Privacy Policy

Last updated: June 2, 2026

1. Who We Are

WA Tracking ("we", "us", "our") operates watracking.com, a SaaS service that helps Google Ads professionals track which keywords and campaigns drive WhatsApp contacts on their clients' websites.

For privacy-related enquiries, contact us at hello@watracking.com.

2. What Data We Collect

From website visitors (via the GTM snippet):

• Google Click ID (GCLID): the unique identifier Google Ads appends to ad clicks
• Keyword that triggered the ad click
• Match type (exact, phrase, or broad)
• Campaign ID
• Page URL where the WhatsApp click occurred
• Timestamp of the click
• A unique reference code generated per click (e.g. REF-K72B391C)

From dashboard users (our customers):

• Email address (via Clerk.dev authentication)
• Plan and subscription status (via Lemon Squeezy)
• Domain names they wish to track

3. What We Never Collect

We also do not collect:

• WhatsApp message content
• Personal names or phone numbers of website visitors
• Browser fingerprinting data
• Device identifiers
• Cookies (we use browser localStorage only for GCLID persistence within a session)

4. How We Use Data

Click attribution data is used solely to:

• Display keyword and campaign attribution in the customer's dashboard
• Generate CSV exports for Google Ads offline conversion uploads
• Enforce plan limits (e.g. event counts per month)

Customer account data (email, plan) is used to authenticate users, send transactional emails, and manage billing.

We do not use any data for advertising, profiling, or sale to third parties.

5. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA) and United Kingdom, our legal bases for processing personal data are:

• Contract performance: processing your email and account data to provide the service you subscribed to
• Legitimate interests: processing website visitor click data on behalf of our customers, who have obtained appropriate consent from their own website visitors

Our customers (the website owners) are responsible for obtaining any necessary consent from their own website visitors in accordance with applicable laws.

6. Data Sharing and Third Parties

We share data only with the following service providers, strictly to operate the Service:

• Cloudflare: Hosting, CDN, and database (Cloudflare D1). Data is encrypted at rest and in transit. Cloudflare Privacy Policy
• Clerk.dev: User authentication. Clerk Privacy Policy
• Lemon Squeezy: Payment processing and subscription management. Lemon Squeezy is our merchant of record and processes payments independently. Lemon Squeezy Privacy Policy
• Resend: Transactional email delivery. Resend Privacy Policy

We do not sell, rent, or share your personal data with any other third parties.

7. Data Retention

• Click event data: retained for the lifetime of the active account, then deleted within 30 days of account closure
• Account data: retained for the duration of the subscription and 30 days after cancellation, then permanently deleted
• Payment records: retained by Lemon Squeezy in accordance with their data retention policies and applicable financial regulations

8. Data Security

All data is stored on Cloudflare's infrastructure with encryption at rest and in transit (TLS 1.3). Access to the database is restricted to our Workers via authenticated bindings. We do not store authentication credentials in our own systems. This is delegated entirely to Clerk.dev.

9. Your Rights

Depending on your location, you may have the following rights:

• Access: request a copy of the personal data we hold about you
• Correction: request correction of inaccurate data
• Deletion: request deletion of your account and associated data
• Portability: request your data in a machine-readable format (CSV export is available directly from the dashboard)
• Objection: object to processing of your data

To exercise any of these rights, email hello@watracking.com. We will respond within 30 days.

10. Cookies and Local Storage

We do not use cookies. The GTM snippet uses browser localStorage to persist the GCLID and keyword across page navigation within the same browser. This data is stored locally on the visitor's device and is never transmitted to our servers directly. It is only included in the payload when a WhatsApp button click occurs.

11. Children's Privacy

Our Service is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, contact us immediately at hello@watracking.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify active customers by email at least 7 days before material changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

13. Contact

For any privacy-related questions, requests, or complaints:
Email: hello@watracking.com
Website: watracking.com