Security and privacy
Privacy and the LGPD: what TraceClose stores and for how long
Your operation’s data is yours: you are the controller and TraceClose is the processor. TraceClose keeps each customer’s data isolated, encrypts integration credentials, automatically deletes tracking data it no longer needs and handles export and deletion requests through our support team.
Who is responsible for what
For your leads’ and customers’ data (name, phone, conversations, sales), your company is the controller: it decides why and how the data is used, and it needs a legal basis to talk to these people and send conversion events to ad platforms. TraceClose is the processor: it handles this data only to provide the service. The details are in the data processing agreement and the privacy policy.
What gets deleted or trimmed automatically
A daily routine applies the time limits below, with nothing for you to do:
| Data | Time limit | What happens |
|---|---|---|
| Tracked link click that didn’t become a conversation | 8 days | Deleted. |
| Click that became a conversation | 90 days | IP address, browser, Meta click IDs, referring page and visitor ID are removed. The UTMs stay, since they back up the lead’s source. |
| Website lead | 90 days | IP address, browser and Meta click IDs are removed. The source stays. |
| Website visits (visit tag) | 90 days | Deleted. Only the daily totals remain. Visitors’ IP addresses are never stored. |
Conversations, leads and sales are kept for as long as your account exists, because they’re your sales history.
How your data is protected
- Isolation: each customer sees only their own data, with isolation enforced in the database itself, not just on screen.
- Credentials: Meta tokens and website secrets are encrypted (AES-256) and never shown again in the dashboard.
- Sessions: the database stores only a fingerprint (hash) of the session token, never the token itself.
- Data sent to Meta: email, phone and name are hashed with SHA-256, as Meta requires. See What data is sent to Meta.
- Less exposure within the team: in the service reports, salespeople see a shortened name and phone number for other salespeople’s leads.
Example: a deletion request
A customer of Example Co. (fictional data) asked to have their data deleted. The manager, Paula, checked the lead’s name and phone number in the dashboard and sent the request through our support team, with the account email. The same route works for exporting the whole company’s data before canceling the subscription.
Export and deletion
There’s currently no export or deletion screen in the dashboard. To request an export or deletion of data (for your company or for a contact), get in touch with us with the account email.
Segments with health data
The Clinic and Aesthetics segment templates come flagged as Sensitive data: the dashboard reminds you to handle the data in line with the LGPD, Brazil’s data protection law, and to check the ad platforms’ health restrictions before sending conversions. In the Clinic template, sending conversions comes turned off.
Didn’t work? See…
- I want to stop sending data to Meta: turn off Send conversions in Settings › Operations. See Send conversions to Meta.
- I want to count visits without cookies: see Cookie consent and domains.
Frequently asked questions
Does TraceClose sell or use my customers’ data?
No. The data you put into TraceClose stays yours, and TraceClose only processes it to provide the service, under the data processing agreement.
How long does TraceClose keep the IP address of people who click a link?
A click that didn’t become a conversation is deleted after 8 days. For one that did, the IP address is removed after 90 days.
How do I request deletion of a contact’s data?
Through our support team, with the account email. There’s no delete button in the dashboard today.
See the path from ad to sale in your WhatsApp.
Try TraceClose free for 7 days with your team. No card needed to try.