ConversionOS and privacy
ConversionOS stores hashed identifiers — SHA-256 email, phone and name — plus stable anonymous customer IDs, never raw emails or names. Browser-facing paths reject plaintext personal data outright, and OAuth and CAPI tokens are encrypted at rest and never exposed to the browser.
Conversion tracking inherently touches customer data — ad platforms match conversions to users. ConversionOS is built so that matching works without your customers' personal data sitting in another system in readable form.
What is stored
- Hashed identifiers
- Email, phone and name are stored as SHA-256 hashes. This is the format ad platforms expect for matching, and it is not reversible into the original value.
- Anonymous customer IDs
- A stable identifier links a customer's purchases over time for lifetime-value reporting, without carrying who they are.
Plaintext personal data is rejected, not just discarded
Browser-facing ingestion paths reject plaintext personal data rather than accepting and then cleaning it. A misconfigured integration fails loudly instead of quietly sending customer data it should not.
Credentials
- OAuth and CAPI tokens are encrypted at rest.
- Credentials are never exposed to the browser — all destination calls are made server-side.
- The per-website site key can be rotated instantly if you believe it has been exposed.
Your obligations
AdProtektor is a processor for this data; you remain the controller. Your privacy notice should reflect that you use conversion tracking and, if you have enabled it, session recording. See Session recording for that specific disclosure requirement.
Frequently asked questions
Is AdProtektor GDPR-compliant?
The product is built for it — hashed identifiers, no plaintext personal data on browser-facing paths, encrypted credentials, and a DPA available on our website. Compliance also depends on your own consent handling and privacy notice.
What happens if I rotate the site key?
The old key stops working immediately, so update your installed snippet at the same time or tracking will stop.
Related articles
ConversionOS destinations
Connect Meta Pixel and Conversions API, Google Analytics 4, and Google Enhanced Conversions for Web.
Session recording
Replay the sessions of flagged visitors to see exactly what happened, with plan-based retention and the privacy disclosure it requires.
Account settings
Timezone, date format, language, branding, password, and the per-website settings that affect what gets tracked.