION and PROCESSING of my DATA under the terms described therein.”

Record of acceptance. Tracknana records and stores, linked to Your Account, the date and time of acceptance, the source IP address, the User-Agent and the version of the documents in force at that moment. This record serves solely to prove the expression of will, under art. 8, § 2, of the LGPD, and You may obtain it on request, under Section 16.

Prior reading. The applicable documents remain permanently available on the website, with prominent access before the account is created and on the pricing page, so that You can read them in full before accepting.

Separate consent for optional communications. Consent to receive communications about news, launches, offers and content is collected in a separate checkbox, unchecked by default, and may be withdrawn at any time without affecting the use of the Service, under Section 22.

4 | DEFINITIONS

5 | WHO THE PROCESSED DATA REFERS TO

The Service involves two distinct populations of data subjects, and this distinction determines how each right is exercised:

Level A data subjects: Users. You, who create an account and subscribe to the Service. Regarding this data, Tracknana is the Controller.

Level B data subjects: leads, buyers and visitors. People who interact with the User's pages, forms and checkouts. This data reaches Tracknana by webhook or through the Tracknana Pixel. Regarding it, Tracknana is the Processor and the User is the Controller.

If You are a Level B data subject and wish to exercise rights over your data, the right party to contact is the company or professional whose website, ad or checkout You used, since that person decides the purposes of the processing. Tracknana cooperates with that request under Section 16.4.

6 | OUR ROLES IN PROCESSING (CONTROLLER × PROCESSOR)

When we act as Controller, we define the purposes and means of processing and answer directly to You.

When we act as Processor, we process the data exclusively according to the User's instructions and for the purposes of the Service. In those cases, the User is responsible for defining the purpose, establishing the legal basis, obtaining the necessary consents, fulfilling the transparency duties towards data subjects and responding to those data subjects' requests. This relationship is formalized in the Data Processing Agreement (DPA), a standalone document available on our website.

7 | WHAT DATA WE COLLECT AND WHY

A simplified overview, developed in the following subsections:

• Sign-up data: username, email and password. Basis: performance of contract
• Payment and tax data: processed by Stripe; we receive status and identifiers and, when You subscribe as a company, the CNPJ for the invoice. Basis: performance of contract; legal obligation
• Authentication data: 2FA secret and recovery codes. Basis: legitimate interest in security
• Preferences and settings: language, theme, currency, notifications, UTMs, webhook endpoints. Basis: performance of contract
• Integration data: tokens and identifiers of the accounts You link. Basis: performance of contract
• Tracking data: sales and lead events received by webhook and Pixel. Basis: legitimate interest of the controlling User
• Access logs: IP and date/time. Basis: legal obligation (art. 15 of the Brazilian Internet Civil Framework); other fields by legitimate interest in security

7.1 | Information You provide directly

7.1.1 Account sign-up. We collect username, email address and password. The password is stored exclusively as a salted hash, generated by the bcrypt algorithm, which means we do not store, and have no way to recover, your password in readable text. After sign-up, we send a verification email and generate a temporary token to confirm ownership of the address. Equivalent tokens are generated for password resets. All of them expire automatically after use or after a set period.

7.1.2 Two-factor authentication. If You enable 2FA, we store (i) a TOTP secret key associated with Your Account, encrypted at rest with AES-256-GCM, and (ii) a set of single-use recovery codes, stored as hashes, never in plain text. Both are permanently deleted when You disable 2FA or delete the Account. We have no way to recover your TOTP secret or your recovery codes if You lose them.

7.1.2-A Sessions and devices. For each device on which You log in, we keep a record with IP address, User-Agent, creation date and date of last use. It exists for two reasons: keeping Your session active without a new login on each access, and letting You see, in "My Account", where Your account is connected.

You can revoke a specific session or all the others at any time. Each session expires automatically within 14 days. On the devices screen, the IP address is omitted when it is not a public address.

7.1.3 Payment information. When You subscribe to a paid plan, payment is processed by Stripe. We store the plan type, the end date of the period subscribed to and the subscription and customer identifiers at Stripe. The billing history remains at Stripe and can be consulted in the billing portal. For Pix payments, we also record, for each one, the amount, the plan, the type (subscription, renewal or plan change) and the payment identifiers at Stripe, with no name, email, CPF or CNPJ.

Payment can be made by card, boleto or Pix. For boleto and Pix, Stripe asks for the payer's CPF or CNPJ, as those payment methods require. That data stays with Stripe: Tracknana consults it only when it is a CNPJ, to issue the invoice, and does not store it in its systems. For Pix, Stripe operates with the partner Ebanx, which appears as the recipient on the payer's statement and may send the payment receipt.

Invoice. We issue an Electronic Service Invoice (NFS-e) for each confirmed payment, in the system of the Municipality of Mamborê, and send it to the registered email. For individuals, the invoice is issued without a CPF; for Users abroad, as a foreign service recipient; for legal entities, with the CNPJ and corporate name, obtained from the boleto or Pix payment or provided by You by email or WhatsApp.

Boleto refunds. Boleto payments cannot be reversed. If You are entitled to a refund of a payment made by boleto, we will ask for the details of a bank account or Pix key held by the payer, used exclusively for the transfer.

We do not receive, process or store the full card number, the CVV or any sensitive payment credentials. That data is handled exclusively by Stripe, in compliance with the PCI-DSS standard. On the billing screen, we show the card brand and the last four digits, retrieved from Stripe, kept for up to 1 minute in temporary memory and not stored in a database.

About Stripe: a global financial infrastructure platform specialized in payment processing. Stripe acts in a dual role: it is an independent controller of the payment data it collects directly from You, and a processor of the information it passes to Tracknana for subscription management. The relationship is governed by Stripe's Data Processing Agreement, which provides for a contractual international transfer instrument, under Section 15. We recommend periodically consulting Stripe's Privacy Policy.

7.1.4 User preferences. We store theme, language, currency and notification preferences. These preferences are recorded on the server, linked to Your profile, and not in browser cookies, so that they follow You on any device after login.

7.1.5 UTM and webhook settings. We store the UTM parameters, trackable links and webhook endpoint settings You create within the Service.

7.1.6 Tax, fee and commission settings. If You use the net values module, we store the percentages and amounts You provide (tax rate, commission and fixed fee per sale, and the rate on ad spend), as well as a record of the percentage in force on the date of each order.

None of these fields is personal data: they are percentages and amounts. The percentages and amounts You configure are not shared with ad or payment platforms. When You use the AI Assistant, the rate on ad spend and the resulting tax form part of the summary sent to OpenAI, which acts as Processor (Section 21.1). Because they reveal your commercial terms, they are treated as Your confidential information, under the Terms of Service.

7.2 | UTM Tracking Script

Tracknana provides a JavaScript script (“UTM Tracking Script”) that You can embed in checkout pages or landing pages using a standard HTML tag. The script reads from the visitor's browser URL the parameters utm_source, utm_medium, utm_campaign, utm_content, utm_term and utm_id.

Loading. The visitor's browser downloads the script from Tracknana's servers, or from Cloudflare's cache, when it opens the page. That loading, like any request to our servers, generates an access log entry with IP, date and time and User-Agent, kept for 6 months under art. 15 of the Brazilian Internet Civil Framework (Section 7.5.1).

Local processing. Once loaded, the script works exclusively in the visitor's browser and sends no information to Tracknana's servers: it makes no network request of any kind.

No cookies. The values read are stored in the visitor's browser localStorage for up to 30 days. The script sets no cookies of its own and does not perform device fingerprinting (fingerprinting).

Personal data filter. The script has built-in validation that automatically rejects values containing personal data patterns, such as email addresses and, when written in the usual format, CPF, CNPJ, phone numbers and card numbers.

Sale attribution. The script adds to the page's payment links the origin parameters not already present in them, acting as a bridge that preserves which campaign generated the sale. The payment platform receives those parameters with the link.

Important. Apart from the access log entry generated by loading it, the UTM Tracking Script neither collects nor transmits personal data to Tracknana. However, the parameters it adds may later return to Tracknana, within the payload sent by the Payment Platform You configured, at which point we act as Processor, under Section 7.4.4.

7.2.1 The User's responsibility. You alone are responsible for ensuring that the script is used in compliance with applicable law and with the rules of the platforms where it is installed. It is exclusively up to You to: state clearly, in your own privacy policy, that You use campaign tracking and attribution mechanisms; obtain visitors' consent when required by applicable law; and ensure that the installation respects the terms of the host platform.

Tracknana has no control over the content of the pages where the script is installed, over the way You collect your customers' data, over the legal bases You use, or over the information You give your visitors.

7.3 | Tracknana Pixel

The Tracknana Pixel is an additional JavaScript script, available on paid plans, within each plan's limits (Section 7.7 of the Terms of Service), that You can embed in your sales pages or landing pages. Unlike the UTM Tracking Script, the Pixel actively transmits data to our servers. When the plan is downgraded, the Pixel above the new limit is paused: the browser's query is refused, and nothing is collected or stored in the visitor's browser.

7.3.1 Data collected. You select, from a predefined list in the Dashboard and according to the plan subscribed to, which events will be collected:

• Page view: we record, for 30 days, the page URL and the referrer (both without query parameters and without fragment), the timestamp, the UTM parameters and the visitor identifier. Ad click identifiers are not recorded in the view record: they go to the attribution session (Section 7.3.5) and to the sending to the ad platform (Section 7.4.6)
• Lead capture: the form fields You configure (email address, name and phone)
• Content interaction: product view and add to cart. It is not recorded in our database; it goes through the internal sending queue and is sent to the ad platform, when optimization is active. If the sending fails repeatedly, the event stays in the failure queue for up to 30 days, with IP, User-Agent and location, and is then deleted
• Checkout start (click on a link or button that leads to the checkout, or the page itself opening the checkout): it is not recorded in our database; it goes through the internal sending queue and is sent to the ad platform, when optimization is active, under the same failure queue rule
• Installation diagnostics: a condition code (for example, another Meta pixel present on the page) and the page host, to indicate whether the Pixel is installed correctly. Kept for 24 hours in temporary memory and not stored in a database

Approximate location. For each of these events, our network provider (Cloudflare) tells us the visitor's approximate country, state and city, derived from the IP address. This information is used when sending conversions to the ad platform, under Section 7.4.6. We never derive a postal code from the IP.

7.3.2 About the visitor identifier. The Pixel generates a random identifier (visitor_id) stored in the visitor's browser localStorage, used to link events from the same origin. This identifier is pseudonymized, not anonymized: it contains no name, email or direct data, but it is persistent on the device and, associated with other events, makes it possible to tell one visitor from another. For that reason, we treat it as personal data for all purposes of this Policy.

7.3.3 Cookies and local storage on Your pages. The Pixel stores, in the visitor's browser and on the domain of Your pages:

About the _fbp. This cookie was historically created by Meta itself. Since the Tracknana Pixel replaces Meta's tool on Your pages, we now create it, with the same name and the same duration, as a technical requirement for recognition. It is stored on the registrable domain of Your pages, and is therefore visible to their subdomains.

The Pixel also reads, without creating, the _fbc cookie when it is already present.

None of these items is created on Tracknana's pages, and the responsibility for informing your visitors and obtaining the required legal bases is Yours, as Controller.

7.3.4 Input sanitization. We apply automatic filters at three distinct points, with different effects:

• In the browser, before sending. UTM values containing an email, CPF, CNPJ, or a phone or card number written in the usual format are rejected and never leave the page. In the form fields captured (name and phone), documents and cards are replaced by a placeholder, with check-digit validation for CPF and CNPJ and the Luhn algorithm for cards, to avoid false positives.
• On the server, in the Pixel path. The email is checked against improper personal data patterns and, if there is a match, the whole lead is rejected. Name and phone are redacted. Every page URL and every referrer is recorded with only the website address and path: query parameters and fragment, where websites often carry emails and tokens, are discarded, and any email, CPF or CNPJ in the path is replaced by a placeholder. In the UTM parameters, personal data patterns are replaced by a placeholder, keeping the rest of the record.
• On the server, in the webhook path. Documents and cards contained in the name and phone are removed, keeping the rest of the field. Any personal data pattern is removed from the transaction identifier, the campaign identifier and the UTM parameters. The email address is validated as to format, but is not rejected for its content, since it is the buyer's identification key.

Limit of these filters. The product name provided by the payment platform does not go through a personal data filter, as it is indispensable to identify the sale. The duty not to enter improper data in that field is Yours, under Section 8.6 of the Terms of Service.

7.3.5 Attribution session. To link the ad click to the sale the checkout reports days later, we keep one attribution session per visitor, containing: visitor identifier, origin parameters, Google, Meta and TikTok ad click identifiers, the visitor's IP address, User-Agent and approximate location (country, state and city, without postal code), the host of the landing page and the host of origin.

We collect only the host, never the full address of those pages. The full URL often reveals the product, the offer and sometimes data in the address; the host answers the attribution question without carrying them.

About the IP and User-Agent. They are the only visitor personal data the Service collects for its own needs. They exist because the IP address available at the time of the sale is the payment platform's, not the buyer's. Without the real address, captured at the visit, the conversion would be attributed to a data center. Private or unparseable addresses are discarded, the User-Agent is truncated, and neither is exposed in an API response or in the Pixel's public configuration. In the attribution session, they are read through a single path: building the conversion event.

When the payment platform does not provide this data at the time of the sale, the IP, User-Agent and location recorded at the same buyer's visit may be used in the purchase event sent to the ad platform.

At each new visit, the IP, User-Agent and location are replaced by those of the most recent visit, and the period starts again. The session is deleted in full 30 days after the last visit, with the IP, User-Agent and location in the same operation.

Access log, distinct from the session. Each request from the visitor's browser to our servers, including the Pixel's and the loading of the UTM Tracking Script, also generates an access log entry with IP, date and time and User-Agent, kept for 6 months. Tracknana keeps this log, as an application provider, under its own obligation in art. 15 of the Brazilian Internet Civil Framework, confidentially, under Section 7.5.1.

7.3.6 Operating modes and temporary markers. You choose, per event, how the conversion is delivered:

• Server only (default): nothing from Meta goes into Your pages; the conversion is sent from our server
• Managed: Tracknana loads Meta's script on Your pages, and the visitor's browser starts communicating directly with Meta
• Bridge: the event is published to Your page's data layer, so that your own tag manager processes it
• Disabled: no collection. For purchases, the sale received by webhook is still recorded in the Dashboard, but nothing about it is sent to Meta: neither the purchase, nor the pending payment, the refund or the chargeback

The managed mode is materially different from the others and requires Your express activation, per event: in it, third-party code runs on Your pages at our initiative, and Meta collects directly, outside our server, under its own policy.

Temporary markers. To avoid sending repeated events, refuse forged events and avoid recording the same lead twice, we keep in temporary memory markers derived, by a hash function, from request identifiers. None is stored in a database, and all expire automatically:

The presence marker records only that the visitor had a page view on that Pixel in the last 6 hours, without keeping which pages. No marker follows the visitor across different websites or is used to build a profile.

7.3.7 The Pixel operates on a processing model. You, who deploy the Pixel, act as Controller of the data of your pages' visitors; Tracknana acts as Processor, on your behalf and in your interest. This relationship is governed by the Data Processing Agreement (DPA), a standalone document available on our website, with prominent access before sign-up and on the pricing page.

7.3.8 Tracknana's declaration. We declare that we do not use the data collected by the Tracknana Pixel for our own purposes, beyond those strictly necessary to provide the Service to You.

7.3.9 The User's responsibility. As Controller, You alone are responsible for: disclosing the use of the Pixel in your pages' privacy policy; obtaining visitors' consent when required by applicable law, before any tracking; ensuring that the deployment complies with the terms of the platforms that host your pages; not using the Pixel to collect sensitive data without an adequate legal basis; responding to data subjects' requests; and notifying Tracknana within 48 (forty-eight) hours of a security incident or suspected misuse, under the Data Processing Agreement.

You must also keep an accessible channel for visitors to exercise their privacy rights, which includes appointing a Data Protection Officer, unless a legal exemption applies to your size.

7.4 | Information collected through integrations

API integrations are automated connections between systems that allow data to be exchanged. We use querying, transfer and storage (the latter only where indicated), strictly to the extent necessary for the purpose of the Service.

7.4.1 Ad platforms (partly stored). When You link your Google, Meta or TikTok accounts, we access your campaign data via API, as Processor. We store the access and refresh tokens, encrypted at rest with AES-256-GCM, the identifiers, names and currencies of the linked ad accounts and, in Meta's case, the identifier of Your login there. The full campaign data is not stored; we keep only:

• Aggregated daily metric snapshots, per campaign and per day: campaign identifier and name, spend, impressions, clicks, conversions, reach, checkout starts, page views and revenue. Deleted automatically after 90 days.
• Recent hourly detail: the same indicators in hourly windows. Deleted after 14 days.
• Monitored campaign snapshots, for campaigns followed by Telegram alerts. Deleted when the campaign is removed from monitoring, when the ad network is disconnected or when the Account is deleted.

The platforms indicated collect this data as Independent Controllers; Tracknana only retrieves and processes it for the purpose of the Service.

7.4.2 Google Analytics (not stored persistently). Google Analytics property data is retrieved via API and is not stored in a database; it stays only in a temporary cache for 5 minutes.

7.4.3 Creative assets (not stored persistently). Ad creatives and associated metrics are retrieved via API and are not stored in a database; they stay only in a temporary cache for 3 minutes.

7.4.4 Payment platform webhooks (stored). The Service receives events from 15 platforms: Hotmart, Kiwify, Eduzz, Stripe, PerfectPay, Yampi, Monetizze, Braip, Ticto, Cakto, Lastlink, Shopify, Wiapy, Kirvano and a generic receiver. When You configure a receiver, the data extracted from the event is stored in our database. The content depends exclusively on what the platform You configured sends, and may include:

• Buyer's email address
• Buyer's name
• Buyer's phone, when provided
• Transaction amount and currency, and payment status
• Event type (purchase, subscription, abandoned cart and others)
• Transaction identifier and product name
• Attribution data: campaign identifiers, UTM parameters, origin platform and ad click identifiers (fbclid, fbc, fbp)
• Event timestamp
• The buyer's IP address, browser and address (country, state, city and postal code), when the platform sends them. They are not stored in our sales base; they only transit until the conversion is sent, when You have enabled it

Legal basis and purpose. Tracknana stores this data acting as Processor on behalf of the User, the actual Controller towards their buyers. The operation is based on the User's legitimate interest in tracking and managing their own sales and conversions, a purpose compatible with the buyer's reasonable expectation in the context of a digital commercial transaction. You are responsible for ensuring that your buyers are informed about data sharing with management and analytics tools.

Grouping by buyer. The events received are grouped by email address, forming a consolidated customer profile with purchase history, accumulated amounts and activity dates. This grouping is a feature of the Service performed on your instruction.

Matching attribution. When a sale arrives with no identified campaign but with a Meta click identifier, the Service may attribute it to the ad that Meta's aggregated reports credited with a matching purchase, considering amount and buyer. No data is sent to Meta for this: we only read its reports. The attribution obtained this way is an estimate, is marked as such in the record and may be revised at each new reading.

Warning about sensitive data by inference. Fields such as product name and page URL are free text generated by You and by the payment platform. A product name may reveal information about the buyer's health, religious belief, political opinion or sex life, turning the record into sensitive data under art. 11 of the LGPD. Our automatic filters do not detect this kind of content, and, when campaign optimization is active, the product name is also sent to the ad platform (Section 7.4.6). You declare and warrant that You have an adequate legal basis for processing any sensitive data arising from your products, pages or campaigns.

7.4.5 Microsoft Clarity (User integration). The Service allows You to link your own Microsoft Clarity account, providing the project identifier and the API token, so that the behavioural metrics of your pages are shown consolidated in your Dashboard.

In this integration, Tracknana does not process visitors' personal data: what we receive from Microsoft are aggregated counters and averages (number of sessions, pages per session, scroll depth and similar indicators), with no visitor identifier and no individual session-level data. We process only the API token You provide, as Controller of that data of Yours. Tracknana does not install Microsoft Clarity, does not set Clarity cookies and does not collect behavioural data from your pages' visitors. The relationship between You and Microsoft is governed by Microsoft's terms and privacy policy, under which it acts as an Independent Controller. The responsibility for informing your visitors and obtaining the required consents is exclusively yours.

The API token You provide is stored encrypted at rest and deleted when the integration is unlinked or when the Account is deleted.

7.4.6 Sending events to ad platforms. When You enable campaign optimization, by linking a conversion dataset to the Dashboard, Tracknana sends events to ad platforms through their Conversions API, acting as Processor on your instruction.

Browsing events are sent for every visitor to Your pages, not only for those who buy. Depending on the event, the following is transmitted:

• The buyer's or lead's email, phone, first name and last name, previously converted to a SHA-256 hash, as required by the platform's specification
• External identifier, formed by the visitor identifier and the customer identifier in our base, also as a SHA-256 hash
• The visitor's IP address and User-Agent, in unencoded form, as technically required by the receiving platform to attribute the event
• Country, state and city, and the postal code only when declared by the buyer at checkout, as a SHA-256 hash. The source is, in this order: the address declared to the payment platform; or, failing that, the approximate location of the visit provided by Cloudflare. The visit location never replaces the declared address, and is not used when the declared country differs from the country of the visit
• Ad click identifiers (fbc, fbp)
• Address of the page on which the event occurred, without query parameters and without fragment
• Product name, amount, currency and the order identifier at the payment platform

The recipient of these transmissions is Meta, as shown in the table in Section 11.1.

We draw your attention to two points. First, the visitor's IP and User-Agent are transmitted without encoding. Second, the product name is transmitted as text and may reveal sensitive data by inference, under Section 7.4.4. This transmission is a technical condition for optimization to work and occurs only when You enable the feature. By enabling it, You declare that You have a legal basis and have given data subjects the required information.

7.4.7 Telegram. If You choose to receive campaign alerts via Telegram, we link your account through an exclusive deep link and store your chat identifier (chat_id) and the linking token. We transmit to Telegram the chat_id and the alert text, which contains the campaign name and metrics; therefore, do not enter third parties' personal data in campaign names (Section 21.1). The deep link works as a credential for accessing your notifications; keep it confidential. The link can be undone at any time.

7.4.8 Mobile app notifications. If You use the mobile app and allow notifications, we store your device's push token, the platform and the date of last use. That token and the notification content are transmitted to the Expo Push service, for delivery to your device. The notification contains the sale status and amount and the name of Your Dashboard, and contains no buyer name, email or phone. Tokens inactive for 90 days are deleted automatically, and You can revoke the authorization in the device or Service settings.

7.5 | Information collected automatically

7.5.1 Access logs. For each request we record the IP address, the date and time, the User-Agent, the route accessed and the result, including requests made by the browser of visitors to the pages where the Pixel or the UTM Tracking Script is installed.

The IP address and the date and time are the application access logs that art. 15 of the Brazilian Internet Civil Framework requires us to keep for six months. The other fields are recorded on the basis of legitimate interest in security, for fraud detection, incident investigation and diagnostics. None of them is used for marketing purposes.

7.5.2 Audit logs. We record the administrative actions performed in the Service, with IP, User-Agent, action performed and timestamp, for security, incident investigation and the regular exercise of rights.

7.5.3 Error and performance logs. We use the Sentry service to capture technical exceptions, on two fronts:

• On the server, the configuration adopted disables the sending of cookies, request bodies, IP identification headers and the User-Agent. The route address, method, message and stack trace of the error are transmitted.
• In the Dashboard, errors that occur in your browser are captured, with the page address, the browser and the recent navigation and request history of the session, which may occasionally contain information shown on screen at the time of the failure.

Error events are retained by Sentry according to the plan subscribed to and, when enabled, log, metric and trace observability is forwarded to Grafana Cloud. Both operate from abroad, under Section 15.

7.5.4 Cookies and measurement on our pages. On our own pages we use only necessary cookies: access_token, refresh_token, csrf_token and, while connecting an ad account, tn_oauth_*, for session and security; cf_clearance, set for 30 minutes by Cloudflare when the browser passes a check against automated access; and, on the institutional website, NEXT_LOCALE, which keeps the chosen language for up to 12 months. We do not use advertising, retargeting, social media or cross-site tracking cookies. Your account preferences, such as language, theme and currency, are stored on the server.

Our pages load Cloudflare Web Analytics, an audience measurement tool from our infrastructure provider that uses no cookies and creates no persistent visitor identifier. It tells us access volume and performance, not individual behaviour.

When creatives are shown in the Dashboard, the images and videos are loaded by Your browser directly from the servers of the ad platforms that host them, which receive Your IP address in that request.

Details of cookies, local storage and the mobile app are in our Cookie Policy.

8 | INFRASTRUCTURE AND DATABASE

The Service is hosted on Oracle Cloud Infrastructure (OCI), Oracle Corporation's cloud computing platform. The servers and the main database are physically located in the Vinhedo region, state of São Paulo, Brazil.

This means that your data is stored in Brazilian territory, directly subject to the LGPD, without relying on an international transfer mechanism for primary storage. Any remote access by Oracle, for infrastructure support and operation, is governed by Oracle's Data Processing Agreement, subject to the safeguards described in Section 15.

Incoming traffic goes through Cloudflare, which provides the protection layer and the access tunnel to the infrastructure.

Database backups and log records are stored in Oracle Object Storage, in the same Vinhedo region, encrypted at rest and with public access blocked. The Service's database and its backup copies therefore remain entirely in Brazilian territory.

Auxiliary email sending, technical monitoring and observability services operate from abroad and store data for limited periods, as detailed in Section 15.

Transactional and institutional emails are sent through Amazon SES, and bounce notifications are received through Amazon SNS, both operating from the United States. They are the only Amazon Web Services services that process data outside Brazil.

9 | HOW WE USE YOUR PERSONAL DATA

We will not use your Personal Data for purposes materially different from those described without at least 15 (fifteen) days' prior notice and, where required, without obtaining your specific consent.

10 | DATA WE DO NOT COLLECT OR STORE

For transparency, the following categories are explicitly not collected or stored by Tracknana, subject to the notes on each item:

• Full credit card numbers and CVV, handled exclusively by Stripe, and bank account details, except those You give us to receive a refund of a payment made by boleto
• Biometric data, health data or government identification document numbers: we neither request nor intentionally collect them, except for sensitive data revealed by inference in free-text fields, addressed in Section 7.4.4. The CPF or CNPJ that Stripe requests for boleto and Pix stays with Stripe, under Section 7.1.3
• Full advertising campaign data, of which we keep only aggregated snapshots
• Google Analytics property data, kept only in a temporary cache for minutes
• Ad creative assets and their metrics, kept only in a temporary cache for minutes
• Visitors' personal data captured by the UTM Tracking Script, which, once loaded, runs only in the visitor's browser (loading it generates only the access log entry in Section 7.5.1)
• Date of birth or any data intended for age verification
• A permanent history of conversations with the AI Assistant: the recent context is used only to continue the ongoing conversation, and does not form a knowledge base about You

11 | HOW AND WITH WHOM WE SHARE YOUR DATA

11.1 | Service providers and processing agents

All the providers above operate under the data protection safeguards described in Section 15.

Services that receive no personal data. To convert amounts between currencies, we consult the exchange rates published by the Central Bank of Brazil and by a complementary exchange rate provider. These queries transmit no data of Yours or of third parties; they only fetch the day's rate table.

11.2 | Sharing resulting from your action

Certain Dashboard features let You contact a lead through messaging apps. When You use this feature, the lead's phone number is transmitted to the provider of the chosen app as part of the destination address. This sharing results from your deliberate action and occurs under your responsibility as Controller of that data.

11.3 | Legal and compliance disclosures

Tracknana may disclose Personal Data and access logs, always within the limits of applicable law, in the following cases: compliance with a specific court order; responding to a reasoned request from a police or administrative authority or the Public Prosecutor's Office, within their legal powers; protecting the rights, property or safety of Tracknana, its Users or third parties, including fraud and attack prevention; regular exercise of rights in judicial, administrative or arbitral proceedings; and investigating potential violations of the Terms of Service or this Policy.

Communications from authorities must be sent to [email protected], subject to the requirements described in the Terms of Service. We limit what we provide to what is strictly necessary, in observance of the principle of data minimization.

11.4 | Corporate transfers and succession

In the event of a merger, acquisition, spin-off, incorporation or sale of assets, Personal Data may be transferred to the successor entity as part of the transaction. In that case, You will be notified at least 15 (fifteen) calendar days in advance, a period that may be reduced to 5 (five) business days in exceptional, duly justified situations of urgency. If You do not agree with the transfer, You may request deletion of the Account and your data before the operation is completed.

11.5 | Non-sale declaration

We do not sell, rent or trade your Personal Data with third parties for monetary or any other consideration, regardless of the jurisdiction in which You are located.

12 | DATA RETENTION

We retain Personal Data only for as long as necessary to fulfil the purposes described in this Policy, the applicable legal obligations and the regular exercise of rights (arts. 15 and 16 of the LGPD).

About periods that depend on configuration. Some of the periods above are defined by an operating parameter: the duration of the attribution session, the maximum session time and the backup periods. We publish here the values actually applied; any change will be reflected in this Policy before it takes effect.

Once the periods expire, the data is securely deleted or anonymized. Residual copies may remain in encrypted backups for the period indicated above, before automatic deletion, under Section 13.

13 | BACKUPS

We make periodic backup copies of the database, in two layers: short-term local retention and remote storage in Oracle Object Storage, in Vinhedo, encrypted at rest and with public access blocked. We also keep a continuous transaction log, which allows the database to be restored to a specific point in time.

Local backups are kept for 7 days. Remote copies are protected against deletion for the first 30 days, as a measure against attacks that try to erase them, and are deleted automatically after 180 days. This means that, once a deletion request is fulfilled, the data is removed immediately from the active systems, but may remain in encrypted backup copies for up to that period, after which it is permanently discarded. Backups are not used for any purpose other than disaster recovery, and access to them is restricted. If a copy is restored, the deletions made after it are repeated before the Service resumes.

14 | DATA SECURITY

Tracknana adopts technical and administrative measures to protect your Personal Data against unauthorized access, destruction, loss, alteration and unlawful disclosure.

14.1 | Measures implemented

• Encryption in transit: TLS/HTTPS protocols in all external communication
• Encryption of credentials at rest: passwords hashed with high-cost bcrypt; TOTP secrets and integration tokens in AES-256-GCM
• Isolation per data owner: security policies in the database that restrict, in the storage layer itself, each User's access exclusively to their own records
• Access control: least privilege, with distinct application roles and separation between operating and administration credentials
• Application protection: security headers, CSRF protection, request rate limiting and request body size limits
• Origin verification: signature or secret token validation on webhooks from platforms that offer it, and authorized domain verification on the Pixel
• Input sanitization: automatic filters that redact document and card patterns in the text fields received, under Section 7.3.4
• Authentication: short-lived tokens, global session invalidation on password change and optional TOTP 2FA
• Logging and auditing: audit trail of administrative actions and monitoring of security events
• Backups: encrypted, versioned backup copies kept in Brazilian territory, with a documented restoration procedure

14.2 | Incident notification

If a security incident occurs that may cause relevant risk or harm to your rights, Tracknana will notify the ANPD and You within a reasonable time, describing the nature of the incident, the data affected, the risks involved and the measures taken to mitigate them, under art. 48 of the LGPD.

14.3 | Limitation

Although we use the measures described, no system is completely invulnerable. Tracknana is not liable for damage resulting from the exclusive fault of the User (such as sharing credentials or not enabling 2FA) or of third parties, unless a failure in our security measures is proven.

15 | INTERNATIONAL DATA TRANSFERS

Tracknana is headquartered in Brazil and the primary storage of your data takes place entirely in Brazilian territory: the database, backups and log records are in the Vinhedo region, São Paulo, on Oracle's infrastructure.

This means that the Service's database and its backup copies do not constitute an international transfer.

There is, however, processing carried out abroad, some of which involves storage for a limited period in the respective providers' systems:

All this processing observes the safeguards in Section 15.1 and is limited to what is strictly necessary for the corresponding purpose.

15.1 | Legal basis

The providers indicated above are located mostly in the United States. The transfers are based on art. 33, II, of the LGPD, through Standard Contractual Clauses approved by ANPD Resolution CD/ANPD No. 19/2024, or an equivalent contractual instrument that ensures compliance with the principles and rights provided for in Brazilian law.

We verify the existence of that instrument with each provider before contracting and whenever the list in Section 11 changes.

15.2 | User awareness

By using the Service, You declare that You are aware that your data will be processed internationally under the safeguards described, which aim to ensure that your fundamental rights are respected regardless of where the processing takes place.

16 | YOUR RIGHTS

Regardless of your location, You have the following rights over your Personal Data, subject to the retention periods in Section 12:

• Confirmation of the existence of processing
• Access to the data we hold about You
• Correction of incomplete, inaccurate or outdated data
• Anonymization, blocking or deletion of unnecessary or excessive data or data processed in breach of the law
• Portability of the data in a structured, machine-readable format
• Deletion of data processed on the basis of consent
• Information about the entities with which we share data
• Information about the possibility of not giving consent and the consequences of refusing
• Withdrawal of consent, at any time
• Objection to processing based on legitimate interest
• Review of automated decisions, under Section 21

16.1 | How to exercise them

Some rights can be exercised directly in the Service, including deleting the Account, unlinking integrations, communication preferences and exporting leads, sales and customer profiles in CSV format from the Dashboard or the mobile app.

For the others, including confirmation, access, correction of registration data, portability of the other categories, blocking and objection, write to [email protected] or [email protected]. The service is free of charge, under art. 18, § 5, of the LGPD.

We will reply within 15 (fifteen) days of receiving the request. We may ask for additional information to confirm your identity before fulfilling the request, a measure intended to protect You against fraudulent requests.

16.2 | Brazil (LGPD)

If You are in Brazil, your rights are those provided for in art. 18 of the LGPD, listed above. We process your data on the legal bases indicated in Section 9. You can lodge a complaint with the National Data Protection Authority at gov.br/anpd.

16.3 | International users

For users located outside Brazil, Tracknana respects the fundamental privacy rights provided for in the applicable local laws. You can exercise the rights granted by the law of your country by writing to [email protected], and we will seek to fulfil your request within the periods required by the law applicable to your case.

16.4 | Level B data subjects: leads, buyers and visitors

If You are a lead, buyer or visitor whose data reached Tracknana through one of our Users, the Controller of that data is that User, and the request must be addressed to them: usually, the company or professional whose website, ad or checkout You used.

If You cannot identify or locate the Controller, write to [email protected]. Acting as Processor, we will forward the request to the responsible User within 5 (five) business days and provide them with the technical means to fulfil it, carrying out the operation when they instruct us to. We cannot, on our own account, decide about data we do not control, but we will not leave your request unanswered.

16.5 | Data Protection Officer

Tracknana qualifies as a small-scale processing agent under ANPD Resolution CD/ANPD No. 2/2022 and, as such, is exempt from formally appointing a Data Protection Officer, keeping, as required by art. 11 of that Resolution, a specific and permanent communication channel with data subjects and with the ANPD, which is the address [email protected].

If this status changes, we will formally appoint a Data Protection Officer and update this Policy.

17 | DELETING THE ACCOUNT AND YOUR DATA

You can delete your Account at any time in the Service settings. Deletion is final and immediate in the active systems; we do not keep accounts in an inactive or recoverable state.

With the deletion, the following are permanently deleted:

• Profile data: username, email and hashed password
• Record of acceptance of documents and communication preferences
• TOTP secret and hashes of the recovery codes
• All leads, sales and customer profiles received by webhook
• All events collected by the Tracknana Pixel associated with your Account
• Webhook settings, UTM parameters, link history and custom settings
• Metric snapshots, monitored campaigns, alert rules and Dashboards
• Integration tokens. We ask Google, Meta and TikTok to revoke the authorizations You granted; if any of them does not confirm, the authorization may remain visible in its panel until You remove it. Meta's authorization is not revoked when the same Meta login is linked to another Tracknana account, or when its origin cannot be confirmed, so as not to disconnect third parties. Microsoft Clarity does not offer revocation by third parties: the token is erased, and the revocation must be done by You in the Clarity project
• Device tokens and notifications
• Technical records linked to the Account

What is not deleted immediately, and why. Five records survive the deletion, each for a reason:

• Audit records and records of requests from integrated platforms: they are unlinked from Your Account and deleted within 6 months. They serve the security of the Service, incident investigation and the regular exercise of rights.
• Record of acceptance of the documents: kept for 5 years, linked to Your email only in encoded form, with the version accepted, the date and the IP address of acceptance, as proof of which text was accepted and when.
• Technical email suppression list: permanent, in encoded form, so that an address that asked to leave does not receive messages again.
• Identifier of the subscription pending cancellation, when applicable: kept only until the cancellation is confirmed, in Your favour, so that You are not charged for a service You no longer use.
• Support messages and record of the requests You sent us: kept for 5 years from the support, as proof of what was asked and answered.

Active subscription. If there is an active subscription at the time of the request, we automatically ask the payment provider to cancel it before completing the deletion. If that communication fails due to technical unavailability, the deletion of your data is carried out anyway, and we retain only the subscription identifier at the provider (a code that contains no name, email or any data of yours) until the cancellation is confirmed, to ensure that You are not charged for a service You no longer use. That identifier is deleted as soon as the cancellation is confirmed.

Backups. Under Section 13, residual copies may remain in encrypted backups for up to 180 days before automatic deletion.

Legal obligations. The access logs required by art. 15 of the Brazilian Internet Civil Framework and the financial and tax records required by tax law are kept for the periods in Section 12, regardless of the deletion (art. 16, I, of the LGPD).

18 | CHILDREN'S AND ADOLESCENTS' PRIVACY

The Service is a professional tool and is not intended for anyone under 18 (eighteen). We do not intentionally collect or request data from minors.

We do not collect date of birth or perform technical age verification. We make this point for transparency: our protection in this matter rests on the declared purpose of the Service, the Terms of Service and the procedure described below, not on automated detection.

Brazil. We adopt the principle of the best interest of the child and adolescent. If the processing of data of a child under 12 is identified, the data will be deleted immediately after verification, except for what is strictly necessary to contact the parents or guardians and inform them of the deletion. If an adolescent data subject between 12 and 18 is identified, the Account will be closed for breach of the Terms of Service, with the same security rigour in deleting the data.

Other jurisdictions. Tracknana prohibits use of the Service by anyone who has not reached the age of majority or the minimum age of consent for data matters in their country of residence.

Procedure for parents and guardians. If You are a parent or legal guardian and believe that a minor in your care has given us personal data, write immediately to [email protected] with the identification of the account or email address involved. After verification, we will permanently delete all associated information in the active systems, treating the case as a priority. Residual copies in encrypted backups follow the automatic 180-day deletion cycle described in Section 13, during which they are not accessed for any purpose other than disaster recovery.

19 | THIRD-PARTY LINKS AND SERVICES

The Service may contain links to external websites or integrations with third-party platforms that are neither operated nor controlled by Tracknana. These third parties act as independent controllers, and Tracknana exercises no editorial, technical or legal control over their privacy, security or content practices.

Tracknana is not liable for damage caused by the use of third-party content, goods or services; for security failures or leaks in third-party systems; or for unilateral changes to the policies or terms of the integrated platforms that affect the Service's functionality.

We recommend that You review the privacy policies and terms of use of any third-party platform before linking your accounts or providing personal information.

20 | DO NOT TRACK SIGNALS

Since we do not use optional tracking, Do Not Track signals sent by the browser do not change our collection. The details are in the Cookie Policy.

21 | AUTOMATED DECISIONS

For full transparency, we inform You that the Service performs the following automated operations:

21.1 Campaign AI Assistant. The feature generates analyses of your campaigns using OpenAI's GPT-4o-mini model. We send, via API, a JSON summary containing: aggregated campaign metrics for the last 30 days, including the identifier and name of each campaign; an hour-by-hour breakdown of the most recent days; the name of Your Dashboard; the rate on ad spend You configured, with the resulting tax and total cost; the messages You write to the assistant; and up to the ten previous messages in the conversation. The submission is limited to the 25 campaigns with the highest spend in the period.

We do not send records of leads, sales, customer profiles or visitors: buyers' names, emails, phone numbers, documents and IP addresses are never part of the submission.

Every free-text field that goes out (Dashboard name, campaign names, Your messages and the history) passes through an automatic filter that replaces email addresses, CPF and CNPJ numbers validated by check digit, and card numbers validated by the Luhn algorithm. Dates and unvalidated numeric sequences are kept, because ad analysis depends on them.

No conversation is stored on our servers. The history is sent by Your browser with each question. In this feature, Tracknana is the Controller and OpenAI is the Processor. Since this is API use, the data sent is not used to train OpenAI's public models, under the terms applicable to use of the programming interface.

The Assistant's answers are informative and auxiliary; they do not constitute a technical opinion, financial advice or a guarantee of results, and produce no legal or similarly significant effects on You. The automatic filter reduces risks but does not replace your care: do not enter third parties' personal data in the messages sent to the assistant, in your campaign names or in the name of Your Dashboard, since these fields are free text and form part of the content transmitted.

21.2 Automatic customer classification. The Service automatically assigns a highlight tag to customer profiles that reach a certain number of purchases. This is an operational classification intended to organize your Dashboard, with no effect on the classified data subject.

21.3 Automated campaign rules. The Service allows You to create, in the Dashboard, automated rules in your own Meta ad account. These rules can pause, reactivate or change the budget of campaigns, and have immediate financial effects.

The ad platform evaluates and runs these rules, on its own infrastructure and at its own cadence, according to the parameters You wrote. Tracknana is the interface through which You create and edit them; we are not the ones who pause your campaign. Defining the parameters and reviewing the results are Your responsibility, and You can remove them at any time.

21.4 Processes that run automatically. For transparency, the following processes run without intervention and may affect You:

• Deletion of the oldest record when the plan limit is reached, under Section 12. This is the one that most affects your data, and it happens without individual notice
• Deletion by retention period, under Section 12
• Cancellation of the subscription with the payment provider, when You delete the Account
• Change to Your plan and the corresponding limits, when the payment provider reports a change in the subscription, when the period paid with Pix ends, with a return to the Free plan, or when a payment is disputed, with removal of paid access
• Pausing of Pixels, datasets, webhook receivers and monitored campaigns above the limit after a plan downgrade, under Section 7.7 of the Terms of Service
• Deletion of never-verified accounts, after 7 days, unless subscribing to a paid plan has already been started
• Sending of conversions, alerts and communications, according to the integrations You enabled
• Suppression of email addresses that the destination provider rejected
• Matching attribution, under Section 7.4.4: a campaign label assigned to sales with no identified origin

21.5 No automated decision is made by Tracknana regarding the suspension or termination of Your Account for conduct. Those measures follow the administrative procedure of the Terms of Service, with notice, defence and appeal.

22 | COMMUNICATIONS YOU RECEIVE

We distinguish three categories, with different rules:

22.1 Transactional communications. Email verification, password reset, welcome, email change, account deletion confirmation, security alerts and reminders that the plan paid with Pix is about to end, sent by us; receipts and billing failure notices, sent by Stripe; and the invoice, sent by us. They arise from the performance of the contract and cannot be unsubscribed from, as they are inseparable from the provision of the Service.

22.2 Legal and contractual notices. Changes to this Policy, the Terms of Service or the DPA; price changes; notification of a security incident; discontinuation of features. They arise from legal and contractual obligations and cannot be unsubscribed from, since they are how we fulfil the information duties provided for in the LGPD and in consumer law.

22.3 Optional communications. Platform news, feature launches, offers, content and informational materials. They are sent only with your prior consent, given in a specific checkbox, unchecked by default, at sign-up.

You can withdraw that consent at any time, free of charge and easily, in Your Account settings or through the unsubscribe link present in every communication of this kind. Withdrawal is immediate, does not affect the use of the Service in any way, and does not stop the communications in categories 22.1 and 22.2.

Technical suppression list. We keep a record of the addresses that must be excluded from sending, whether at your request or because of a permanent bounce or a spam complaint from the email provider. This record is kept in encoded form (hash), not in readable text, and is used exclusively to prevent new sending to the corresponding address.

This record survives the deletion of the Account (Section 17), in encoded form, with no name, identifier or any other associated data. Its purpose is to prevent an address that asked to unsubscribe, or that the email provider marked as invalid, from receiving messages again if a new account is created.

Keeping your address up to date. You are responsible for keeping your email address up to date, as it is the main means of communication between Us and You.

23 | CHANGES TO THIS POLICY

Tracknana may change this Policy to reflect changes in the Service, technological advances or legislative updates.

23.1 Material changes. Changes that affect your rights, the purposes of processing or the identification of the controller will be communicated at least 15 (fifteen) days in advance, by email to the registered address and by a prominent notice within the Service.

23.2 Non-material changes. Editorial corrections, formatting adjustments or updates to contact information take effect immediately upon publication, with the date and version number in the header updated.

23.3 Renewal of consent. If the change modifies the purpose of processing for which consent was originally collected, we will ask for new specific consent before proceeding with the new processing, and will record it under Section 3.

23.4 Acceptance and termination. Continued use of the Service after the changes take effect constitutes acceptance of the new version. If You do not agree, You must stop using it and may request deletion of the Account and your data before the changes take effect.

23.5 Previous versions. We keep previous versions of this Policy available for consultation, with their respective dates in force.

24 | CONTACT INFORMATION

Controller: Tracknana Software Development Ltda.
Trade name: Tracknana
CNPJ: 66.059.324/0001-03
Headquarters: Mamborê, Paraná, Brazil
General email: [email protected]
Privacy, legal and authorities channel: [email protected]
WhatsApp (support): +55 44 99737-2685
Website: www.tracknana.com

Brazilian National Data Protection Authority (ANPD): gov.br/anpd

Related documents: Terms of Service · Data Processing Agreement (DPA) · Cookie Policy

Previous versions of this document