Legal
Last updated: 21 October 2026
SyncBeacon (“we”, “us”, “our”) is a server-side conversion tracking platform operated from the European Union. We act as a Data Processor on behalf of our customers (merchants), who remain the Data Controller of their end-user storefront data. For Partner Program accounts and applications, SyncBeacon is the controller of the partner’s own business contact and payout data.
For questions about this policy, contact us at hello@syncbeacon.cloud.
When you register, we collect:
When your browser tracker or server-side webhook fires, SyncBeacon ingests:
We do not use device fingerprinting or intentionally collect end-user names and postal addresses for tracking. Network metadata (such as IP address) may be processed transiently for secure request handling, anti-abuse, and delivery diagnostics.
When you connect a storefront and enable product sync or ad-pause features, SyncBeacon may process:
This data is used to run out-of-stock ad pause, surface product status in your dashboard, and diagnose integration issues. It does not include shopper names, emails, or postal addresses.
Payments are processed by Mollie B.V. (PCI DSS Level 1 certified). We never receive or store credit card numbers, IBAN details, or other payment instrument data. We only store your Mollie customer ID and subscription status.
While you use the SyncBeacon registration pages, we collect limited first-party analytics so we can see where sign-up is abandoned and improve the flow. This may include:
Internally, we may count how many distinct funnel sessions share the same IP hash within the retention window so we can see whether signup interest is returning (product analytics only). We do not use that signal to contact or market to visitors.
This data is used only for signup analytics and operational support. It is not used for marketing emails or advertising without a separate legal basis (consent). Funnel analytics rows are automatically deleted after 90 days.
On the public marketing website (syncbeacon.cloud), only after you accept analytics cookies, we may use a first-party pageview beacon so we can measure visits including in-app (SPA) navigations that do not create a full page load. With the same consent, blog pages may use a similar first-party engagement beacon (view / scroll depth). These beacons store only:
If you choose Reject, we do not write these session ids and do not send these client events. We do not store IP addresses or personal contact details with these events. Rows are deleted after 90 days. Separately, aggregated visit metrics may still be derived from server access logs (without storing individual IPs in our analytics database); that processing does not require the analytics cookie choice.
If you apply to or participate in the SyncBeacon Partner Program, we process:
When a partner claims a merchant, we may email that merchant a confirmation link so they can accept or decline the attribution. We do not share storefront event or catalogue data with partners.
Operational monitoring uses pseudonymous and business-operational data only. We do not use conversion or product monitoring to build advertising profiles of your customers, and we do not sell this telemetry to third parties.
We do not sell, rent, or share your data with third parties for their marketing purposes.
| Purpose | Legal Basis |
|---|---|
| Service delivery | Contract performance (Art. 6(1)(b)) |
| Billing & invoicing | Contract performance (Art. 6(1)(b)) |
| Security & fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| EU tax compliance | Legal obligation (Art. 6(1)(c)) |
| Conversion & product monitoring (reliability, troubleshooting, service improvement) | Contract performance (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)) |
| Registration funnel analytics (signup drop-off & return-visit interest) | Legitimate interest (Art. 6(1)(f)) |
| Marketing website pageview & blog engagement analytics (first-party client beacons) | Consent (Art. 6(1)(a)); storage on your device also requires consent under TTDSG / ePrivacy |
| Marketing emails (future) | Consent (Art. 6(1)(a)) |
| Partner Program (partner accounts, attribution, commission settlement) | Contract performance (Art. 6(1)(b)); claim emails to merchants also Art. 6(1)(f) legitimate interest in accurate referral attribution |
Storefront event data is retained according to your subscription plan:
| Plan | Retention Period |
|---|---|
| Pilot | 14 days |
| Essentials | 30 days |
| Growth | 90 days |
| Enterprise | 360 days |
After the retention period, event data is automatically purged by a nightly background job.
Account data (email, company name, subscription records) is retained for the duration of your account and for up to 7 years thereafter for tax and legal compliance.
Partner Program account, attribution, and commission records are retained for the duration of the partnership and for up to 7 years thereafter for tax and accounting compliance. Pending claim tokens expire as described in the Partner Program terms.
Registration funnel analytics (including optional email and technical metadata described in section 2.5) and consented marketing website pageview / blog engagement events (section 2.6) are retained for up to 90 days and then automatically purged.
We share data only with the following categories of recipients, all bound by data processing agreements:
| Sub-Processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Infrastructure hosting | Germany (EU) |
| Mollie B.V. | Payment processing | Netherlands (EU) |
| Ad platforms (Meta, Google, etc.) | Conversion event forwarding (on merchant’s instruction) | Global |
Our servers are located in Germany (EU). Storefront event data may be transferred to ad platform servers outside the EEA when you configure an ad platform. These transfers are covered by the ad platforms’ own transfer mechanisms, including Standard Contractual Clauses (SCCs), where applicable.
As a merchant account holder, you have the right to:
You can exercise the first four rights from the GDPR Controls page in your dashboard, or email hello@syncbeacon.cloud.
The SyncBeacon dashboard ( app.syncbeacon.cloud) uses only strictly necessary cookies and localStorage items for authentication, UI preferences (theme), and a random registration-funnel session id on signup pages (first-party analytics described in section 2.5). When you open a registration URL with a partner referral code (?ref=), we may set a first-party cookie sb_partner_ref (up to 90 days) so the signup can be attributed to that partner. It is used only for Partner Program attribution, not for advertising profiles.
On the public marketing website (syncbeacon.cloud), only after you accept analytics, we may store a first-party pageview or blog session id in localStorage (section 2.6) and load Apollo (visitor identification for B2B sales analytics). If you choose Reject, those first-party analytics tags are not run and Apollo is not loaded. You can change this choice at any time via "Cookie preferences" in the site footer. Apollo is operated by Apollo.io; see their privacy documentation for how identified company/contact data is processed.
We may update this policy from time to time. Material changes will be notified by email at least 14 days before taking effect.
Data Protection Contact: hello@syncbeacon.cloud
If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local supervisory authority (e.g., the BfDI in Germany).