SetRoasFlowAll documents

SETROASFLOW — DPA ANNEX: PROCESSING DETAILS

Version: Draft — 25 August 2026

Controller: Merchant

Processor: SetRoasFlow

Subject matter:

Server-side conversion tracking, customer data infrastructure, CDP, analytics, segmentation, audience activation, personalization, reporting, exports and connected integrations.

Duration:

For the lifetime of the applicable Merchant account/project, subject to earlier deletion by the Merchant and applicable deletion/recovery periods.

Personal data:

  • Email; stored in clear in CDP where consent permits; SHA-256 hashed for advertising platforms.
  • Phone; SHA-256 hashed for advertising platforms; clear only for configured CRM destinations where permitted.
  • External customer ID; SHA-256 hashed.
  • Name, surname, city, province/state, postal code and country; hashed before advertising-platform transmission.
  • IP address and user-agent; may be sent in clear to supported conversion APIs where permitted.
  • Advertising click identifiers.
  • Event/context information.
  • Country/region and device type.
  • Attribution information.
  • Derived profile metrics including LTV, AOV, repeat-buyer status, churn risk and predicted LTV.

Special categories:

The Service is not intended for special-category personal data or criminal-offence data. The Merchant must not submit such data.

AI:

The Service is designed not to submit end-customer personal data to AI features. Merchant-provided free text is forwarded as typed and may contain personal data.

Processing operations:

Collection, transmission, normalization, hashing, identity resolution, storage, analytics, segmentation, activation, export and deletion.

Retention/deletion:

Live CDP profiles remain for the account/project lifetime unless deleted earlier. Event records are retained for a rolling period of 24 months. Project deletion removes applicable live data within 24 hours. Residual provider recovery copies may persist for limited periods before automatic expiration.

Operator access:

Authorized SetRoasFlow personnel may have technically possible administrative access to production data stores for operations, debugging and support, subject to organizational and contractual restrictions.