Privacy Policy
How we handle data at TrackAtlas. Effective September 29, 2026.
This Privacy Policy explains how DAX CAPITAL LLC, operating the TrackAtlas service ("TrackAtlas", "we", "us"), collects and processes personal data. TrackAtlas is a business-to-business service: our customers are online merchants ("Merchants") who use us to measure and deliver conversion data for their stores.
We act in two distinct roles, and this policy is organized around them.
1. Where we are the controller: Merchants and site visitors
When you create a TrackAtlas account, visit trackatlas.io, or contact us, we are the controller of your data.
What we collect: account details (name, email address, company), authentication data, billing details (processed by our payment processor; we do not store full card numbers), support communications, and basic usage and security logs (IP address, browser, actions in the dashboard).
Why: to provide and secure the Service (performance of contract), to bill you, to answer support requests, to prevent fraud and abuse (legitimate interest), to send service communications, and to comply with legal obligations. We do not sell your personal data and we do not use it for third-party advertising.
2. Where we are the processor: Shopper Data
When a Merchant connects a store, TrackAtlas processes data about that store's visitors and buyers ("Shopper Data") on the Merchant's behalf and instructions. The Merchant is the controller of Shopper Data; we are their processor and service provider.
What we process on Merchants' behalf: commerce events (page views, add-to-carts, checkouts, orders and order values), technical data (IP address, user agent, first-party identifiers), advertising click identifiers (such as Meta fbc and fbp, Google gclid, gbraid and wbraid), UTM parameters, and, where provided by the store, hashed contact details (such as email or phone) used by advertising platforms for match purposes. Contact details are hashed before transmission wherever the destination platform supports it.
What we do with it: record it for the Merchant's attribution reporting, and deliver conversion events to the advertising platforms the Merchant has explicitly connected (such as Meta, Google Ads and Pinterest). We process Shopper Data only to provide the Service; we do not sell it, we do not use it to build advertising profiles of our own, and we do not combine it across Merchants except in aggregated, de-identified form to operate and improve the Service.
Shopper rights: if you are a shopper, the store you visited is the controller of your data. Please direct access, deletion or objection requests to that store; we support Merchants in fulfilling them.
3. Sharing and service providers
We share personal data only with:
- advertising platforms the Merchant has connected, as their processor and on their instruction;
- service providers that help us run TrackAtlas: cloud hosting and databases, payment processing, transactional email, and error monitoring, each bound by contractual confidentiality and data-protection obligations;
- AI assistants the Merchant connects through TrackAtlas Insights, at the Merchant's direction, as described in section 12;
- authorities, where required by law, and successors, in connection with a merger or sale of assets.
A current list of subprocessors is available on request.
4. International transfers
We are a United States company and process data in the United States and the European Union. Where personal data of individuals in the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
5. Retention
Account data is kept for the life of the account and as required for legal and accounting purposes. Shopper Data is retained only as long as needed to provide the Service and its reporting to the Merchant, and is deleted or anonymized after the Merchant's account closes, subject to a reasonable wind-down period and legal requirements.
Encrypted conversion delivery data is retained for up to 30 days while delivery is pending or needs recovery, and is deleted when processing succeeds. Delivery status records without contact identifiers are retained for up to 90 days.
6. Security
We protect data with encryption in transit, encryption of sensitive credentials at rest, access controls, hashing of contact identifiers, and monitoring. No system is perfectly secure; we notify affected Merchants of incidents as required by law.
7. Cookies
Our website and dashboard use strictly necessary cookies and similar storage: to keep you signed in, protect forms and store connections, remember settings you change such as the theme, apply the partner referral you followed and remember your cookie choice. They need no consent and cannot be switched off. Only if you allow Targeting Cookies, our website loads the Meta Pixel and the Google tag through our own tracking script, to measure which of our ads bring people to TrackAtlas; until then no Meta or Google tag loads and nothing is stored in your browser for advertising. The tracking technologies that TrackAtlas provides to Merchants run on the Merchants' stores under the Merchants' responsibility and their own cookie policies.
On an eligible partner referral journey, optional first-party analytics measures the pages you view and acquisition buttons you click, only after you allow Performance Cookies. You can decline or change your choice at any time through Cookie Settings at the bottom of every page. We do not collect form contents, passwords or full URLs in this history. Detailed journey events and sessions are retained for up to 90 days. Your cookie choice lasts 12 months if you allow, or 6 months if you decline, and we keep a record of it, without your IP address, as proof of consent. A referral identifier and your cookie choice may be shared between trackatlas.io and app.trackatlas.io. Account attribution, subscription records and partner commission accounting are handled separately and do not depend on optional navigation analytics.
Strictly Necessary Cookies
cc_tracking_session(Cookie, 12 hours): Keeps you signed in to the dashboard.cc_ws(Cookie, 1 year): Remembers the workspace you have open.cc_store(Cookie, 1 year): Remembers the last store you opened.shopify_oauth_state(Cookie, 10 minutes): Protects the Shopify connection flow against forgery.ta_consent(Cookie, 12 months, or 6 if you decline): Stores your cookie choices on this site and in the dashboard.ta_partner_ref(Cookie, 30 days): Records the partner link you followed, so your referral and its discount apply when you sign up.ta_meta_review_shop(Cookie, 1 hour): Session for the demo shop used in platform reviews.cc-theme(Local storage, Persistent): Remembers light or dark theme. Set only when you change it.ta-partner-analytics-denied(Session storage, Session): Remembers in this tab that you declined analytics.tracking-seen-notices(Local storage, Persistent): Remembers which dashboard notices you already closed.cc_attr_name_width_v1(Local storage, Persistent): Remembers the column width you set in Attribution.cc_attr_drill_v1_*(Local storage, Persistent): Remembers the columns you chose in Attribution.creatives:v2:*(Local storage, Persistent): Remembers how you set up the Creatives view._ta_consent(Cookie, 6 months): Your answer to our earlier, simpler cookie notice.
Performance Cookies
ta-partner-events-v1(Session storage, Session): Holds the pages of this visit until they are sent.ta_partner_analytics(Cookie, 30 days): Signed receipt that links analytics to your choice.
Targeting Cookies
_ta_vid(Cookie, 1 year): A random visitor id, so a sign-up can be linked to the ad visit before it._ta_touch_v1(Cookie, 90 days): The ad click that brought you here._ta_landing(Cookie, 1 year): The first page you landed on and the site that sent you._ta_utm_* and _ta_<click id>(Cookie, 90 days): The campaign tags and ad click ids of the link you followed._ta_sid(Cookie, 30 minutes): Groups the pages of one visit._ta_fbc(Cookie, 90 days): A copy of the Meta click id, for our server events._fbp(Cookie, 90 days): Set for the Meta Pixel: identifies this browser to Meta._fbc(Cookie, 90 days): Set for the Meta Pixel: the Meta ad click you came from._gcl_*(Cookie, 90 days): Set by the Google tag: the Google ad click you came from.
8. Your rights
Depending on your location, you may have rights to access, correct, delete, restrict or port your personal data, and to object to certain processing (including under the GDPR if you are in the EEA or UK, or under state privacy laws such as the CCPA if you are a California resident, which also gives you the right to know and the right to non-discrimination). Merchants and site visitors can exercise these rights by contacting us; shoppers should contact their store, as described above. You may also lodge a complaint with your local supervisory authority.
9. Children
The Service is not directed to children and we do not knowingly process children's data.
10. Changes
We may update this policy as the product and legal landscape evolve. Material changes will be announced through the Service. The effective date above always reflects the current version.
11. Data obtained from connected advertising accounts
When a Merchant connects an advertising account to TrackAtlas using that platform's authorization flow, the Merchant authorizes us to act on their behalf within that account. This section describes what we do with the data we obtain from it. It applies to Google Ads and Pinterest, and to any other platform connected the same way.
What we access. With the Merchant's authorization we read the conversion tracking configuration of their advertising account: the ad accounts they hold, with the names and currencies of those accounts; the conversion actions or conversion tags configured in them, with their identifiers and labels; and campaign performance and cost metrics. We also send to that same account the purchase and funnel events we measure on the Merchant's store.
Why. Solely to provide the Service to the Merchant who granted the access: to configure conversion tracking automatically and remove the transcription errors that manual setup causes, to deliver the conversions we measure to the Merchant's own advertising account, and to show campaign performance alongside those conversions in the Merchant's dashboard.
How we store it. Authorization tokens are encrypted at rest and are used only for the calls described above. We retain the conversion configuration we read so the Service can operate. We do not use data obtained from a connected advertising account for any purpose not described in this policy.
Sharing. We do not sell, rent or transfer data obtained from advertising platform APIs to any third party, except to a tool the Merchant itself connects and directs to receive it, such as an AI assistant under section 12. We do not use it for our own advertising, to train models, or to build profiles of individuals.
Deletion. A Merchant may revoke access at any time from the TrackAtlas dashboard or from their account settings on the platform. On revocation the authorization token is deleted from our systems and we stop accessing the account.
12. TrackAtlas Insights: AI assistants
TrackAtlas Insights is an optional feature that lets a Merchant connect an AI assistant, such as Claude (Anthropic) or ChatGPT (OpenAI), or another client of the Model Context Protocol, to their TrackAtlas account. The Merchant authorizes the assistant through a sign-in and consent screen on TrackAtlas.
What the assistant can read. Access is read only. When the Merchant asks a question, the assistant requests reports for the stores that Merchant can open in TrackAtlas: sales, orders and costs; advertising spend and platform-reported results; attribution by channel, campaign, ad set and ad, including campaign names and UTM values; funnel steps; tracking health; and recent orders with their number, value and credited channel. We do not send shopper names, email addresses, phone numbers, postal addresses or IP addresses to the assistant. The assistant cannot change settings, pixels, stores or campaigns.
Who controls it. The Merchant decides to connect the assistant and which questions to ask, and the report data goes to the assistant's provider on the Merchant's instruction. That provider processes it under the Merchant's own agreement and settings with them (including any use for model training), not as our subprocessor. Review the provider's terms and privacy policy before connecting. We do not receive the Merchant's conversations; we only receive the report requests the assistant makes.
What we keep. The connection (which assistant, when it was created and last used); access and refresh tokens, stored only as one-way hashes, which expire after one hour and 60 days respectively; and a log of each request (the report requested, the store, whether it succeeded and how long it took), kept for up to 180 days for security, abuse prevention and usage metrics.
Ending access. The Merchant can disconnect an assistant at any time under AI assistants in the TrackAtlas dashboard, which stops access on its next request. Changing the account password ends every connection. Data the assistant already received stays with its provider under the Merchant's agreement with them.
13. Contact
DAX CAPITAL LLC, operating TrackAtlas. Privacy questions and requests: through the help center at trackatlas.io/help or your account contact.