Privacy by design
GDPR compliance isn't a checkbox we added later - it's the foundation SyncBeacon was designed on. No consent dark patterns, no workarounds.
Privacy architecture
SHA-256 hash in browser
Email and phone hashed client-side - plain text never leaves the page.
EU servers only
Hashed events processed in the EU. No plain-text PII is stored in the relay layer.
Consent gate
Non-consenting visitors: event dropped - not queued, not anonymised.
Hashed forwarding
Consented events forwarded to ad platforms under each platform's EU DPA.
Data protection
SyncBeacon's servers and database are hosted in the EU. Plain-text PII never reaches those servers - it is SHA-256 hashed in the browser first. The hashed event data forwarded to ad platforms (Meta, Google, TikTok) carries no reversible personal information and is transmitted under each platform's own EU Data Processing Agreement.
Email addresses and phone numbers are SHA-256 hashed in the user's browser before transmission. Plain-text PII never leaves the page - ever.
Reads signals from your existing Consent Management Platform (CMP). Non-consenting visitors never have identifiable data forwarded to ad platforms.
No reliance on third-party cookies whatsoever. Works identically regardless of browser cookie settings - compliant by architecture, not by workaround.
Only the fields required for conversion matching are captured and forwarded. No behavioural profiling, no fingerprinting, no cross-site tracking.
Built-in GDPR Article 17 erasure support. Remove stored event data for a user through your dashboard controls when handling Data Subject Access Requests.
FAQ
It can be, when consent is respected, data is minimised, and only permitted identifiers are forwarded. Compliance depends on implementation, consent banner configuration, and your privacy policy, not the concept alone.
SyncBeacon reads signals from your Consent Management Platform. In explicit mode, hashed customer identifiers are only forwarded when marketing consent was granted. Non-consenting orders can send limited, non-identifying order data where configured.
SyncBeacon processes and stores event data on EU servers in Germany. Only hashed, pseudonymised identifiers are forwarded to ad platforms under each platform's data processing terms.
No. SyncBeacon does not rely on third-party cookies. Click IDs and session context are stored as first-party data where permitted, and confirmed conversions are delivered server-side.
Only the fields needed for conversion matching: event name, value, currency, order ID, click IDs where available, and SHA-256 hashed email or phone when consent allows. Plain-text PII is hashed in the browser before it leaves the page.
Yes. SyncBeacon includes erasure workflows (GDPR Article 17) so you can remove stored event data for a user when handling data subject requests.
No legal review needed. No consent workarounds. Just a clean pipeline built for the EU.