Privacy & consent

Privacy is enforced at the edge, before any data leaves — not by a checkbox in a dashboard somewhere downstream.

Consent is resolved by region

Where the visitor is	Model	What it takes
EU, EEA, UK, Switzerland	opt-in	an explicit yes; without it, nothing is sent
United States and the rest	opt-out	sent unless the visitor refuses (GPC, US Privacy String, your own flag)
Unknown location	opt-in	fail-safe toward privacy

This runs server-side on every event. You don't configure it, and it can't be bypassed by a misconfigured tag.

Without consent

The event may still be counted as traffic, but everything identifying is stripped before dispatch: no user_data, no click IDs, no cookies, IP address and user agent anonymised, and the URL reduced to origin and path — query strings can carry personal data.

Who receives what

Destination	Receives
Meta, Google Ads, GA4, TikTok, Snapchat, Pinterest, Reddit	SHA-256 hashes only — never a clear-text email
Klaviyo, HubSpot	email and phone in clear text, only with consent
Your warehouse	hashes by default; clear text only if you switch it on, and only with consent

You pass identifiers to us in clear text; hashing happens at the edge. Ad platforms never see a raw email, whatever you send. See Destinations.

The personalization cookie

If you use on-site personalization, one extra cookie is set on your own domain: it holds only short segment ids — never an email, never a profile id, never a lifetime value. It is signed, so it cannot be forged, and it is not written at all where consent is required and hasn't been given.

Someone reading it learns "this browser is in segment a3f2b1c4", which means nothing without your dashboard. See On-site personalization.

US opt-out signals

Global Privacy Control and the US Privacy String are honoured automatically. When a US visitor has opted out we still send the conversion — but with each platform's own restricted mode: Meta Limited Data Use, Google Consent Mode, TikTok limited data use. You keep the measurement without using their data for targeting.

Connecting your cookie banner

The snippet reads common CMPs (Shopify Customer Privacy API, Google Consent Mode, Iubenda, Cookiebot) automatically. For a custom banner, expose your own signal in one of two ways:

// Option A — a cookie your banner sets:
document.cookie = 'srf_consent=granted; path=/; max-age=31536000'   // or 'denied'

// Option B — a function the snippet calls on every event:
window.getMarketingConsent = function () { return true }   // or false

What happens without any signal is decided by location, at the edge:

• Opt-in regions (EU/EEA, UK, Switzerland): fail-closed — no signal means no personal data leaves and no cookie is written. An explicit yes is required.
• Everywhere else (US and rest of world): opt-out — tracking works until the visitor says no (an explicit denial, Global Privacy Control, or the US Privacy String).

So a US store without a cookie banner gets full-fidelity tracking out of the box, while an EU visitor is protected by default — each according to the law that actually applies to them.

Data subject requests

Deleting a website purges its CDP data — profiles, identity map, segments, logs — from both the database and the live profile store. Under Settings you have two self-service options: Erase all tracking data permanently deletes everything collected across all your websites (profiles, events, analytics, logs, spend history) while keeping your account and configuration — tracking restarts from zero; Delete account removes everything, account included.

We can delete what we hold. Data already delivered to a destination lives under that platform's own retention rules, and has to be handled there.

Documents

The Privacy Policy, DPA, subprocessor list, retention policy and security overview are public at setroasflow.com/en/legal.