1. Introduction
This Privacy Policy describes how FirePixel ("FirePixel", "we", "us" or "our") collects, uses, and protects information in connection with our server-side tracking and event-routing platform available at firepixel.io and any related services (collectively, the "Service").
FirePixel is operated by Obed LLC, a company established in the United States. By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy.
2. Data Controller
For the purposes of the EU General Data Protection Regulation ("GDPR"), the data controller for personal data that we collect directly from you is:
3. Information We Collect
3.1 Account and Billing Information
When you register for and use the Service, we may collect:
- Name
- Email address
- Company name and details
- Billing address and payment-related information (via our payment processors)
- Authentication and account preference information
3.2 Event and Tracking Data
FirePixel is a server-side tracking and routing platform. When you implement FirePixel on your websites, apps, or e-commerce stores, we process event data that you choose to send to us, which may include:
- Page views, clicks, scrolls, form submissions, purchases, and other events
- Conversion events such as leads, registrations, checkouts, and sales
- Order details (e.g., order ID, value, currency, products purchased)
- Referrer URLs, UTM parameters, campaign and ad identifiers
- Customer identifiers that you choose to send, such as email address or hashed identifiers
- Timestamps and event metadata
The exact scope of event data depends on how you configure FirePixel and what data you choose to send to us via our SDKs, APIs, or integrations.
3.3 Technical and Log Information
When you access or use the Service, we automatically collect certain technical information, including:
- IP address
- Browser type and version
- Device and operating system information
- Log files, including access times, API usage, and error logs
- Security and authentication logs
3.4 Cookies and Similar Technologies
We use cookies and similar technologies in connection with our website and Service to:
- Maintain your session and authenticate requests
- Provide core functionality and security
- Analyze usage of the Service and improve performance
You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Service.
4. How We Use Your Information
We use the information described above for the following purposes:
- To provide, operate, and maintain the FirePixel Service
- To process event data and send events to advertising and analytics platforms on your behalf
- To authenticate users and secure the Service
- To process payments and manage subscriptions and billing
- To respond to support requests, questions, and feedback
- To monitor, detect, and prevent fraud, abuse, or security incidents
- To analyze and improve the performance and functionality of the Service
- To send administrative communications, such as service notifications and policy updates
- To comply with legal obligations and enforce our terms and policies
5. Legal Bases for Processing (EEA/UK Users)
If you are located in the European Economic Area or the United Kingdom, we process your personal data under the following legal bases:
- Performance of a contract – to provide and operate the Service you sign up for.
- Legitimate interests – to maintain security, prevent fraud, improve the Service, and support business operations, where these interests are not overridden by your rights.
- Consent – for certain uses of cookies, marketing communications, or processing of end-user data where required by law. You may withdraw consent at any time.
- Legal obligations – to comply with accounting, tax, and other regulatory requirements.
6. Data Sharing and Disclosure
We do not sell, rent, or broker personal data under any circumstances.
We may share information as follows:
- Service providers and processors: We use trusted third parties to help us operate the Service (e.g., hosting providers, payment processors, email and support tools). These providers only process data on our instructions and under appropriate data protection agreements.
- Bot protection (Cloudflare Turnstile): When you ask us to email you a login code, create an account, or reset your password, our login and signup pages run Cloudflare Turnstile to check that the request comes from a person and not an automated script, so nobody can use our forms to flood other people's inboxes. Most visitors see nothing; some are asked to tick a box. To do this, Cloudflare receives your IP address and signals from your browser and device (such as the browser type and how the page was interacted with). Cloudflare uses this data only to provide and improve the check, and we never send it your email address. SeeCloudflare's Turnstile privacy addendumandprivacy policy.
- Advertising and analytics platforms: When you configure integrations, we send event data on your behalf to platforms such as Meta, Google, TikTok, OpenAI (ChatGPT Ads), Snapchat, Pinterest, and other systems you connect. You control which integrations are enabled and what data is sent.
- OpenAI (ChatGPT Ads): When you connect a ChatGPT Ads pixel, we send your conversion events to OpenAI through its Conversions API, on your behalf, so that OpenAI can measure and attribute your ChatGPT ads. For each event this can include the event type, time and page URL; your customer's email address, phone number, external ID, and first and last name, sent only as SHA-256 hashes, never in plain text; their IP address and browser user agent; their city, region, postal code, and country; the ChatGPT Ads click reference ("oppref") and browser reference ("obref"); and the order value, currency, and the products in the order. OpenAI processes this data under its own terms. SeeOpenAI's privacy policy.
- Legal and compliance: We may disclose information if required by law, regulation, legal process, or governmental request, or to protect our rights, users, or the public.
- Business transfers: In connection with a merger, acquisition, financing, or sale of all or part of our business, data may be transferred as part of that transaction, subject to appropriate safeguards.
7. International Data Transfers
FirePixel is operated from the United States, and your information may be processed and stored there or in other countries where our service providers are located. Where required, we implement appropriate safeguards for international data transfers, such as standard contractual clauses or equivalent legal mechanisms.
8. Data Retention
We retain personal data only for as long as necessary for the purposes described in this Privacy Policy or as required by law. Retention periods may vary depending on the type of data:
- Account and billing data: Kept for the duration of your account and for a period thereafter as required for legal, tax, and accounting purposes.
- Event and tracking data: Retained in accordance with your account settings and our internal policies. You may request deletion or truncation of certain data where technically feasible.
- Logs and security data: Retained for a limited period to ensure security, troubleshoot issues, and maintain service integrity.
9. Data Security
We implement technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration. These measures include encrypted connections, restricted access controls, and regular monitoring of our systems.
However, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.
10. Your Rights
Depending on your location and applicable law, you may have the following rights regarding your personal data:
- Right of access – to obtain a copy of the personal data we hold about you
- Right to rectification – to correct inaccurate or incomplete data
- Right to erasure – to request deletion of your personal data in certain circumstances
- Right to restriction – to request that we limit our processing in certain cases
- Right to object – to object to processing based on legitimate interests or direct marketing
- Right to data portability – to receive your data in a structured, commonly used format
- Right to withdraw consent – where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal
If you are a resident of California or a similar jurisdiction with equivalent laws, you may have additional rights under CCPA/CPRA or similar legislation, including the right to request information about data we collect, the right to request deletion, and the right to non-discrimination for exercising your privacy rights.
To exercise your rights, please contact us at info@firepixel.io. We may need to verify your identity before responding to your request.
11. End-User Data and Responsibility
As a FirePixel customer, you are responsible for ensuring that your use of our Service and your configuration of tracking on your websites and apps comply with all applicable laws and regulations, including obtaining any required consents from your end users.
When we process event data relating to your end users, we generally act as your data processor and process such data only on your instructions, as described in our agreements with you.
12. Signing in with Google or Apple
You can create a FirePixel account or log in with your Google account or your Apple Account instead of a password, and you can connect either one later from your Profile. This section covers signing in only. Connecting Google Ads is a separate step, described in section 13.
12.1 What we receive
- Google: we ask only for Google's basic sign-in permissions (your name, email address and profile). Google tells us your Google account ID, your email address and whether Google has verified it, your name, and the address of your profile picture.
- Apple: we ask only for your name and email address. Apple shares your name once, the first time you agree to share it with FirePixel. If you choose Hide My Email, Apple gives us a private relay address (ending in @privaterelay.appleid.com) instead of your real one, and forwards our emails to you.
We never receive your Google or Apple password. Signing in does not give us access to your contacts, files, calendar, email or anything else in your Google or Apple account, and we never post or act on your behalf.
12.2 How we use it
- To create your account and log you in. We recognise you by the account ID Google or Apple gives us, not by your email address.
- If you log in with Google and a FirePixel account already uses the same email address, verified by Google, we connect Google to that account and email you to tell you. We never match an account by an Apple private relay address; to use one with an existing account, connect Apple from your Profile.
- To name a new account. When you connect Apple to an existing account, Apple's name is used only if your account has no name yet.
- To email you about your account, for example login codes and a notice whenever a sign-in method is connected or removed.
12.3 What we store and for how long
- For each connected sign-in method: which provider it is, the account ID it gave us, the email address it reported, whether that address is an Apple private relay address, and when you last used it.
- Your name and email address become part of your FirePixel account, like any other account details.
- Google: we do not keep your profile picture, and we keep no Google tokens for sign-in. The short-lived token Google issues is used once to read the details above and is then discarded.
- Apple: we keep the token Apple issues, encrypted, for one purpose only: to withdraw FirePixel's access at Apple when you disconnect Apple or delete your account.
- Our security logs record sign-in events against your FirePixel account ID, not your email address. When you confirm your identity with Google, we may also log how long ago and by which method (such as a password or a passkey) you last signed in to Google.
We keep these details for as long as the sign-in method stays connected to your account.
12.4 Disconnecting
You can disconnect Google or Apple at any time in your FirePixel Profile. We delete the connection straight away, and we stop connecting that provider to your account automatically by email until you connect it again yourself. When you disconnect Apple, we also ask Apple to withdraw FirePixel's access.
You can also remove FirePixel at the provider:
- Google: at myaccount.google.com/permissions. This stops Google sharing your details with us, but it does not remove the connection stored at FirePixel, so disconnect in your Profile as well.
- Apple: at appleid.apple.com, under Sign-In and Security, then Sign in with Apple, choose FirePixel and stop using Sign in with Apple. Apple tells us when you do this, or when you delete your Apple Account, and we then remove the connection in the same way and email you. You can still log in with your email address.
If you use an Apple private relay address and turn off email forwarding for FirePixel, our emails to you, including login codes, may no longer reach you.
12.5 When you delete your account
Deleting your FirePixel account deletes your sign-in connections with it. If Apple was connected, we also ask Apple to withdraw FirePixel's access; this happens in the background shortly after the deletion. There is nothing to withdraw at Google, because we hold no Google sign-in tokens.
13. Google Ads and Google APIs
To send conversions to Google Ads, you connect a Google account to FirePixel and grant it access through Google's permission screen. This section describes the data we receive from Google APIs through that connection. It is separate from signing in with Google (section 12), and sections 4 and 6 do not apply to it.
13.1 The permissions we ask for
- Google Data Manager API: to send the conversions you configure into the Google Ads accounts you choose.
- Google Ads API: to list the Google Ads accounts you can access and their conversion actions, so you can choose where conversions go.
- Basic profile (name, email address and profile): to know which Google account you connected and to show it in your dashboard.
13.2 What we access and store
- Your Google account ID, email address, name and the address of your profile picture, so you can tell connected accounts apart.
- The access token and refresh token Google issues to us, and the list of permissions you granted.
- From Google Ads: the IDs, names and currencies of the accounts you can access; their conversion actions (ID, name, type, category, status and tag details); and their conversion tracking settings. We save only the account and conversion action you select, in your pixel settings.
- From the Data Manager API: the ID Google gives each upload, and the status Google reports for it, such as how many records were accepted or rejected and why.
We do not read your campaigns, ads, keywords, budgets, reports, billing or audience lists, and we do not create, change, pause or delete anything in your Google Ads account other than the conversions you ask us to send.
13.3 How we use it
We use data from Google APIs only to provide the Google Ads connection you set up: to show you your accounts and conversion actions so you can choose a destination, to send the conversions you configure, and to check and show you whether Google accepted them.
We do not use it for advertising, including retargeting or personalised or interest-based ads. We do not sell it, and we do not transfer it to advertising platforms, data brokers or information resellers. We do not use it to decide creditworthiness or for lending, and we do not use it to train AI or machine learning models. Our staff do not read it unless you ask us to (for example, in a support request), or it is needed for security or to comply with the law.
13.4 How we protect it
Access and refresh tokens are encrypted in our database and are never sent back to your browser. All traffic between FirePixel and Google uses encrypted connections (TLS), and access to our systems is restricted.
13.5 Sharing
We do not share data from Google APIs with anyone, except the hosting providers that run FirePixel, as part of providing the Service, or where the law requires it.
13.6 Retention, deletion and revoking access
We keep your Google account details and tokens while the Google account is connected. When you disconnect it in FirePixel (under Pixels, in your connected Google accounts), we ask Google to revoke our access and delete the stored tokens and account details straight away. Deleting your FirePixel account also deletes them, and we ask Google to revoke our access for every Google account that was connected.
We keep a record of each upload we made on your behalf: the ID Google gave it, the Google Ads account and conversion action it went to, how many conversions it held, and the status Google reported. It contains no tokens and no Google account details. We keep these records for as long as your FirePixel account exists, including after you disconnect Google, so you can still see Google's result for past events. Deleting your FirePixel account deletes them.
You can revoke FirePixel's access at any time at myaccount.google.com/permissions. To ask us to delete data we received from Google, email info@firepixel.io.
13.7 Limited Use
FirePixel's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
These rules cover the data we receive from Google APIs. They do not cover the event and conversion data you send to FirePixel about your own customers, which we deliver to Google on your instructions. That data is described in sections 3.2, 4, 6 and 11, and Google's handling of it is described in Google's Business Data Responsibility pages.
14. Children's Privacy
The Service is intended for use by businesses and individuals over the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take steps to delete such information. If you believe a child has provided us with personal data, please contact us at info@firepixel.io.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. When we do, we will revise the "Last updated" date at the top of this page. In some cases, we may provide additional notice (such as via email or in-app notifications).
Your continued use of the Service after any changes take effect will constitute your acknowledgment of the updated Privacy Policy.
16. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, you can contact us at: