TrackRev
Privacy

Privacy Policy

We wrote this in plain language because you deserve to understand it — not because a lawyer made us. If anything is unclear, email maruf@trackrev.io.

Last updated:

Who we are

TrackRev (trackrev.io) is a link tracking and revenue attribution service. When we say "TrackRev", "we", "us", or "our" in this policy we mean the operator of this service. We act as the data controller for the personal data you provide when creating an account or using the dashboard.

For data our redirect and pixel collect on your visitors — on your behalf — you are the data controller and we act as the data processor. That distinction is explained in Data our product collects.

Data we collect about you

When you create a TrackRev account and use the service we collect the following categories of personal data:

  • Account data: your name, email address, and workspace name, provided when you sign up or update your profile.
  • Billing data: if you subscribe, your card details are tokenised by Stripe. We receive only the last four digits, card brand, expiry date, and billing name — we never store card numbers or CVVs.
  • Workspace configuration: the tracking links, custom domains, integration credentials (Stripe restricted keys stored encrypted in Supabase Vault), affiliate programme settings, and commission rules you create inside TrackRev.
  • Usage data: pages visited inside the dashboard, features used, and errors encountered, collected through our own first-party instrumentation. We do not use Google Analytics, Mixpanel, Amplitude, or any third-party analytics tool inside the product.
  • Support communications: emails and messages you send to our support addresses, retained for the duration of the support relationship.

Why we collect it (legal bases)

We rely on the following legal bases under UK GDPR and the EU General Data Protection Regulation:

  • Contract performance: account data and billing data are necessary to provide the service you signed up for and to charge for it.
  • Legitimate interests: usage data helps us understand how the product is used so we can improve it. We have assessed that this does not override your rights; you can object by emailing maruf@trackrev.io.
  • Legal obligation: we retain billing records for up to seven years to comply with tax and accounting regulations.
  • Consent: we will ask for your explicit consent before using your data for any purpose not listed here, such as marketing emails about new features.

Data our product collects on your behalf

When a visitor clicks one of your TrackRev links or fires a pixel event on your site, our service records the following on your behalf. In GDPR terms, you are the data controller for this data; TrackRev is your data processor.

  • Click event: link clicked, timestamp, country and city (derived from the visitor's IP — the raw IP is used only for the geo-lookup and is not stored long-term), user agent string, HTTP referrer, and UTM parameters embedded in the URL.
  • Visitor identifier (vid): a random UUID set in a first-party cookie on your domain (when configured with a custom cookie-domain) or on our shortlink domain otherwise. It is not tied to any real-world identity unless your site calls our identify() endpoint with a user ID you supply.
  • Pixel events: page views, custom events, and any properties you pass when calling trackrev.track(). You control exactly what data is sent.
  • Revenue events: when Stripe, Paddle, or Lemon Squeezy fires a webhook to TrackRev, we record the charge amount, currency, and the customer ID you pass — no card data ever reaches TrackRev.

As the data controller for visitor data, you are responsible for having an appropriate legal basis to collect it — typically a cookie consent notice on your site — and for responding to data subject requests from your own visitors. TrackRev provides CSV export so you can supply personal data records on request.

Sub-processors

We use the following third-party services to operate TrackRev. Each is bound by a data processing agreement and processes data only on our documented instructions:

  • Stripe — payment processing and billing. PCI DSS Level 1 certified. Stripe privacy policy.
  • Vercel — hosting, serverless functions, and global edge network. Redirect requests are handled at the edge node nearest to your visitor. Vercel privacy policy.
  • Supabase — managed PostgreSQL database (US region). All workspace data — links, clicks, events, affiliate records, revenue attribution — lives here, gated by Row Level Security so no request can access another workspace's rows. Supabase privacy policy.

We do not share your personal data with advertisers, data brokers, or any sub-processor not listed above. If we add a new sub-processor that processes personal data, we will update this section and notify you by email.

Cookies

Cookies set on trackrev.io

  • Authentication cookies (sb-access-token, sb-refresh-token): Set by Supabase Auth on login. Strictly necessary for the service to function — these are not analytics cookies. The access token expires after 1 hour; the refresh token after 7 days. Both are removed on logout.
  • Stripe cookies: if you visit the billing page, Stripe's embedded component may set cookies for fraud prevention. These are Stripe's responsibility and covered by Stripe's cookie policy.

TrackRev does not set analytics, advertising, or third-party tracking cookies on trackrev.io or app.trackrev.io.

Cookies set on customer domains

When you configure a custom cookie-domain in your workspace settings, our pixel sets a _trv_vid cookie on your domain. From your visitors' perspective this is a first-party cookie. You are responsible for obtaining consent where required by PECR, the ePrivacy Directive, or applicable local law before the cookie is set.

Where data lives

All TrackRev customer and workspace data is stored in the United States:

  • Supabase PostgreSQL (us-east-1, AWS Virginia): workspace data including links, clicks, events, affiliate records, and revenue attribution rows all reside here.
  • Vercel edge network: redirect requests are handled globally at the edge node closest to the visitor, but computed analytics and logs are persisted back to Supabase in us-east-1. Vercel does not persistently store visitor IPs.

International data transfers

If you are located in the UK or European Economic Area (EEA), your personal data is transferred to and stored in the United States. We rely on the following safeguards to protect that transfer:

  • Vercel and Supabase cover international transfers via Standard Contractual Clauses (SCCs) approved by the European Commission, or are certified under the EU–US Data Privacy Framework where applicable.
  • You may request a copy of the applicable transfer mechanism by emailing maruf@trackrev.io.

Retention periods

  • Account data (name, email): retained while your account is active; deleted within 30 days of account closure.
  • Billing records: retained for 7 years from the date of transaction to meet tax and accounting obligations.
  • Click and event data: retained for the lifetime of your workspace; exported (on request) and then permanently deleted within 30 days of account closure.
  • Raw IP addresses: used at click time for the country/city geo-lookup only; not stored in the click record.
  • Support communications: retained for 3 years after the last interaction, then deleted.

You can export all workspace data to CSV from the Settings page at any time before closing your account.

Your rights

Under UK GDPR and the EU General Data Protection Regulation you have the following rights. All requests should be sent to maruf@trackrev.io and will be acknowledged within 72 hours.

  • Right of access: request a copy of the personal data we hold about you and information about how it is used.
  • Right to rectification: ask us to correct inaccurate or incomplete data.
  • Right to erasure ("right to be forgotten"): ask us to delete your account and associated personal data, subject to legal retention obligations (e.g. billing records).
  • Right to data portability: receive your account data and workspace data in a machine-readable format (JSON or CSV).
  • Right to restriction: ask us to pause processing while a dispute about accuracy or lawfulness is resolved.
  • Right to object: object to processing based on legitimate interests, including profiling. We will stop unless we can demonstrate compelling legitimate grounds that override your rights.
  • Right to withdraw consent: where processing is based on consent, withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

California residents (CCPA / CPRA): you have the right to know what personal information we collect and how we use it, the right to delete it, the right to correct inaccurate information, and the right to opt out of any sale or sharing of your personal information. We do not sell or share personal information. To exercise your rights, email maruf@trackrev.io.

We respond to all verified requests within 30 days. If we need more time (up to 60 days in complex cases), we will notify you.

Supervisory authority

If you believe we have mishandled your personal data, you have the right to lodge a complaint with a supervisory authority. We would prefer you contact us first so we can try to resolve the issue directly. If you are not satisfied with our response:

  • UK residents may contact the Information Commissioner's Office (ICO) at ico.org.uk.
  • EEA residents may contact their local data protection authority.

Changes to this policy

We may update this privacy policy from time to time. For material changes — those that affect your rights or change how we use your personal data — we will send an email to your account address at least 14 days before the change takes effect, and post a banner in the dashboard.

The "Last updated" date at the top of this page always reflects the most recent revision. Continued use of TrackRev after a material change takes effect constitutes acceptance of the updated policy.

Contact

Privacy requests and data subject rights: maruf@trackrev.io

Security and vulnerability disclosures: maruf@trackrev.io

General enquiries: maruf@trackrev.io

Privacy Policy · TrackRev