Privacy Policy

Account information. We collect the email address and authentication information needed to create and secure your ZeroConfig account.

Website and event information. When you activate tracking, ZeroConfig may process page URLs, timestamps, event names, form submissions, user agent, IP address, consent signals, and advertising click identifiers such as gclid, fbclid, fbc, fbp, and li_fat_id. Email addresses and phone numbers included in configured conversion events are normalized and SHA-256 hashed before transmission to an advertising platform.

CRM information. If you connect HubSpot, ZeroConfig processes the deal and contact fields needed to report a closed sale: deal amount, currency, close date, pipeline stage, and the associated contact's email address and stored click identifiers.

Configuration and diagnostic information. We store the domains, element selectors, event mappings, advertising destinations, conversion action and conversion rule identifiers, delivery statuses, and error details needed to configure and operate the service.

OAuth credentials. When you connect a supported service, we receive and store OAuth access or refresh tokens. We do not receive or store your Google, Meta, LinkedIn, HubSpot, Cloudflare, or other third-party account password.

Basic website usage information. Our hosting and security providers may process request logs, IP addresses, browser type, device type, and timestamps to deliver and protect the website. We do not use Google user data for website analytics or advertising.

When you choose “Continue with Google,” ZeroConfig requests only the Google permissions shown on the Google consent screen. These permissions allow ZeroConfig to:

• Access the Google Ads customer accounts that the signed-in Google user is authorized to manage, including customer resource names and customer IDs.
• Read the names, IDs, categories, and status of Google Ads conversion actions so the user can select the correct conversion destination inside ZeroConfig.
• Create or upload customer-authorized conversion events to the selected Google Ads account through the Google Ads API and Google Data Manager API.
• Maintain offline access with an OAuth refresh token so configured conversions can continue after the user closes ZeroConfig.

ZeroConfig does not request access to Gmail, Google Drive, Google Calendar, contacts, photos, or unrelated Google profile content. ZeroConfig does not access an Ads account until the user chooses to connect Google.

When you connect Meta, ZeroConfig uses Facebook Login and requests the ads_read and business_management permissions. These permissions allow ZeroConfig to:

• Read the names and IDs of the ad accounts the signed-in Meta user is authorized to manage, and the pixels attached to them, so the user can choose a destination pixel.
• Send customer-authorized conversion events to the selected pixel through the Meta Conversions API, including hashed email addresses and phone numbers, the fbc and fbp click identifiers, IP address, and user agent.
• Store the access token needed to continue sending those events.

ZeroConfig does not request access to your Meta profile, friends, posts, messages, photos, or page content, and does not read campaign performance or audience data.

When you connect LinkedIn, ZeroConfig requests the r_ads and rw_conversions scopes. These permissions allow ZeroConfig to:

• Read the names, IDs, and status of the LinkedIn ad accounts the signed-in user is authorized to manage.
• Read and create conversion rules in the selected ad account so the user can choose or add a conversion destination inside ZeroConfig.
• Send customer-authorized conversion events to the selected conversion rule through the LinkedIn Conversions API, including hashed email addresses, the li_fat_id first-party tracking identifier, and IP address.

ZeroConfig does not request access to your LinkedIn profile, connections, messages, or feed. If you supply a LinkedIn access token issued directly in Campaign Manager instead of signing in, we store and use that token for the same purposes and nothing else. A LinkedIn token stored by one ZeroConfig account is never used on behalf of another.

When you connect HubSpot, ZeroConfig requests the oauth, crm.objects.deals.read, crm.objects.contacts.read, crm.schemas.deals.read, crm.schemas.contacts.write, and forms scopes. These permissions allow ZeroConfig to:

• Identify the connected HubSpot portal so incoming webhook events can be matched to your ZeroConfig account.
• Read your deal pipelines and stages so you can choose which stages count as a closed sale.
• Read a closed deal and its associated contact when its stage changes, limited to the fields listed in section 1.
• Create the contact properties that store click identifiers (gclid, fbc, and li_fat_id), and add those properties as hidden fields on your HubSpot forms so a click can be matched to the deal it produced.

HubSpot notifies ZeroConfig when a deal's stage changes; ZeroConfig does not poll or bulk export your CRM. Apart from creating the click-identifier properties and hidden form fields described above, ZeroConfig does not write to your CRM, and it does not read unrelated contacts, companies, tickets, notes, or email content.

We use collected information only to provide, secure, maintain, and support ZeroConfig. This includes authenticating users; installing and configuring edge tracking; showing available advertising accounts, pixels, conversion actions, and conversion rules; routing configured conversion events; honoring consent signals; diagnosing failed deliveries; preventing fraud and abuse; responding to support requests; and complying with law.

Data received from Google, Meta, LinkedIn, and HubSpot is used only to provide the features the user requests from that platform. We do not use it for personalized advertising of our own, retargeting, credit decisions, surveillance, or any purpose unrelated to the user-facing functionality described in this policy.

We do not sell, rent, or trade personal information or data received from a connected platform. We do not share it with data brokers or use it to build advertising profiles.

We disclose information only in these circumstances:

• At your direction. Configured event data is sent to the advertising or business platform you select, such as Google, Meta, or LinkedIn. Data read from HubSpot is sent only to the advertising destinations you enable for closed deals.
• Service providers. Cloudflare provides edge and security services, and Supabase provides authentication and database infrastructure. They process data for us under contractual confidentiality and security obligations and only as needed to provide their services.
• Legal and safety reasons. We may disclose information when required by law or when reasonably necessary to protect users, ZeroConfig, or the public from fraud, abuse, or security threats.
• Business transfer. Information may transfer as part of a merger, acquisition, financing, or sale, subject to this policy and applicable law.

We do not use or transfer Google user data for serving advertisements. We do not permit humans to read Google user data except with the user's affirmative agreement for support, when necessary for security or abuse investigation, to comply with law, or when the data has been aggregated and anonymized for internal operations. We apply the same restriction to data received from Meta, LinkedIn, and HubSpot. We do not use any collected data to train general-purpose artificial intelligence or machine-learning models.

ZeroConfig reads the consent state published by a Consent Management Platform you deploy, currently Cookiebot and OneTrust, and the Global Privacy Control signal sent by a visitor's browser. When advertising consent is refused, or when Global Privacy Control is enabled and the visitor has not affirmatively agreed on your banner, ZeroConfig does not send the event to any advertising platform and records that it was skipped. You remain responsible for deploying and configuring your CMP correctly, as described in our Terms of Service.

ZeroConfig stores account settings, connector configurations, OAuth credentials, event mappings, and delivery logs in Supabase-hosted systems. Website events are processed through Cloudflare infrastructure. Data may be processed in countries other than the one where you live, subject to safeguards required by applicable law.

We use safeguards designed to protect data, including TLS in transit, access controls, tenant-level database protections, and encryption provided by our infrastructure services. OAuth tokens are not displayed after they are stored. Webhook deliveries from HubSpot are signature-verified before they are processed. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.

• Advertising event and delivery logs are retained for up to 90 days unless a shorter period is required by law or requested by the customer.
• Website configuration, event mappings, selected account identifiers, and OAuth credentials are retained while the relevant connector or ZeroConfig account remains active.
• Security, support, and legal records may be retained as reasonably necessary to resolve disputes, enforce agreements, prevent abuse, or meet legal obligations.

You may request deletion of your ZeroConfig account, platform data, OAuth credentials, configurations, and event records by emailing [email protected] from your account email. We will acknowledge the request and delete or irreversibly anonymize eligible data within 30 days, except where retention is legally required. Backup copies may remain for a limited period until overwritten through normal backup cycles.

You can disconnect any connector inside ZeroConfig at any time, which deletes our copy of its token and stops all forwarding to that platform. Deleting our copy does not invalidate the token itself, so you can also revoke access from the platform, which does: the third-party connections page in your Google Account, Business Apps in Meta Business Settings, the permitted-services page in your LinkedIn settings, or the Connected Apps page in your HubSpot account settings. Revocation stops future access but does not automatically delete data previously stored by ZeroConfig; email [email protected] to request deletion.

You may also decline any authorization. The rest of ZeroConfig remains available, but the features for that platform will not work.

ZeroConfig uses essential browser storage and cookies to maintain authentication, protect sessions, and remember necessary service settings. On a customer's own website, the ZeroConfig edge worker sets first-party cookies to retain click identifiers so a later conversion can be attributed. We do not use information received from Google APIs for advertising cookies or cross-site advertising.

Depending on your location, you may have rights to access, correct, export, restrict, object to, or delete personal information, or withdraw consent. To exercise a right, email [email protected]. We may need to verify your identity before completing the request. You may also complain to your local data-protection authority.

ZeroConfig is a business service and is not directed to children under 13, or the minimum age required by local law. We do not knowingly collect personal information from children. Contact us if you believe a child has provided information to ZeroConfig.

We may update this policy to reflect service, legal, or regulatory changes. We will post the updated policy here and change the effective date. We will provide additional notice when required by law.

For privacy questions, questions about data received from a connected platform, or deletion requests, contact: