Privacy Policy

TRACKNANA

Last Updated: April 11, 2026

www.tracknana.com · [email protected]

This Privacy Policy describes how Tracknana collects, uses, stores, shares, and protects Your personal information when You use Our Service.

1. Introduction

This Privacy Policy ("Policy") describes the practices of Tracknana Software Development Ltda., registered under CNPJ No. 66.059.324/0001-03, operating under the trade name Tracknana, based in Mamborê, Paraná, Brazil ("Company", "We", "Us", or "Our"), regarding the collection, use, storage, disclosure, and protection of personal information when You use the Tracknana application, website (www.tracknana.com), and all related services (collectively, the "Service").

This Policy applies to all Users of the Service. Tracknana is based in Brazil and operates primarily under the Lei Geral de Proteção de Dados (LGPD). The Service may be accessed by users in different countries, especially in the Americas, and Tracknana seeks to respect the fundamental privacy rights provided for in applicable local legislation, without prejudice to the application of Brazilian law as the governing law.

By creating an Account and using the Service, You acknowledge that You have read, understood, and consent to the collection and processing of Your information as described in this Policy. If You do not agree with this Policy, please do not use the Service.

We use the terms "Personal Data" and "Personal Information" interchangeably throughout this Policy unless a specific law requires a particular term.

2. Definitions

• "Account" means the unique account registered with a username, email address, and password to access the Service.
• "Ad Platforms" means Google Ads, Meta Ads (Facebook/Instagram), and TikTok Ads.
• "Cookies" means small text files placed on Your Device by the Service to store preferences and session information.
• "Device" means any electronic device used to access the Service.
• "Lead Data" means information received via webhooks from Payment Platforms, stored in Our database for lead management.
• "Customer Data" means Lead Data aggregated by email address to create unified customer profiles.
• "Payment Platforms" means Hotmart, Kiwify, Stripe, Eduzz, Clickbank, PerfectPay, Yampi, Nuvemshop, and any additional platforms configured by the User via generic integration.
• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Tracknana Pixel" means the JavaScript script provided by Tracknana that Users may embed on their sales pages or landing pages to record page views and lead events, transmitting this data to Tracknana's servers.
• "Service Provider" means a third party that processes data on behalf of the Company.
• "Usage Data" means data collected automatically from use of the Service, including IP address, browser type, pages visited, and timestamps.
• "Webhook Data" means all data received through webhook endpoints configured by the User.

3. Data Controller

The data controller responsible for processing Your Personal Data in connection with the Service is Tracknana Software Development Ltda., a small business registered under CNPJ No. 66.059.324/0001-03, operating under the trade name Tracknana, based in Mamborê, Paraná, Brazil. For questions or to exercise Your rights, contact Us at:

• Email: [email protected]
• Website: www.tracknana.com

4. Personal Data We Collect

4.1 Information You Provide Directly

4.1.1 Account Registration Data

When You create an Account, We collect:

• Username;
• Email address;
• Password (stored in hashed and salted form — We never store plaintext passwords).

Upon registration, We send a verification email to the address You provided. We generate and temporarily store an email verification token to confirm ownership of the email address. We also generate temporary tokens for password reset requests. These tokens are short-lived and automatically expire after use or after a fixed time period.

4.1.2 Payment Information

When You subscribe to a paid plan (Solo, Pro, or Enterprise), payment is processed by Stripe. We receive from Stripe:

• Subscription status and plan type;
• Billing dates and payment history;
• A truncated card identifier (last 4 digits) for display purposes only.

We do not receive, process, or store Your full credit card number, CVV, or other sensitive payment credentials. All payment data is handled by Stripe in compliance with PCI-DSS standards. We issue an invoice or fiscal receipt (NFS-e for Users in Brazil) at the time each payment is confirmed. Invoice records, including the invoice number, amount, date, and associated Account identifier, are retained for up to 60 months for tax and financial compliance purposes. In the event of a refund, the corresponding invoice is canceled and a cancellation receipt or credit note is issued.

4.1.3 Two-Factor Authentication Data

If You enable TOTP two-factor authentication, We store: (a) a TOTP secret key associated with Your Account, encrypted at rest; and (b) a set of one-time recovery codes, stored as bcrypt hashes (not in plaintext). Recovery codes allow You to access Your Account if You lose access to Your TOTP device; each code can only be used once. Both the TOTP secret and recovery code hashes are permanently deleted when You disable 2FA or delete Your Account.

4.1.4 User Preferences

We store Your interface preferences to personalize Your experience, including:

• Theme preference (light or dark mode);
• Language preference (English, Portuguese, or Spanish);
• Whether You have completed the initial language setup.

These preferences are stored in Your Account record and deleted when Your Account is deleted.

4.1.5 UTM and Webhook Configuration Data

We store UTM parameters, tracking links, and webhook endpoint configurations that You create within the Service.

4.1.6 UTM Tracking Script (Client-Side Only — No Data Collected by Tracknana)

Tracknana provides a JavaScript tracking script (the "UTM Tracking Script") that Users may embed on third-party checkout pages via a standard HTML script src tag. This script reads the following UTM parameters from the visitor's browser URL: utm_source, utm_medium, utm_campaign, utm_content, utm_term, and utm_id. The script does not read or capture advertising platform click identifiers (such as gclid, fbclid, or ttclid). The captured UTM values are stored in the visitor's browser localStorage for up to 30 days and a single "src" parameter (containing the utm_id or utm_campaign value) is injected into detected checkout links on the page to enable conversion attribution.

Important: The UTM Tracking Script operates entirely within the visitor's browser (client-side). It does not transmit any data to Tracknana's servers and does not set cookies. The script uses the visitor's browser localStorage to persist UTM parameter values and a timestamp for up to 30 days; it does not use session storage and does not fingerprint or uniquely identify individual visitors. The script includes built-in validation that automatically rejects values containing personal data patterns such as email addresses, phone numbers, tax identification numbers (CPF/CNPJ), credit card numbers, and URLs. The stored data consists solely of sanitized UTM parameter values and contains no personally identifiable information. Tracknana does not collect, receive, store, or process any personal data of checkout page visitors through the UTM Tracking Script. However, the "src" parameter injected into checkout links may be forwarded to Tracknana as part of Webhook Data when the Payment Platform includes it in its webhook payload (see Section 4.2.4).

The User who deploys the UTM Tracking Script is solely responsible for: (a) disclosing the use of the script in their own privacy policy or notice; (b) obtaining any required consent from checkout page visitors as mandated by applicable data protection laws; and (c) ensuring compliance with the terms of service of the Payment Platform or website hosting the checkout page.

4.1.7 Tracknana Pixel (Data Actively Collected by Tracknana)

Tracknana provides an additional JavaScript script called the "Tracknana Pixel" that Users may embed on their own sales pages or landing pages for event tracking. Unlike the UTM Tracking Script, the Tracknana Pixel actively transmits data to Tracknana's servers.

Data collected by the Tracknana Pixel:

• Pageview events: page URL, timestamp, anonymous session identifier;
• Lead events: form data submitted by the visitor (as configured by the User in the pixel deployment);
• Visitor IP address (used for approximate geolocation and fraud prevention, not stored in raw form beyond the processing period);
• Browser user agent (browser type and version, operating system).

Important: The Tracknana Pixel operates under a processing model in which the User who deploys it acts as the data controller of the visitors to their pages, and Tracknana acts as the data processor on behalf of the User. This relationship is formally governed by the Data Processing Agreement described in Section 4.1.8.

Tracknana does not use data collected by the Tracknana Pixel for its own purposes beyond those strictly necessary to provide the Service to the User who deployed it.

The User who deploys the Tracknana Pixel is solely responsible for: (a) disclosing the use of the Tracknana Pixel in the privacy policy of their pages; (b) obtaining the necessary consent from visitors as required by applicable legislation before any tracking; (c) ensuring that the deployment complies with the terms of use of the platforms hosting their pages; (d) notifying Tracknana immediately in case of suspected misuse of collected data; and (e) maintaining an accessible channel for visitors to exercise their privacy rights.

4.1.8 Data Processing Agreement (DPA) — Tracknana Pixel

By installing and using the Tracknana Pixel, the User enters into a Data Processing Agreement ("DPA") with Tracknana, the essential terms of which are as follows:

a) Roles of the parties: The User is the Controller of the personal data of visitors to their pages. Tracknana is the Processor of this data, acting exclusively in accordance with the User's instructions and for the purposes of the Service.

b) Purposes of processing: Tracknana will process data collected by the Tracknana Pixel exclusively for: (i) displaying tracking metrics and events on the User's Dashboard; (ii) enabling the attribution of conversions and leads to the User's campaigns; (iii) providing analytical functionalities of the Service. No other use is permitted.

c) User obligations (Controller): The User agrees to: (i) obtain valid consent from visitors to their pages before installing the Pixel, when required by applicable legislation; (ii) inform visitors about the use of the Tracknana Pixel in their privacy policy; (iii) not use the Pixel to collect sensitive category data without an adequate legal basis; (iv) promptly respond to data subject requests; (v) notify Tracknana immediately, and within a maximum of 48 hours, in case of a breach or misuse.

d) Tracknana obligations (Processor): Tracknana agrees to: (i) process data exclusively in accordance with the User's instructions; (ii) implement adequate technical and organizational measures; (iii) not subcontract processing without prior notification to the User; (iv) notify the User within a maximum of 72 hours in case of a security incident; (v) delete or return all data when requested or when the Account is terminated.

e) Liability: The User is primarily responsible for ensuring legal compliance of data collection via the Pixel. Tracknana shall not be liable for violations arising from the User's misuse.

f) Suspension for misuse: Tracknana reserves the right to immediately suspend the User's access to the Pixel if it detects use in violation of the DPA or applicable legislation.

4.2 Information Collected Through Integrations

4.2.1 Ad Platform Data (Partially Stored)

When You link Your Google, Meta, or TikTok accounts, We access Your advertising campaign data via the respective APIs in real time. Full data is not stored. However, We store:

• Aggregated Daily Metric Snapshots: Daily aggregated metrics (spend, impressions, clicks, and conversions per platform per day). These snapshots are automatically deleted after 90 days;
• Monitored Campaign Snapshots: For campaigns monitored via Telegram alerts. Deleted when monitoring is disabled or Your Account is deleted.

4.2.2 Google Analytics Data (NOT Stored)

Google Analytics property data is retrieved via API and is NOT stored on Our servers.

4.2.3 Ad Creative Data (NOT Stored)

Creative assets and associated metrics are retrieved via APIs and are NOT stored.

4.2.4 Payment Platform Webhook Data (Stored)

When You configure webhook receivers, the incoming payloads are stored in Our database. This typically includes:

• Customer/buyer email address;
• Customer/buyer name;
• Customer/buyer phone number (if provided by the Payment Platform);
• Transaction amount and payment status;
• Event type (sale, subscription, abandoned cart, etc.);
• Transaction identifier;
• Product name;
• Attribution data: campaign identifier, UTM parameters, originating ad platform;
• Event timestamp.

Legal basis and nature of storage: Tracknana stores this data acting as a processor on behalf of the User, who is the controller of this information with respect to their customers/buyers. The legal basis is the legitimate interest of the User in tracking and managing their sales and conversions. The User is responsible for ensuring that their customers/buyers are informed about data sharing with analytics tools.

This Webhook Data is used exclusively to populate the Leads section and Customer profiles on the User's Dashboard.

4.3 Information Collected Automatically

4.3.1 Usage Data

We automatically collect Usage Data when You access the Service, including:

• IP address;
• Browser type and version;
• Operating system;
• Pages viewed within the Service and time spent on each;
• Date and time of access;
• Device type and unique device identifiers;
• Referring URL.

4.3.2 Cookies and Tracking Technologies

We use the following types of cookies:

Essential Cookies (Session): Required for authentication, session management, and core Service functionality. These cannot be disabled without impairing the Service.

Preference Cookies (Persistent): Store Your settings, language preferences, and login details to personalize Your experience.

Analytics Cookies (Persistent): Used to understand how the Service is used, track feature adoption, and improve performance. These are only activated with Your consent where required by law.

You can manage cookie preferences through Your browser settings. Disabling essential cookies may impair Service functionality.

4.3.3 Microsoft Clarity (Behavioral Analytics)

We use Microsoft Clarity, a behavioral analytics tool provided by Microsoft Corporation, to understand how Users interact with the Service. Microsoft Clarity collects data such as:

• Session recordings (cursor movements, clicks, page scrolling);
• Interaction heatmaps;
• IP address (anonymized);
• Device and browser information.

Tracknana's use of Microsoft Clarity is strictly analytical, limited to improving the interface and product experience. Data sharing features with the Microsoft Advertising network are disabled. We do not combine data collected by Clarity with any other User personal data for advertising or profiling purposes.

Important: Microsoft Clarity acts as an independent controller of the data it collects. For more information, see the Microsoft Privacy Statement at privacy.microsoft.com.

If You do not wish Microsoft Clarity to collect data from Your session, You may opt out through the Service's privacy settings or via Microsoft's opt-out mechanisms.

4.4 Information from Third Parties

4.4.1 Stripe

We receive subscription and billing status information from Stripe as described in Section 4.1.2.

4.4.2 LLM Feature (OpenAI)

When You use the AI Campaign Assistant, the aggregated daily metric snapshots stored in Our database are used to build a JSON summary of Your last 30 days of campaign metrics, which is sent to OpenAI's GPT-4o-mini model for processing. The snapshots are retained for up to 90 days and automatically deleted thereafter. OpenAI processes the transmitted summary pursuant to its Data Processing Addendum (DPA) available at openai.com/policies/data-processing-addendum.

5. How We Use Your Personal Data

We process Your Personal Data for the following purposes and on the following legal bases:

We will not use Your Personal Data for purposes materially different from those described above without providing You notice and, where required, obtaining Your consent.

6. Data We Do Not Collect or Store

For transparency, the following categories of data are explicitly NOT collected or stored by Tracknana:

• Full credit card numbers, CVVs, or bank account details (handled exclusively by Stripe);
• Full ad campaign data beyond the snapshots described in Section 4.2.1;
• Google Analytics property data (retrieved via API in real time, not stored);
• Ad creative assets or their metrics (retrieved via API in real time, not stored);
• The transient JSON summary sent to OpenAI for the LLM Feature;
• Biometric data, health data, or government-issued identification numbers;
• Precise geolocation data beyond IP-based approximate location;
• Personal data from visitors of checkout pages where the UTM Tracking Script is deployed (which operates exclusively client-side).

Note about the Tracknana Pixel: Unlike the UTM Tracking Script, the Tracknana Pixel transmits data to Our servers. Data collected by the Pixel is described in Section 4.1.7 and governed by the DPA in Section 4.1.8.

7. How We Share Your Personal Data

7.1 Service Providers and Sub-processors

We share Your data with the following categories of Service Providers, solely to the extent necessary to provide the Service:

7.2 Legal and Compliance Disclosures

We may disclose Your Personal Data if required to do so by law or in response to valid legal process, including:

• Court orders, subpoenas, or other compulsory legal processes;
• Requests from government agencies or law enforcement authorities;
• To protect the rights, property, or safety of Tracknana, Our Users, or the public;
• To investigate or prevent suspected fraud, security threats, or violations of these Terms.

7.3 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or substantially all of Our assets, Your Personal Data may be transferred to the acquiring entity. We will notify You before Your Personal Data is transferred and becomes subject to a different privacy policy.

7.4 No Sale of Personal Data

We do not sell, rent, or trade Your Personal Data to third parties for monetary or other valuable consideration. This applies regardless of the User's jurisdiction.

8. Data Retention

We retain Your Personal Data only as long as necessary for the purposes described in this Policy. Specific retention periods are as follows:

When retention periods expire, We securely delete or anonymize the data. Residual copies may persist in encrypted backups for a limited period consistent with Our backup schedule before automatic purging.

9. Data Security

We implement industry-standard technical and organizational measures to protect Your Personal Data, including:

• Encryption in transit (TLS/HTTPS) for all communications between Your Device and Our servers;
• Encryption at rest for sensitive data, including passwords (bcrypt hashing with salting) and TOTP secrets;
• Regular security assessments and vulnerability scanning;
• Access controls limiting employee and contractor access to Personal Data on a need-to-know basis;
• Secure server infrastructure located in Virginia, United States, with physical and network security controls;
• Incident response procedures for potential data breaches.

While We implement commercially reasonable security measures, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security of Your data.

10. International Data Transfers

Our servers are located in Virginia, United States. If You are located outside the United States, Your Personal Data will be transferred to and processed in the United States.

We ensure that international data transfers are conducted with appropriate safeguards. For Users in Brazil, transfers are carried out based on the hypotheses provided for in Article 33 of the LGPD, including: (i) contractual obligations with Service Providers; and (ii) specific contractual clauses for international transfers.

Specifically:

• Data sent to OpenAI is transferred under OpenAI's Data Processing Addendum;
• Data processed by Stripe is transferred under Stripe's DPA;
• Data collected by Microsoft Clarity is processed by Microsoft under its Data Protection Addendum and the EU-US Data Privacy Framework.

By using the Service, You consent to the transfer of Your data to the United States under the safeguards described above.

11. Your Privacy Rights

11.1 Rights Available to All Users

Regardless of Your location, You have the following rights regarding Your personal data:

• Access: Request a copy of the Personal Data We hold about You;
• Correction: Request correction of inaccurate or incomplete Personal Data;
• Deletion: Request deletion of Your Personal Data, subject to legal retention obligations;
• Portability: Request Your data in a structured, commonly used, machine-readable format;
• Withdrawal of Consent: Withdraw consent for data processing at any time;
• Objection: Object to processing based on legitimate interests;
• Restriction: Request restriction of processing under certain circumstances.

To exercise any of these rights, contact Us at [email protected] or through Your Account settings. We will respond within 15 days.

11.2 Brazil (LGPD — Lei Geral de Proteção de Dados)

If You are located in Brazil, You have the following rights under the LGPD (Article 18):

• Confirmation of the existence of data processing;
• Access to Your data;
• Correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion of unnecessary, excessive, or non-compliant data;
• Portability of Your data to another provider;
• Deletion of data processed with Your consent;
• Information about entities with which Your data has been shared;
• Revocation of consent.

We process Your data under the legal bases of the LGPD: consent, contract performance, legitimate interest, and legal obligation. You may file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.

11.3 International Users

For users located outside Brazil, Tracknana respects the fundamental privacy rights provided for in applicable local legislation. You may exercise any rights provided by Your country's legislation by contacting Us at [email protected]. Tracknana will seek to fulfill Your request within the timeframes required by the applicable law in Your case.

12. Account Deletion and Your Data

You may delete Your Account at any time through Your Account settings. Upon account deletion:

• Your profile data (username, email, hashed password) will be permanently deleted from Our active systems;
• All Webhook Data (Leads and Customer data) will be permanently deleted;
• All webhook configurations, UTM parameters, and custom settings will be deleted;
• All stored campaign metric snapshots, monitored campaign configurations, Telegram alert rules, and dashboards will be permanently deleted;
• All data collected by the Tracknana Pixel associated with Your Account will be permanently deleted;
• Linked Third-Party Service connections (Google, Meta, TikTok) will be revoked;
• TOTP two-factor authentication secrets and recovery code hashes will be deleted;
• Active paid subscriptions will be canceled through Stripe.

Residual data may persist in encrypted backups for a limited period consistent with Our backup schedule before automatic purging. Payment and billing records may be retained for up to 60 months to comply with tax and financial regulatory obligations.

13. Children's Privacy

The Service is not intended for use by anyone under the age of eighteen (18). We do not knowingly collect Personal Data from children under 18. In compliance with COPPA, We specifically do not target or knowingly collect information from children under thirteen (13).

If You are a parent or guardian and believe Your child has provided Us with Personal Data, please contact Us immediately at [email protected]. If We discover that We have collected Personal Data from a child in violation of applicable law, We will take immediate steps to delete such data.

14. Third-Party Links and Services

The Service may contain links to third-party websites, applications, or services not operated by Us. We are not responsible for the privacy practices of these third parties. We encourage You to review the privacy policies of any third-party service You access through the Service.

15. Do Not Track Signals

We honor Do Not Track (DNT) browser signals where technically feasible. When We detect a DNT signal, We limit data collection to essential cookies and Service functionality data. For analytics cookies, We treat a DNT signal as equivalent to opting out.

16. Automated Decision-Making

The LLM Feature provides AI-generated insights about Your advertising campaigns. These outputs are informational only and do not constitute automated decision-making or profiling that produces legal or similarly significant effects on You. No automated decisions are made regarding Your Account status, subscription, or access to features.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When We make material changes:

• We will post the updated Policy on Our website with a new "Last Updated" date;
• We will notify You via email at the address associated with Your Account;
• Where required by law, We will obtain Your renewed consent before implementing changes that affect how We process Your data.

We encourage You to review this Policy periodically. Your continued use of the Service after the updated Policy becomes effective constitutes Your acceptance of the changes.

18. Data Breach Notification

In the event of a data breach that poses a risk to Your rights and freedoms:

• We will notify affected Users via email within seventy-two (72) hours of becoming aware of the breach, or as otherwise required by applicable law;
• We will notify the relevant data protection authority as required by applicable law (e.g., ANPD in Brazil);
• We will provide information about the nature of the breach, the data affected, the likely consequences, and the measures We have taken or propose to take to mitigate the effects.

19. Contact Information

If You have any questions, concerns, or requests regarding this Privacy Policy or the processing of Your Personal Data, You may contact Us:

• Data Controller: Tracknana Software Development Ltda.
• Trade Name: Tracknana
• CNPJ: 66.059.324/0001-03
• Location: Mamborê, Paraná, Brazil
• General email: [email protected]
• Legal and authorities email: [email protected]
• Website: www.tracknana.com

For privacy complaints, You may also contact the relevant data protection authority in Your jurisdiction as referenced in Section 11 above.

By creating an Account or using the Service, You acknowledge that You have read, understood, and agree to this Privacy Policy.