Security and data protection
Where your data lives, who can see it and how long it is kept.
Last updated: October 29, 2026. The binding text is the Privacy Policy and the Terms of Service.
At a glance
- Hosting
- Google Cloud, europe-central2 (Warsaw, Poland, EEA)
- GDPR role
- Processor for your store visitors, controller for your account
- Data processing agreement
- Part of the Terms of Service, no signature needed
- Encryption
- TLS 1.2+ in transit, AES-256 at rest
- Visitor data retention
- 90 days Free, 180 days Pro, 365 days Business and Custom
- Breach notice to customers
- Within 24 hours of becoming aware
Hosting and data location
AxiTrace runs on Google Cloud in the europe-central2 region (Warsaw, Poland), inside the European Economic Area. The application, the event pipeline, the analytics database (ClickHouse), the account database (MySQL) and the queues (Google Cloud Memorystore for Valkey) all run there.
Data leaves the EEA only where you or the service require it: conversions you choose to send to an ad platform such as Meta, Google or TikTok, and the AI Advisor, whose model provider (Anthropic) processes the report input in the United States under Standard Contractual Clauses without any personal data of your store visitors.
GDPR roles and data processing agreement
For the visitors and buyers of your store, you are the controller and AxiTrace is your processor: it processes their data only on your instructions and configuration. For your own account, billing and support, AxiTrace is the controller.
The data processing agreement is part of the Terms of Service, so it applies from sign-up without a separate signature. Requests for the executed Standard Contractual Clauses go to info@axitrace.com.
With the optional consent gate switched on, AxiTrace reads Google Consent Mode v2, TCF and common consent platforms, and an event the visitor did not consent to is not forwarded to an ad platform.
How data is protected
- Encryption in transit: TLS 1.2 or higher between browsers, stores and AxiTrace.
- Encryption at rest: AES-256 for sensitive data in the databases.
- Credentials: ad platform OAuth tokens and API keys are stored encrypted and never written to logs in plain text.
- Access control: production access is limited to authorized personnel on the least-privilege principle, with multi-factor authentication for every administrative login.
- Monitoring: systems are monitored continuously, with an incident response procedure.
Data sent to ad platforms
AxiTrace sends conversions only to the platforms you connect and only the events you enable. Email, phone and name are hashed with SHA-256 before they leave AxiTrace. Auto Exclusion for Google Ads is off by default; when you switch it on, only IP addresses from your own fraud list are sent, and only to your own Google Ads account.
AI assistants and the API
Connecting Claude, ChatGPT or Cursor through the MCP server, or a script through the REST API, is your decision. You sign in with OAuth and choose the workspaces and permissions the connection gets on a consent screen; buyer contact details are returned only with a separate permission. Every connection can be revoked in the dashboard, and API access records are kept for 90 days. The assistant's provider receives the data under your own agreement with it.
Retention and deletion
- Store visitor event data: 90 days on Free, 180 days on Pro, 365 days on Business and Custom. You can set a shorter period in the workspace settings or request deletion at any time.
- Google Ads click ids: up to 90 days, for offline conversion uploads.
- Account data: for the life of the account and up to 30 days after its deletion.
- Billing records: up to 7 years, as Polish tax law requires.
Sub-processors
| Company | Purpose | Location |
|---|---|---|
| Google Cloud Platform | Hosting of the application, databases (MySQL, ClickHouse, Valkey) and queues | EU (europe-central2) |
| Hetzner Online GmbH | Free tools scanner server; stores no personal data | Germany |
| Anthropic PBC | AI model for the AI Advisor and the shop check; no store visitor personal data is sent | United States (SCCs) |
| Cloudflare, Inc. | Turnstile bot check on public forms | United States (DPA) |
| Stripe | Payments, as an independent controller | Independent controller |
Customers are told by email at least 14 days before a new sub-processor is engaged. The full list with each provider's terms is in Section 10 of the Privacy Policy; the ad platforms and store platforms you connect are your own choice and listed there too.
Incidents
If a personal data breach affects data processed for you, AxiTrace notifies you within 24 hours of becoming aware of it, with what happened, the data and people affected, the likely consequences and the measures taken. As a controller, AxiTrace notifies the Polish supervisory authority within 72 hours where the law requires it.
Certifications
AxiTrace itself does not hold a SOC 2 report or an ISO 27001 certificate. Its infrastructure provider, Google Cloud, holds SOC 2 Type II, ISO/IEC 27001, ISO/IEC 27017 and ISO/IEC 27018. Payments run through Stripe, which is PCI DSS Level 1 certified; AxiTrace never stores card numbers.
Contact
Security questions, questionnaires and vulnerability reports: info@axitrace.com.