Privacy Policy

Plain-language summary. CleanClicks is a behind-the-scenes analytics tool used by other businesses to measure their advertising. We do not run our own ad targeting and we do not build profiles of you to sell. When you visit a website that uses CleanClicks, we receive a small amount of data the website operator already collects (the click that brought you, a randomly generated identifier, and, when you submit a form, an irreversibly hashed version of your email address) for the sole purpose of helping that operator measure the effectiveness of their advertising. You can opt out at any time using the methods described in Section 9. This summary is provided for convenience; the full policy below is what governs.

1. Introduction

CleanClicks (“we,” “us,” or “our”) operates a first-party conversion tracking infrastructure deployed on a global edge network. This Privacy Policy describes how we collect, use, store, and share information when our technology is installed on a website operated by one of our customers (“Customer Sites”) and when you visit our marketing site at cleanclicks.ai.

CleanClicks is operated by CJF & Associates LLC d/b/a ClickPath Consultants, a North Carolina limited liability company.

1.1 Our role under US privacy laws

When CleanClicks processes personal information collected through a Customer Site at the direction of that Customer, CleanClicks acts as a service provider under the California Consumer Privacy Act (Cal. Civ. Code §1798.140(ag)), a processor under the Virginia Consumer Data Protection Act (Va. Code §59.1-575), the Colorado Privacy Act (Colo. Rev. Stat. §6-1-1303), the Connecticut Data Privacy Act (Conn. Gen. Stat. §42-515 et seq.), and the comprehensive privacy statutes of Utah, Oregon, Texas, Florida, Delaware, Iowa, Indiana, Tennessee, New Hampshire, New Jersey, Maryland, Kentucky, Minnesota, Rhode Island, Nebraska, Montana, and any other state with a substantially similar designation now or hereafter in effect. The Customer is the business (CCPA) and the controller (other state laws) for that data and is responsible for determining the purposes and means of processing.

When you submit information directly to us through forms on cleanclicks.ai, when you sign up for a CleanClicks account, or when we research you as a business contact for outreach (Section 2.4), we act as the business (CCPA) and controller (other state laws) for that information.

1.2 Data Processing Addendum

Our processing of personal information on behalf of Customers is governed by a written Data Processing Addendum that incorporates the contractual terms required by Cal. Civ. Code §1798.140(ag)(1)(C) and the analogous provisions of other state privacy statutes. The current Data Processing Addendum is available on request from [email protected]. Customers entering into a CleanClicks subscription are bound by the Data Processing Addendum as a term of service.

1.3 Visitor recourse on Customer Sites

Because the Customer is the business or controller for data collected on its own site, requests to access, correct, delete, port, or restrict the processing of personal information collected on a Customer Site should be directed to the Customer in the first instance. CleanClicks will assist the Customer in fulfilling such requests in accordance with the Data Processing Addendum and applicable law. If you are unsure who operates a site that uses CleanClicks, the privacy policy on that site will identify the operator; you may also contact us at [email protected] and we will route your request to the Customer.

1.4 No HIPAA covered transactions

CleanClicks is not a “business associate” within the meaning of the Health Insurance Portability and Accountability Act, 45 C.F.R. §160.103, and CleanClicks’s services are not designed to receive, transmit, or maintain protected health information. Customers are contractually prohibited from deploying CleanClicks on web pages that capture or display protected health information without first executing a separate written business associate agreement, which CleanClicks does not offer at this time.

2. Information We Collect

2.1 On Customer Sites (tracking infrastructure)

When you visit a Customer Site that uses CleanClicks, we collect the categories of information described below through a lightweight first-party script served from the Customer’s own subdomain or, on a Shopify store, through a pixel the Customer adds to the store’s settings, which runs in Shopify’s own sandbox.

Statutory categories. For purposes of Cal. Civ. Code §1798.140(v) and the analogous provisions of other state privacy statutes, the personal information described in this Section 2.1 falls within the following statutory categories:

• Identifiers – including the random visitor identifier (cc_pid), advertising click identifiers (gclid, fbclid, msclkid, ttclid, tbclid, wbraid, gbraid, li_fat_id, ad_id, um_cl), Meta browser cookie values (_fbp and _fbc) when present, GA4 client and session identifiers, and the Usermaven anonymous identifier.
• Internet or other electronic network activity information – pages visited (the page address, with its campaign and click-identifier parameters, and the page title), referral source, UTM campaign parameters, conversion events, User-Agent string, and inferred bot-or-human classification.
• Geolocation data (non-precise) – country, region, city, and postal code derived from your IP address at the network edge. CleanClicks does not collect “precise geolocation” as defined by Cal. Civ. Code §1798.140(w) (a location identified within a radius of 1,850 feet or less).
• Commercial information – conversion events configured by the Customer, including purchase value and currency where applicable.
• Inferences – bot-or-human classification scores and traffic-quality categorizations.

The hashed email address described below is collected but, as a one-way SHA-256 cryptographic hash that cannot be reversed to the underlying email, is processed under our internal practices as a pseudonymous identifier. We acknowledge that some regulators take the position that hashed email addresses remain “personal information” for purposes of state privacy statutes; we treat the hashed email accordingly and apply the same protections, retention limits, and visitor rights as we would to a non-hashed identifier.

Sources of personal information. We collect this information directly from your interactions with the Customer Site. We do not purchase, license, or otherwise obtain personal information about Customer Site visitors from data brokers or other third-party sources. (Section 2.4 describes the business-contact information we obtain for our own outreach.)

Sensitive personal information. We do not collect “sensitive personal information” as defined by Cal. Civ. Code §1798.140(ae) (including, without limitation, government identifiers, account log-in credentials, precise geolocation, racial or ethnic origin, religious beliefs, union membership, contents of mail or electronic communications, genetic data, biometric identifiers, health data, or sex-life or sexual-orientation data). Customers are contractually prohibited from configuring CleanClicks to capture sensitive personal information.

Advertising click identifiers. We capture up to 10 click ID parameters from URL query strings when you arrive at a Customer Site from an advertising platform:

• Google Ads: gclid, wbraid, gbraid
• Meta (Facebook and Instagram): fbclid
• TikTok: ttclid, tbclid
• Microsoft Ads: msclkid
• Other: ad_id, um_cl (Usermaven)

These identifiers are kept in the Customer Site’s own browser storage, not in cookies. On pages that load CleanClicks’s own script, each stored click identifier is checked against a 90-day limit, counted from when it was first captured and measured by your device’s clock, each time the script reads it. The script also keeps a record of the latest identifier of each kind and when it was first seen, with no time limit, so that it does not store that one again from an old link; an earlier identifier of the same kind can be stored again if you open an old link that carries it, and it then starts a new 90 days. Where CleanClicks is installed as a WordPress plugin, the plugin also keeps its own copy, for as long as its installed version decides. Where CleanClicks is installed as a Shopify pixel, the pixel keeps its own copy with no time limit, until you clear the Customer Site’s data in your browser. Section 7 lists these items.

Visitor identifier. We generate a random universally unique identifier stored in a first-party cookie named cc_pid that lasts 1 year. Each time your browser sends us a conversion event that carries this cookie and no opt-out signal (no Global Privacy Control signal, no opt-out choice stored in your browser, and no refusal sent with the event), the same value is set again for another year, so it never lasts longer than 1 year from the latest such event. The events CleanClicks’s Shopify pixel sends usually do not carry this cookie, so they do not set it again. Some browsers can shorten it on their own; Safari, for example, can limit it to 7 days, depending on how the Customer Site’s tracking address is set up. This identifier contains no personally identifiable information and cannot be used to identify you across different websites.

Hashed email address. When you submit a form containing an email address on a Customer Site, the email address is processed as follows:

1. The email is normalized using industry-standard rules consistent with advertising platform requirements.
2. A one-way cryptographic hash is computed using the SHA-256 algorithm in your browser, before any data leaves your device.
3. Only the resulting 64-character hexadecimal hash is transmitted to our servers from your browser.
4. Our browser-facing API endpoints accept an email address only as its hash; the conversion endpoint rejects a request whose body carries an email field. CleanClicks’s browser code does, however, send the addresses of the page you are on, the page you came from, and the page you first landed on, as they are, so if the Customer Site puts your email address into a page address, it reaches our servers inside that address. We remove it before we keep or pass on that address, except inside an advertising click-identifier value, where it can remain (see Section 10 for this and for how raw emails are handled on server-to-server endpoints).

The hashed email is used solely to match conversion events (such as a purchase) back to the advertising click that brought you to the Customer Site, enabling accurate attribution reporting for the Customer.

Device and browser information.

• User-Agent string. Used for device-type classification and bot detection. Not stored beyond the retention period of the conversion record or audit log that holds it.
• IP address. Processed at the network edge for geographic classification (country, region, city, postal code). Geographic data is transmitted to advertising platforms in the format each platform’s official API requires. For platforms whose APIs support hashed location values (such as Meta), city, state or region, postal code, and country are SHA-256 hashed before transmission. For platforms whose APIs require unhashed location values (such as the Google Analytics 4 Measurement Protocol), the location values are transmitted in the format that platform’s specification requires. IP addresses are not retained in long-term storage; they appear in conversion records and traffic analytics for no longer than 90 days, and in security audit logs for no longer than 180 days, as described in Section 5.

Inferences and automated decision-making. We classify traffic as human, bot, or suspicious based on the User-Agent, IP, and behavioral signals described above at the network edge. This classification is used solely to suppress non-human events from being reported to the Customer’s advertising platforms. It does not affect your experience on the Customer Site, is not transmitted to advertising platforms about you individually, is not used for advertising targeting, and does not produce legal or similarly significant effects within the meaning of Va. Code §59.1-575 or analogous state statutes.

Browsing activity.

• Pages visited on the Customer Site (the page address, with its campaign and click-identifier parameters, and the page title)
• Conversion events configured by the Customer (form submissions, purchases, button clicks, page views, DOM element appearances)
• Referral source (the URL that brought you to the Customer Site)
• UTM campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content)

Analytics identifiers.

• GA4 client identifier (from the _ga cookie, if present)
• GA4 session identifier
• Usermaven anonymous identifier

Optional session analytics (Plerdy). If a Customer enables the optional Plerdy integration, CleanClicks proxies Plerdy’s analytics on the Customer Site through the Customer’s first-party tracking subdomain. When enabled, this may include behavioral analytics such as heatmaps, scroll and click tracking, and session recordings, processed by Plerdy as a third-party processor under Plerdy’s own terms and the Customer’s configuration. This integration is off by default and is controlled by the Customer; it is not part of CleanClicks’ standard conversion-tracking data and is not used by CleanClicks for advertising targeting.

2.2 On cleanclicks.ai (marketing site)

Our marketing site uses HubSpot forms for contact and audit requests. Information you voluntarily provide (name, email, company, website URL) is processed by HubSpot under their privacy policy.

We act as the business (CCPA) and controller (other state laws) for personal information you submit to us through forms on cleanclicks.ai.

• Categories. Identifiers (name, business email, company name, website URL), commercial information (your interest in our services), and internet activity information (pages viewed on cleanclicks.ai, UTM parameters, referral source).
• Sources. Directly from you when you complete a form, and from our analytics tools when you browse the marketing site.
• Purposes. Responding to your inquiry, providing the requested audit, and ongoing sales and marketing communications regarding CleanClicks. You may opt out of marketing communications at any time via the unsubscribe link in any marketing email.
• Recipients. HubSpot (CRM); Encharge (marketing automation); Stripe (only if you proceed to a paid subscription); Resend (transactional email delivery); Telegram (internal alerts to our team about billing and checkout events, such as a payment dispute, or a checkout we refused, did not apply, or did not link to an account; an alert can concern an account of any status, a checkout by someone who holds no account, or a Stripe event alone; besides fixed wording, an alert contains only an account ID where there is one, Stripe identifiers of a customer, subscription, Checkout Session, event or dispute, amounts, and a dispute’s response deadline; the account ID can be that of an account whose email address matched the one given at a checkout, even if someone else made that checkout; an alert never contains your name or email address); RB2B (website-visitor identification; see below); and our infrastructure providers. Except for the visitor-identification activity described below, we do not sell or share this information for cross-context behavioral advertising.
• Retention. Marketing leads are retained for 24 months from your last engagement with us, after which they are deleted unless you have become a paying customer. Retention of paying-customer account and billing records is described in Section 5. Retention is enforced by an automated workflow that deletes leads meeting these criteria on a recurring basis.

Website-visitor identification (cleanclicks.ai only). When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout. California and other state residents may also exercise the opt-out and other privacy rights described in Section 9. This activity applies only to cleanclicks.ai; it is never deployed on Customer Sites and is not part of the CleanClicks tracking service.

Tracking Health Check (cleanclicks.ai only). When you run the Tracking Health Check, we record the domain of the website you entered, the resulting score, the time of the check, and, where available, the campaign parameters (UTM values) and referring website domain that brought you to the page. We do not record your name, email address, IP address, or any cookie or session identifier with this log, and we do not use it to identify or contact you. We use it only to count Health Checks and to measure which channels bring visitors to the tool. It is stored with our infrastructure provider (Cloudflare) and deleted after 180 days.

2.3 GA4 OAuth access (audit tool)

If you sign up for a CleanClicks audit on cleanclicks.ai and grant CleanClicks permission to access your Google Analytics 4 property, we use Google OAuth to read traffic and configuration data from your property for the purpose of comparing what GA4 reports to you against what your first-party tracking captures. This is the basis of the GA4 Reality Check feature on your audit dashboard. Paid accounts that connect Google Analytics 4 on the Connections page use the same access, as described below.

What we access. When you click “Connect Google Analytics” during an audit, you are taken to Google’s consent screen and asked to grant CleanClicks the following scopes:

Scope	What it permits	Why we request it
https://www.googleapis.com/auth/analytics.readonly	Read sessions, conversions, channel data, and property configuration	Power the audit comparison and the GA4 Reality Check report
https://www.googleapis.com/auth/analytics.edit	Create a Measurement Protocol secret on the property you select; if you choose the optional “create a fresh property” path during onboarding, also create that new GA4 property and its web data stream inside your own Google Analytics account	Allow server-side first-party tracking to write conversion events into your existing GA4 property only if you later become a paying customer and choose this mode

We do not request user-management access (analytics.manage.users) or any ads-targeting scope. We never modify your reports, audiences, conversion goals, custom dimensions, or any other configuration on your property except as described in this paragraph, and each of these changes happens only as part of a step you ask for inside the CleanClicks dashboard. We create the Measurement Protocol secret described above, or reuse one we created before, and, only when you explicitly choose it during onboarding, a new GA4 property and web data stream in your own account. On a property we create for you, when you confirm the creation we also record Google’s user data collection acknowledgement on the property, which includes your confirmation that you have the required privacy disclosures for the data Google Analytics will collect (shown at the confirmation step); we try to set the property’s event data retention to 14 months, with user data reset on new activity; and we switch on Google Signals only if you tick that option, which is off by default. On an existing property you pick, we record that acknowledgement only if you tick the checkbox that shows it when you ask us to set up a Measurement Protocol secret, and we change no other setting on that property.

Google API Services Limited Use. CleanClicks’s use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, CleanClicks:

• uses information received from Google APIs solely to provide and improve the GA4 Reality Check feature, the optional Measurement Protocol delivery feature, the Google Ads account selection, conversion-action setup, and conversion upload features (Section 2.5), and related user-facing functionality;
• does not transfer information received from Google APIs to others except as necessary to provide or improve those user-facing features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to affected users;
• does not use or transfer information received from Google APIs for serving advertisements, including retargeted, personalized, or interest-based advertising;
• does not allow humans to read information received from Google APIs unless we have your affirmative agreement to view specific data, the access is necessary for security purposes (such as investigating abuse), the access is required to comply with applicable law, or the data is aggregated and used for internal operations in accordance with applicable privacy and other jurisdictional legal requirements; and
• does not use information received from Google APIs to develop, improve, or train generalized or non-personalized AI or machine-learning models.

What we read. Aggregate metrics only (session, page-view, event and purchase counts, gross purchase revenue, and channel groupings) and property metadata (account and property names and IDs, a property’s web data streams and their measurement IDs, the Measurement Protocol secrets on the data stream you choose, and each report’s time zone, currency and data-quality notes). We do not read individual user records, hit-level event data, audiences, or user IDs.

How we store the access. We exchange the authorization code Google returns for a long-lived refresh token. That refresh token is encrypted at rest using AES-256 with a per-account key and stored in our customer-state database. Short-lived access tokens (with a lifetime Google sets) are fetched as needed and stored, encrypted the same way, until the next one replaces them or the connection is deleted. The key material is isolated from application code and rotated under a documented procedure, so database backups containing encrypted refresh tokens cannot be decrypted without that isolated key material.

Effect of revocation. When you disconnect inside CleanClicks (Section 9.4), the encrypted refresh token is deleted from our database; disconnecting does not revoke the token with Google (Section 9.4 describes how to manage access on Google’s side). The comparison we compute from your Google Analytics 4 data is cached, and each cached copy expires 24 hours after it is written. Disconnect GA4 on your audit dashboard also tries to delete it straight away; a Disconnect on the Connections page leaves it to expire. For a site with a tracking monitor, we also keep a daily record of the purchase count and purchase revenue that Google Analytics 4 reports for that site, together with what CleanClicks sent to it, for 400 days, and each comparison refresh records the Google Analytics 4 session total in your account’s activity log. Disconnecting does not delete these records; they are kept as Section 5 describes.

2.4 Business contacts we research for outreach

We sometimes email businesses that may benefit from CleanClicks or ClickPath Consultants’ services. To do that, we research the company and one person there who is likely to make decisions about marketing or analytics. We act as the business (CCPA) and controller (other state laws) for this information.

• Categories. About the company: its website domain, its name, its country, its industry and approximate number of employees, and, for some companies, a score from our own automated check of the company’s public web pages. About the contact: name, job title, LinkedIn profile URL, business email address, and whether that email address could be verified (identifiers and professional or employment-related information). About our outreach: the stage of outreach, the dates we contacted you, the emails we sent, your replies, and our internal notes.
• Sources. Competitive marketing-data services (such as SpyFu) that list companies by their online advertising; a business-data service (Findymail) that lists companies by industry, size, and location, and that provides a contact’s name, job title, LinkedIn profile URL, and business email; LinkedIn profile pages we view by hand; our own automated check of the company’s public web pages; an email verification service (Reoon); and you, when you reply.
• Purposes. Marketing CleanClicks and ClickPath Consultants services to your business by email. We send a small number of emails, no more than 10 per day from each mailbox. Each one uses text we wrote and approved in advance, and an automated check confirms it matches that text before we send it. For some companies, we first send a LinkedIn connection request to the contact, and email them if they have not replied after two business days. Each email includes our postal address and a way to opt out. If you reply that you are interested, we follow up with you, and we may add you to our marketing email system.
• Recipients. Service providers that help us run this outreach: ActivePieces (workflow automation and storage); Cloudflare (hosting and storage for our outreach system and its records); Instantly (sending our emails and reading the replies to them); Findymail and Reoon (contact lookup and email verification); Google (email); Anthropic (AI drafting of our emails and sorting of replies); ClickUp (task tracking); Telegram (internal review messages); Aimfox (LinkedIn connection requests); Moxie (our customer records and call scheduling, if you reply to us or book a call); and Encharge (only if we add you to our marketing email system after you reply that you are interested). We do not sell this information, and we do not share it for cross-context behavioral advertising.
• Retention. We keep a prospect record while outreach is open. When outreach ends, we move the record to an archive and delete it 12 months after our last contact with you. If you opt out, we keep your email address on a do-not-contact list for as long as we run outreach, so that we never contact you again. When you opt out, or ask us to stop contacting your company, we may also add your company’s website domain to that list.

Your choices. To stop our emails, reply “unsubscribe” to any of them. We stop all emails to you as soon as we process the request, and always within 10 business days. To ask what we hold about you, or to have it deleted, email [email protected] with “Prospect Data Request” in the subject line, or use any method in Section 9. When we delete your record, we keep your email address on our do-not-contact list, and your company’s website domain if it is already there, so that the deletion cannot lead to a new email. We also keep records of our outreach that identify you only by a coded form of your email address.

Our own website checks. When our system checks a company’s public web pages for this outreach, we keep a record of that check (the domain, the score, and a reference to the prospect record) and delete it after 180 days. We never connect a Tracking Health Check that you run yourself on cleanclicks.ai (Section 2.2) to a prospect record, and running one does not start any outreach.

2.5 Google Ads OAuth access (conversion upload)

If you connect a Google Ads account to a site in your CleanClicks dashboard (platform.cleanclicks.io), we use Google OAuth to send that site’s conversions to the Google Ads account you choose and to set up the conversion actions that receive them.

What we access. When you connect Google Ads, during onboarding or on the Connections page, we send you to Google to grant access, and we ask for the following scope:

Scope	What it permits	Why we request it
https://www.googleapis.com/auth/adwords	Google’s page “OAuth 2.0 Scopes for Google APIs” describes it as: “See, edit, create, and delete your Google Ads accounts and data.”	Upload your site’s conversions to the Google Ads account you choose; list the accounts and conversion actions you can choose from; and, only when you ask, create conversion actions to receive those uploads

What we do with it. We use this access only for the following:

• List your accounts. Right after you grant access, we ask Google for the IDs of the Google Ads accounts your login can reach. To show you the accounts you can choose from, we also read each account’s name and whether it is a manager account and, for a manager account, the IDs and names of the active accounts under it. When you connect again, we may also ask a manager account we recorded for you whether it still gives access to the account you chose before.
• Read conversion actions. We read the name, type, and status of the conversion actions in the account you choose, so that you can link one and so that we can find actions we created before.
• Create conversion actions, only when you ask. When you press Create for me, we create a “CleanClicks – Purchase – [your site]” conversion action in the account you choose and, for Shopify stores and WordPress sites, “CleanClicks – Add to cart – [your site]” and “CleanClicks – Begin checkout – [your site]”. If an action with one of these names, or an earlier “CleanClicks – [your site]” purchase action, already exists, we link it instead of creating another. We create the Purchase action as a primary action and the Add to cart and Begin checkout actions as secondary actions. We do not edit or delete conversion actions, including when you disconnect.
• Upload conversions. When a conversion that carries a Google click identifier or a hashed email address happens on your site, our tracking service uploads it to the account you choose through the Google Ads API, with the data listed for Google Ads in Section 4, unless CleanClicks can tie it to an opt-out (Section 4). Uploads use the access you granted. If that access is not available when a conversion is ready to upload, our service may try the upload to the same account with CleanClicks’s own Google Ads login instead. We also use that login for scheduled and on-demand connection checks that read your account’s ID and name, and our staff can use it to list the conversion actions in your account and to create new ones.
• Test, only when you ask. When you ask CleanClicks to test your Google Ads connection, we send Google an upload that carries a hashed test email address of our own and asks Google only to validate it.
• Keep the connection working. We renew the access token regularly, to keep uploads working and to show you whether the connection works.

What we do not do. We do not read or change your campaigns, ad groups, ads, keywords, budgets, bids, audiences, or customer lists, and we do not read your cost, click, impression, or search-term reports.

Google API Services Limited Use. The Limited Use commitments in Section 2.3 apply to the information we receive through this access. The conversion data we upload comes from your site, not from Google APIs; each upload also carries your account ID and the conversion action’s ID, which we received from Google, and we upload only to the Google Ads account you choose.

How we store the access. We store the refresh token Google returns encrypted at rest, in the same way as the GA4 refresh token (Section 2.3). Each access token is valid for a time Google sets. We store each one encrypted in the same way, and our tracking service reads a separate copy of it, kept in our edge storage without the per-account key for no longer than the token’s lifetime (or one minute, if that is longer), to make uploads. With the connection we also store the IDs of up to 50 accounts your login can reach directly, the IDs of the active accounts under each manager account we list for you together with the ID of the manager that gives access to each, the ID of the account you choose, and the conversion actions linked to each event, and we record the connection (with every account ID Google returned) and your later account and conversion-action choices in your account’s activity log.

Effect of disconnecting. When you disconnect Google Ads on the Connections page, we delete the stored tokens and the list of accounts, remove the account you chose from your site’s tracking settings, and stop uploads for that site. The links to conversion actions and the ID of the manager account (if any) stay in your site’s tracking settings, and the activity-log records stay with your account; the 90-day post-cancellation purge (Section 5) deletes them. Disconnecting does not revoke the grant with Google, and the edge copy of the access token expires on its own, as described above. To manage the grant on Google’s side, use the permissions page in your Google Account (Section 9.4 gives the address). Removing access in your Google Account alone does not remove the account you chose from your site’s tracking settings, so our service keeps sending that site’s conversions to Google Ads with CleanClicks’s own Google Ads login; disconnect in CleanClicks to stop them. The post-cancellation purge also deletes the stored tokens without revoking the grant, and it leaves the edge copy to expire on its own in the same way, so if you stop using CleanClicks, we recommend removing access there as well. Disconnecting and the purge do not delete conversions already uploaded or conversion actions we created in your Google Ads account.

3. How We Use Information

Information collected through Customer Sites is used exclusively for the following purposes:

• Conversion attribution. Matching conversion events to the advertising click or campaign that generated the visit.
• Server-side delivery. Transmitting conversion data to advertising and analytics platforms via their official server-side APIs on behalf of the Customer.
• Bot filtering. Identifying and excluding non-human traffic using proprietary bot detection, configurable filtering rules, and network-level traffic scoring.
• Deduplication. Preventing the same conversion from being counted multiple times.
• Traffic quality analysis. Providing Customers with aggregate visibility into their traffic composition (human vs. bot vs. suspicious).
• Privacy compliance. Detecting and honoring Global Privacy Control signals and managing platform-specific privacy flags.

Use restrictions. We do not (a) sell personal information for monetary or other valuable consideration; (b) share personal information for cross-context behavioral advertising; (c) use personal information collected on a Customer Site for our own marketing or advertising purposes; (d) use personal information to make decisions that produce legal or similarly significant effects concerning you; or (e) use personal information collected on a Customer Site to train, develop, or improve generalized or non-personalized artificial intelligence or machine-learning models.

4. Third-Party Data Sharing

When a conversion event occurs on a Customer Site, we transmit conversion data to the advertising and analytics platforms configured by the Customer via each platform’s official server-side API. The platforms and data transmitted are:

Platform	Data transmitted
Google Ads (Click Conversions API)	Click identifier (gclid, wbraid, or gbraid); hashed email; conversion action resource name; conversion value; currency code; conversion timestamp; order ID (when present); an ad-user-data consent value (consent.adUserData), set to granted on the first upload of a conversion from the United States (judged from the visitor’s network location, or from the order’s billing or shipping country) when no refusal is on file, set to denied where a refusal is known, and otherwise left out
Meta (Conversions API)	Hashed email; IP address (unhashed, required by Meta’s Conversions API specification); User-Agent (unhashed, required by Meta’s Conversions API specification); Meta browser identifiers: the _fbp cookie value (fbp) and the _fbc cookie value (fbc; when the cookie is absent, fbc is built from the fbclid and the time it was first seen); pseudonymous external identifier (populated from the CleanClicks visitor ID cc_pid); hashed city, state or region, postal code, and country; event name; event timestamp; event ID; event source URL; commercial information (value, currency, order ID, line items)
TikTok (Events API)	Hashed email; IP address (unhashed, required by TikTok’s Events API specification); User-Agent (unhashed, required by TikTok’s Events API specification); ttclid (click identifier); hashed external identifier (hashed cc_pid); event name; event timestamp; event ID; commercial information (value, currency, order ID, line items)
Microsoft Ads (Offline Conversions API)	msclkid (click identifier); hashed email; conversion name; conversion time; conversion value; currency code
Google Analytics 4 (Measurement Protocol – server-side event delivery)	GA4 client identifier or, when the visitor’s own is not present, the first of the following that is: the CleanClicks visitor ID cc_pid; a user ID set by the Customer; a pseudonymous identifier derived from the hashed email address (the same email address always produces the same identifier), which is the usual case for an order reported by the Customer’s e-commerce platform when no Google Analytics identifier is on record for the buyer; on an event that is re-sent, an identifier derived from the order’s event ID; a random identifier; GA4 session identifier; user ID (when set by the Customer); event name and parameters, including value, currency, transaction ID, tax, shipping, coupon code, page URL, page title, page referrer, line items, session ID and engagement time; user_location (country, region, city – transmitted unhashed per the Google Analytics 4 Measurement Protocol specification); event timestamp
Usermaven (Server-to-Server API)	Hashed email (used as user.id); Usermaven anonymous identifier; event type; commercial information (value, currency, order ID, line items with product metadata); page URL, page path, page title, document host; IP address (unhashed); User-Agent; language; UTM attribution (utm_source, utm_medium, utm_campaign, utm_term, utm_content, referrer)
Google Analytics 4 (Admin / Data API – audit and paid accounts, on OAuth grant)	Account ID; property ID; aggregate session, page-view, event and purchase counts and gross purchase revenue; channel groupings; property configuration metadata. No visitor personal data is transmitted to Google through this access path – see Section 2.3.

Categories of third parties. For purposes of Cal. Civ. Code §1798.110 and analogous provisions of other state privacy statutes, the categories of third parties to whom we disclose personal information are: (a) advertising platforms (Google, Meta, TikTok, Microsoft) at the direction of the Customer for attribution and measurement; (b) analytics platforms (Google Analytics 4, Usermaven, Plerdy) at the direction of the Customer for measurement; (c) infrastructure providers (Cloudflare for compute, storage, and edge network; Stripe for payment processing on cleanclicks.ai); (d) communications, CRM, and outreach providers (HubSpot, Encharge, Resend, ActivePieces, Google, Anthropic, ClickUp, Telegram, Instantly, Aimfox, Moxie, and the contact-data and email-verification providers named in Section 2.4) for marketing-site interactions, customer account administration (including internal alerts to our team about billing and checkout events, such as a payment dispute or a checkout we refused, did not apply, or did not link to an account; such an alert can concern a checkout by someone who holds no account), and business outreach only; and (e) legal, accounting, and professional advisors as necessary, and government or law-enforcement entities where required by law. Except for the business-contact lookups described in Section 2.4, we do not disclose personal information to data brokers, and we do not disclose personal information to any third party for cross-context behavioral advertising.

How opted-out visitors are handled. Once a visitor has opted out (via a Global Privacy Control signal, a cookie-based opt-out, or a refusal recorded against the visitor’s hashed email address), CleanClicks does not transmit to advertising platforms a conversion from a request or order it can tie to that opt-out. A Global Privacy Control signal and the opt-out cookie are read from the request itself. A refusal recorded against an email address is applied to orders and forms that carry that address, and to a browser the Customer Site has linked to that address when the request names no other address; a new record can take a short time to reach every CleanClicks location. A conversion outside those cases, and an order the Customer’s e-commerce platform reports before the record has been written or has reached the CleanClicks location that handles it, are handled as if no refusal were on record unless they carry a refusal of their own, such as a Global Privacy Control signal or the opt-out cookie on a request from your browser, a refusal that CleanClicks’s script, WordPress plugin, or Shopify pixel sends with the conversion, a refusal the CleanClicks WordPress plugin recorded on a WooCommerce order at checkout, or a refusal signal the Customer’s own server sends with a conversion it reports. An order that a Shopify store reports from its own servers carries none of these, so a Global Privacy Control signal or the opt-out cookie in your browser does not travel with that order itself. On a Shopify store, CleanClicks’s Shopify pixel runs in Shopify’s own sandbox, and its requests to CleanClicks usually carry none of CleanClicks’s cookies, so the opt-out cookie that the opt-out choice on the privacy page (Section 9.1) sets usually does not reach what the pixel sends. That choice is recorded against your email address only where CleanClicks has linked your browser to that address, and the pixel’s requests usually cannot make that link; without it, the choice reaches neither the conversions the pixel sends for advertising platforms nor the orders the store reports from its own servers. CleanClicks also sends no conversion to advertising platforms when it cannot read the consent record it needs. Separately, on a WooCommerce site that sends orders from its own server straight to Usermaven, the CleanClicks WordPress plugin can send a hash of the order’s email address with the order; it does not read a refusal recorded against that address, and stops only on what the order itself recorded at checkout, or where CleanClicks routes that site’s orders through its own servers and the plugin can read that setting when it sends the order. For a request or order CleanClicks can tie to an opt-out:

• Meta, TikTok, and Microsoft Advertising. No conversion is sent. These platforms receive nothing for such a request or order.
• Google Ads. No identifying conversion is sent. Advertising click identifiers are removed, and the server-side conversion upload is not made. On pages that load CleanClicks’s own script, that script sets Google’s consent signals for ad storage, ad user data, and ad personalization to denied for a browser that sends a Global Privacy Control signal or carries the opt-out cookie, and switches on ad-data redaction, so Google receives only privacy-preserving, identifier-free browser signals from the Customer Site’s Google tags unless the Customer Site’s own cookie banner changes those settings. For every other visitor, that script sets those three signals to granted by default, and it sets analytics storage to granted for every visitor; the Customer Site’s own cookie banner can change them. After the opt-out choice on the privacy page, the setting changes when that script is next loaded, which can take up to five minutes, and a page already open keeps its earlier setting. CleanClicks’s Shopify pixel and the theme code CleanClicks provides for Shopify do not load that script, so on a Shopify store that uses only those, no CleanClicks code sets these signals. A refusal recorded only against your email address does not change these signals on a browser that has neither the signal nor the cookie. What Google Analytics receives is described in the next two items.
• Google Analytics, through the Customer Site’s own first-party analytics proxy. For a request that carries a Global Privacy Control signal, the proxy forwards no page visit, event, or purchase to Google Analytics; on a Shopify store, whether the Shopify pixel’s requests carry the signal depends on your browser and on Shopify. For an opt-out the proxy can see on the request (the opt-out choice on the Customer Site’s privacy page described in Section 9.1, a refusal you make in the Customer Site’s cookie banner that CleanClicks’s script can tell you made yourself and therefore stores as the opt-out cookie, or a refusal recorded against your hashed email address on a browser the Customer Site has already linked to that address; a banner refusal the script cannot tell you made yourself is not stored as the cookie; it is sent only with a conversion or email address the script reports from that page, and the proxy sees it only in that last case, for up to 72 hours), the proxy by default still forwards page visits, events, and purchases to Google Analytics with your identifying details removed: not your IP address (Google sees only the network address of CleanClicks’s servers), no user or visitor identifier, no advertising click identifier, no page title, and no session identifier; a new random client identifier is used on every hit; and ads personalization is marked off. What may be sent is the event’s name, the page address, the referring page, and campaign tags (in those addresses or as separate campaign fields), and, for a purchase, the order number, the order amount, the currency, the tax, the shipping, and for each item its ID, name, price, and quantity. Each of these fields is dropped instead of sent when it does not pass the proxy’s checks. In what this feed forwards, CleanClicks never raises or invents a consent signal: where your browser sent Google’s consent state, its advertising-storage value is set to denied and its analytics value is passed on as your browser set it; on the Measurement Protocol route, only an ad-user-data or ad-personalization value your browser set to denied is passed on, and any other consent value is dropped. This feed is on by default for every Customer Site that uses the first-party analytics proxy; CleanClicks sets it and can switch it off for a Customer Site, in which case the proxy forwards nothing for such a request. On a browser the Customer Site has not linked to your email address, a refusal recorded only against that address cannot be seen on the request, so that browser’s analytics requests, purchases included, are forwarded on the ordinary path. On a Shopify store, CleanClicks’s Shopify Custom Pixel (the code pasted into the store’s settings), when it has your email address from checkout, sends a refusal you make in the store’s cookie banner to CleanClicks, which records it against the address’s hash; it sets no opt-out cookie. The pixel’s requests to the proxy usually carry none of CleanClicks’s cookies, and on a request that carries none, the proxy cannot see the opt-out choice on the privacy page, a refusal stored as the opt-out cookie, or a refusal recorded against your email address. Unless you refused analytics in the store’s cookie banner, or the pixel cannot read your choice there, the pixel can send your purchase to the proxy, and unless that request carries a Global Privacy Control signal, the proxy can forward it to Google Analytics with its identifiers, including your Google Analytics client and session identifiers, the order number, amount, currency, tax, and shipping, and each item’s ID, name, price, and quantity. A hit already sent to Google cannot be recalled. The proxy also serves Google’s tag script to every browser, including one that sends a Global Privacy Control signal; when it fetches that script or a related script file from Google, it passes on your browser’s user-agent string and the script request’s own parameters and any body it carries, but not your IP address or cookies. Where the Customer Site has Google Signals switched on, Google’s tag script served through the proxy also sends requests straight to Google that do not pass through the proxy; CleanClicks limits those only through the consent signals described above, which it sets only on pages that load its own script, so on a Shopify store that uses only CleanClicks’s Shopify pixel and Shopify theme code, CleanClicks sets none of them.
• Analytics events CleanClicks’s servers build and send (Google Analytics Measurement Protocol and Usermaven). Nothing is sent, unless a measurement-only setting has been switched on for that destination for the Customer Site and your refusal is known not to cover analytics. Where it has, your hashed email address, IP address, user agent, location, device type, campaign details (other than campaign tags in the page address), and advertising click identifiers are removed. The event can still carry the page address and title, the first-party analytics identifiers that count visits and sessions on the Customer Site (the CleanClicks visitor ID, the Google Analytics client and session IDs, or the Usermaven anonymous ID), and a user ID set by the Customer, where present.

Opt-out record retention for server-side enforcement. To ensure your opt-out is honored when a purchase or other conversion event is reported by the Customer’s e-commerce platform (such as Shopify or WooCommerce) after your visit, CleanClicks keeps a server-side record of your refusal, keyed to the one-way hash of your email address. Such a record is written only when the Customer Site has an email address for you, for example from a form you sent or an order you placed. A refusal recorded as your own decision (including a Global Privacy Control signal and the opt-out choice described in Section 9.1), a refusal recorded without the categories it covers, and the older record of a site-wide opt-out are kept for up to 25 months from the last time the Customer Site recognized you by your email address while the refusal stood. Some refusals are kept for 72 hours and then lapse, such as a refusal the Customer Site can tell apart as a cookie banner’s own default. A refusal recorded as a flag on the email-to-click-ID mapping lasts as long as that mapping, up to 25 months. The privacy page served on each Customer Site’s tracking subdomain (/__cc/privacy) lists which refusals are kept for each period. The record is stored in CleanClicks’s internal infrastructure and is not transmitted to any advertising platform. Conversion events that CleanClicks can tie to it, as described above, are processed in measurement-only mode while it stands, in accordance with the opt-out rules above. Because this record is what keeps your opt-out in force, it is kept when we carry out a deletion request under Section 9, and it is included in the copy we provide in response to a request to know or access your personal information.

For Customers who have granted OAuth access to their Google Analytics 4 property (Section 2.3), our communication with the GA4 Admin and Data APIs is performed server-side under the access token issued to the Customer’s account. Google’s own privacy policy and Workspace data processing terms govern that communication.

No sale or share for cross-context behavioral advertising. For purposes of Cal. Civ. Code §1798.140(ad) (sale) and §1798.140(ah) (share), CleanClicks does not “sell” or “share” personal information. Transmissions to advertising and analytics platforms occur solely at the direction of the Customer (the business or controller) and pursuant to written contracts that meet the service-provider or processor standards of Cal. Civ. Code §1798.140(ag) and the analogous provisions of other state statutes. To the extent that the act of transmitting hashed identifiers or click data to an advertising platform could be deemed a “share” for cross-context behavioral advertising under any state privacy statute, you may opt out of such sharing using the methods described in Section 9.

5. Data Storage and Retention

All server-side data is stored in encrypted, globally distributed edge storage. Visitor-collected data is automatically and permanently deleted upon expiration of the following retention periods:

Data category	Retention period
Conversion records (identifiers, internet activity, commercial information)	90 days
Email-to-click-ID mappings (hashed identifiers)	90 days, counted again from each update; a mapping that holds only an opt-out flag, up to 25 months
Opt-out records (hashed identifiers)	Up to 25 months, or 72 hours for some refusals, as described in Section 4; kept through a deletion request
Technical details of the request that recorded a refusal (such as its source, time, browser class and origin, and a one-way hash of the sending IP address)	180 days; deleted on a deletion request
Visitor identity records (identifiers, internet activity)	90 days, counted again from each update
Analytics session-continuity records (identifiers)	90 days for the record of the first Google Analytics client ID seen for a visitor, which is not renewed; 30 minutes from the latest hit for the short-lived session record
Audit logs (security and access logs; identifiers, internet activity)	180 days, except the record of a deletion request we carried out and the record of a request to lift an opt-out, which are kept with no expiry as evidence and hold a one-way hash of the email address, not the address itself
Account activity log (actions on your CleanClicks account, such as connecting or disconnecting a platform and choosing an account, property, or conversion action, and the Google Analytics 4 session total recorded with each comparison refresh; identifiers)	Kept while the account exists; deleted with the account, including by the 90-day post-cancellation purge described below
Order-delivery ledger for analytics (one row for each delivery attempt or outcome of an order: the order number, amount, and currency; no name, email address, or email hash)	180 days
Deletion-request retry record (the email address given in a deletion request, kept only when the deletion could not be completed at once)	Kept while the deletion is being retried; deleted when the deletion completes or can no longer be retried, and otherwise 30 days after the latest failed attempt
Routine conversion deduplication records (identifiers)	Up to 7 days
Delivery-confirmation witnesses and replay tombstones (identifiers)	Up to 91 days
First-party cookies (browser-side; identifiers)	Up to 1 year from when each was last set; the visitor identifier is set again as described in Section 2.1
Items CleanClicks’s scripts keep in the Customer Site’s browser storage (browser-side; identifiers)	As described in Section 7; some are kept with no time limit, until you clear the Customer Site’s data in your browser
Encrypted GA4 OAuth refresh tokens – paid customers (identifiers)	Held until you disconnect, or until the 90-day post-cancellation purge described below.
Google Analytics 4 purchase comparison (the daily purchase count and purchase revenue Google Analytics 4 reports for a site with a tracking monitor, with what CleanClicks sent to it; no visitor data)	400 days, or until you remove the site or the account is deleted, including by the 90-day post-cancellation purge described below
Encrypted GA4 OAuth refresh tokens – audit accounts that never convert (identifiers)	A scheduled daily job asks Google to revoke, and then deletes, each active GA4 connection on an audit or expired-audit account that was created more than 30 days earlier and has no tracking monitor set up. A failed attempt leaves the connection stored.
Encrypted Google Ads OAuth tokens, connected account IDs, and conversion-action links (Section 2.5; identifiers)	Tokens, the account list, and the account you chose are held while the connection is active and deleted when you disconnect, or by the 90-day post-cancellation purge described below if you have not disconnected; the manager account ID, the conversion-action links, and activity-log records are kept until the 90-day post-cancellation purge described below. Edge copies of access tokens are kept no longer than the token’s lifetime, which Google sets, or one minute if that is longer.
Marketing-site lead records (HubSpot; identifiers, commercial information)	24 months from last engagement, enforced by automated workflow
Tracking Health Check usage log (domain of the website scanned, score, campaign and referral source; no name, email, or IP address)	180 days, enforced by a scheduled daily deletion job
Business-contact prospect records (Section 2.4; identifiers, professional or employment-related information, outreach history)	While outreach is open, then 12 months from our last contact, enforced by a scheduled daily deletion job
Do-not-contact list (email address or company domain only)	As long as we run outreach, so an opt-out stays honored
CleanClicks account records (cc-saas: your account, sites, subscription status, connections, API keys, monitors and usage charges; identifiers, commercial information)	Kept while the account exists; deleted with the account, including by the 90-day post-cancellation purge described below
Paying-customer billing records held by our payment processor, Stripe (customer, subscription, invoice and payment records; identifiers, commercial information)	Kept in Stripe for tax and accounting recordkeeping; we do not delete them when your account is purged

Customer-configured data. Allowlist configurations, encrypted OAuth credentials, and account metadata persist for the duration of the active subscription. Upon cancellation, all such data is scheduled for deletion by the 90-day post-cancellation purge described below.

90-day post-cancellation purge. When a paying customer cancels their subscription, account-scoped data is scheduled for permanent deletion once 90 days have passed after cancellation, except as stated below. This includes encrypted OAuth refresh tokens, domain registrations, the account’s own activity log, the account’s configuration, and the visitor records stored under the account’s domains (conversion records, email-to-click-ID mappings, visitor identity records, deduplication records, and opt-out records with the technical details recorded with them). A scheduled job carries out the deletion, and it can take more than one run to finish. The job does not try again when it fails to delete a site’s tag configuration, its stored API-key entry, or its hostname registration with our infrastructure provider, so a failed step can leave that item in place, and it does not delete a hostname registration for a site whose domain was never verified. The 90-day window is intended to allow the customer to request data export and is enforced by an automated purge process. Some records are not removed by this purge and instead expire on their own schedule: security audit log rows and the order-delivery ledger for analytics (180 days), analytics session-continuity records (no more than 90 days), the edge copy of a Google Ads access token (Section 2.5; kept no longer than the token’s lifetime, which Google sets, or one minute if that is longer), and a deletion-request retry record (kept while the deletion is being retried; deleted when it completes or can no longer be retried, and otherwise 30 days after the latest failed attempt). The deletion-request and opt-out-lift records described above are kept with no expiry as evidence.

Statutory criteria for retention. Each retention period above is set to the shortest period reasonably necessary to fulfill the disclosed purpose, consistent with Cal. Civ. Code §1798.100(a)(3) and 11 CCR §7002(d). The 90-day conversion-record retention reflects the typical advertising-platform attribution window plus a buffer for late-arriving conversions and reconciliation. The 90-day visitor-identity retention matches the email-to-click-ID mappings these records are used with, so that a conversion reported later in the attribution window can still be matched to the same visitor, and the index used to find these records for a deletion or access request is kept on the same schedule. The opt-out record lifetimes (up to 25 months, or 72 hours for some refusals, as described in Section 4) reflect the need to keep honoring a refusal for as long as a later purchase or conversion from the same person can reach us, and to let a temporary refusal, such as a cookie banner’s own default, lapse. Tax and accounting record retention reflects IRS guidance and applicable state recordkeeping rules.

6. International Data Transfers

CleanClicks processes data on a globally distributed edge network operated by Cloudflare, Inc. Your data may be processed in the United States or in any other country where our infrastructure provider operates. CleanClicks markets the Service exclusively to businesses in the United States and does not direct the Service to data subjects in the European Economic Area, the United Kingdom, or Switzerland. Customers are responsible for ensuring an appropriate legal basis for any cross-border processing of their Visitors’ data.

7. Cookies

CleanClicks sets the following first-party cookies on Customer Site domains:

Cookie name	Purpose	Duration
cc_pid	Random visitor identifier (UUID). Contains no personal information.	1 year, set again for another year by each conversion event described in Section 2.1, so never longer than 1 year from the latest such event
cc_sid	Session continuity identifier for GA4 attribution. HttpOnly cookie set on the CleanClicks tracking subdomain (cleanclicks.{customer-site}). Used to stitch GA4 sessions when third-party cookies are blocked or expire mid-session. Set when the GA4 Session Recovery feature is on, which it is by default for paid Customer Sites, and never for a browser that sends a Global Privacy Control signal or carries the opt-out cookie.	30 minutes (sliding)
cc_ss_optout	Records your opt-out preference for the sale or sharing of personal information.	1 year
cc_ss_optout_relay	On a WordPress site with the CleanClicks plugin, a copy of CleanClicks’s own opt-out cookie (cc_ss_optout, which the opt-out choice on the privacy page sets, and which a cookie-banner refusal that CleanClicks’s script relays can also set), written on the Customer Site’s own domain so that the plugin can read it. The plugin treats it as it treats cc_ss_optout; CleanClicks’s own script does not read it.	6 hours from the latest page view the plugin tracks while CleanClicks’s opt-out cookie stands, so it can remain for up to 6 hours after you allow sale or sharing again
cc_optin_chal	Security token for the step on the privacy page that allows sale or sharing again. Set on the CleanClicks tracking subdomain only when you start that step.	10 minutes

CleanClicks’s scripts also keep items in the Customer Site’s own browser storage, not in cookies, including the following. Where a row names three items, they are those of CleanClicks’s own script, the CleanClicks WordPress plugin (which also loads that script), and the CleanClicks Shopify pixel, in that order; a row that names one item says which of them keeps it.

Item (names)	Purpose	Duration
Advertising click identifiers (_ci, cc_click_ids, cc_shopify_clickids)	Stores advertising click identifiers captured from the URL on arrival.	On pages that load CleanClicks’s own script, each is checked against a 90-day limit from when it was first captured, as described in Section 2.1. The WordPress plugin keeps its own copy for as long as its installed version decides. The Shopify pixel keeps its copy with no time limit.
Click-identifier record (_cit, kept by CleanClicks’s own script)	The latest click identifier of each kind and when it was first seen, so that one older than 90 days is no longer used and is not stored again from an old link.	No time limit
Campaign details (_at, cc_attribution, cc_shopify_attribution)	Stores attribution data needed to match conversions to the originating click: campaign parameters, the referring page, and the address of the page you first landed on, which can contain a click identifier.	No time limit. CleanClicks’s own script and the WordPress plugin replace them when a later visit brings campaign details of its own, with some exceptions such as a return from a payment page; the Shopify pixel updates them and keeps the first landing page.
Session identifier (_si, cc_session_id, cc_shopify_session_id)	Stitching events within a single browsing session.	Until the browser tab is closed
Visit count (_sn, cc_session_num, cc_shopify_session_num)	Counts your visits to the Customer Site.	No time limit
Hashed email address (_he, cc_wp_hashed_email, cc_shopify_hashed_email)	The one-way hash of an email address, used to match later conversion events to the advertising click.	On pages that load CleanClicks’s own script, used for no more than 90 days after it was stored, measured by your device’s clock, and never renewed by being read; that script deletes it at once on a Global Privacy Control signal. The opt-out choice on the privacy page is kept at CleanClicks’s own address, where the Customer Site’s pages cannot read it, so after that choice the hash can stay in browser storage and that script can keep sending it to CleanClicks for up to 90 days from when it was stored; while your choice cookie lasts, CleanClicks applies your choice to what that script sends from that browser. The WordPress plugin keeps its own copy for as long as its installed version decides. CleanClicks’s Shopify Custom Pixel keeps the hash with no time limit, here and in the confirmed email link below; the pixel of CleanClicks’s Shopify app keeps one copy, with no time limit, and clears it when it sees you refuse in the store’s cookie banner.
Confirmed email link (cc_shopify_identity, kept by CleanClicks’s Shopify Custom Pixel)	The hash of the email address, a one-way code that stands for the click identifiers sent with it, and the time, so that the same link is not sent again within 7 days.	No time limit

You can remove these items by clearing the Customer Site’s cookies and site data in your browser. CleanClicks does not use third-party cookies, does not perform cookie syncing, and does not track visitors across different websites.

Cookie classification. The CleanClicks WordPress plugin registers these items with the WordPress consent framework in the categories below, and we use the same categories for the matching items on every Customer Site, those of the Shopify pixel included. The visitor identifier (cc_pid), the advertising click identifiers and the click-identifier record, the campaign details, and the hashed email address and confirmed email link are marketing, because their values are used to measure advertising. The session identifier, the visit count, and cc_sid are statistics, because they count visits. cc_ss_optout, cc_ss_optout_relay, and cc_optin_chal are functional, because they record or protect your privacy choice, and a refusal has to be storable whatever you chose.

8. Global Privacy Control and Universal Opt-Out

CleanClicks detects and honors the Global Privacy Control signal as defined by the Global Privacy Control specification. When a Global Privacy Control signal is detected:

• We treat it as a valid opt-out request under the California Consumer Privacy Act, Cal. Civ. Code §1798.135.
• No conversion from a request that carries the signal is sent to advertising platforms, the first-party analytics proxy forwards no page visit, event, or purchase from such a request to Google Analytics, and the analytics events CleanClicks’s servers build and send are handled as Section 4 describes.
• On pages that load CleanClicks’s own script, Google Consent Mode v2 defaults are set to deny ad storage, ad user data, and ad personalization. For a visitor with neither the signal nor the opt-out cookie, that script sets those three defaults to granted, and it sets analytics storage to granted for every visitor; the Customer Site’s own cookie banner can change them. CleanClicks’s Shopify pixel and the theme code CleanClicks provides for Shopify do not load that script, so on a Shopify store that uses only those, CleanClicks sets no such defaults.

On pages that load CleanClicks’s own script, Global Privacy Control is detected automatically at both the browser and server level. CleanClicks’s Shopify pixel does not read the signal in your browser; CleanClicks’s servers act on it only on a request that carries it, and whether the pixel’s requests carry it depends on your browser and on Shopify.

Universal opt-out mechanisms. In addition to Global Privacy Control, CleanClicks honors any universal opt-out mechanism that is recognized by the California Privacy Protection Agency (11 CCR §7025), the Colorado Department of Law (4 CCR 904-3, Rule 5), the Connecticut Attorney General, or the equivalent regulator in any state in which a universal opt-out mechanism is required. As of the effective date of this policy, Global Privacy Control is the only such mechanism in widespread browser-side deployment.

Do Not Track. Some browsers transmit a “Do Not Track” signal. There is no industry or legal consensus on what websites must do in response. CleanClicks does not respond to Do Not Track signals at this time, but, as described above, we do honor the more current Global Privacy Control signal.

US opt-out-by-default analytics setting. CleanClicks’s us-optout analytics setting is switched on by default when a paid Customer Site is set up, and CleanClicks can switch it off. As of the date of this policy, the setting does not change any analytics request: CleanClicks does not remove, alter, write, or fabricate any consent signal because of it. What a Global Privacy Control signal, an opt-out under Section 9, or a recorded refusal does to first-party analytics is described in Section 4 under “How opted-out visitors are handled.”

9. Your Rights

9.1 All visitors

You may opt out of the sale or sharing of your personal information on any Customer Site by:

• Enabling Global Privacy Control in your browser, which CleanClicks acts on for each request that carries it
• Visiting the /__cc/privacy page on the Customer Site’s tracking subdomain and clicking the opt-out button

On a Shopify store, the opt-out button usually does not reach what CleanClicks’s Shopify pixel sends, or the orders the store reports from its own servers, and whether a Global Privacy Control signal reaches the pixel’s requests depends on your browser and on Shopify (Section 4). There, also refuse in the store’s own cookie banner, which the pixel reads.

Clearing your browser’s cookies for the Customer Site removes the identifiers stored in them, and it also removes an opt-out stored in a cookie; it is not itself an opt-out. What an opt-out stops, and what still reaches Google Analytics after one, is described in Section 4.

9.2 California residents (CCPA / CPRA)

Under the California Consumer Privacy Act and California Privacy Rights Act, California residents have the right to:

• Know what personal information is collected, used, and shared
• Delete personal information held about them
• Opt out of the sale or sharing of personal information
• Non-discrimination for exercising privacy rights
• Correct inaccurate personal information
• Limit use of sensitive personal information

How to submit a request. California residents may submit a request to know, delete, correct, or opt out by:

1. Emailing [email protected] with “California Privacy Request” in the subject line; or
2. Completing the web form at cleanclicks.ai/privacy/request.

We will acknowledge receipt within 10 business days and will respond substantively within 45 days, with one 45-day extension permitted as authorized by Cal. Civ. Code §1798.130(a)(2).

Identity verification. To protect your information from unauthorized access, we will verify your identity before fulfilling a request to know, delete, or correct. For most requests, we verify by matching the information you provide in the request (such as the email address you submitted to a Customer Site) against the records we hold. For sensitive or high-risk requests, we may require additional information or, where you have an account on cleanclicks.ai, may require that the request be submitted from the authenticated account.

Authorized agents. You may designate an authorized agent to submit a request on your behalf. To verify the agent’s authority, we require (a) a written authorization signed by you, or (b) a valid power of attorney. We may also require you to verify your own identity directly with us before we act on the agent’s request, except where you have provided the agent with a power of attorney pursuant to California Probate Code §§4000 to 4465.

Non-retaliation. We will not deny goods or services, charge a different price, provide a different level of service, or suggest that we will do any of these things because you exercised a privacy right.

Do Not Sell or Share / Limit Use of Sensitive Personal Information. To opt out of the sale or sharing of your personal information, follow the methods in Section 9.1, submit a request through the methods above, or use the link titled “Do Not Sell or Share My Personal Information” in the footer of cleanclicks.ai and on the privacy page of any Customer Site (Section 9.1 says what that link does not reach on a Shopify store). CleanClicks does not collect sensitive personal information for the purpose of inferring characteristics about you, so the right to limit the use of sensitive personal information does not currently apply; if our practices change, this section will be updated and an opt-out link will be provided.

9.3 Other US state residents

If you are a resident of Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Utah, Delaware, Iowa, Indiana, Tennessee, New Hampshire, New Jersey, Maryland, Kentucky, Minnesota, Rhode Island, or Nebraska, you have the following rights with respect to personal information that CleanClicks processes about you. (For personal information that CleanClicks processes solely as a service provider or processor on behalf of a Customer, please contact the Customer.)

• Right to confirm whether we are processing your personal information and to access that information
• Right to correct inaccurate personal information
• Right to delete personal information we have collected from you (subject to statutory exceptions)
• Right to data portability – to receive a copy of your personal information in a portable, readable format
• Right to opt out of (a) the sale of personal information for monetary or other valuable consideration, (b) targeted advertising, and (c) profiling in furtherance of decisions producing legal or similarly significant effects

To exercise these rights, contact us using the methods in Section 9.2.

Right to appeal. If we deny your request, you may appeal our decision by replying to our denial within 60 days, or by emailing [email protected] with the original request reference. We will respond to the appeal in writing within 60 days. If we deny the appeal, you may contact your state Attorney General to submit a complaint.

We will not retaliate against you for exercising any of these rights.

9.4 GA4 OAuth revocation

If you connected your Google Analytics 4 property to CleanClicks, for an audit or on a paid account, you have two controls, and you can use either or both at any time:

• Inside CleanClicks. Sign in at platform.cleanclicks.io and use the Disconnect button on the Connections page (for an audit, use Disconnect GA4 on your audit dashboard). This deletes that site’s stored Google Analytics 4 connection, including its encrypted refresh token, and stops new reads through that connection. Other connections to the same property, for example from another of your sites, stay active until you disconnect them. It does not revoke the token with Google; to manage access on Google’s side, use the next option. If you set up server-side delivery, the Measurement Protocol secret stays in your site’s settings and we keep sending events to your property with it until you ask us to stop.
• From your Google Account. Visit https://myaccount.google.com/permissions to manage or remove CleanClicks’s access there.

Each cached Google Analytics 4 comparison expires 24 hours after it is written. Disconnect GA4 on your audit dashboard also tries to delete it straight away; a Disconnect on the Connections page leaves it to expire. Disconnecting does not delete the daily purchase comparison records or the activity-log entries described in Section 2.3; they are kept as Section 5 describes. To request deletion of any other audit data, contact us at the address in Section 13.

9.5 Additional state-specific notices

California Shine the Light (Cal. Civ. Code §1798.83). California residents may request information about our disclosures of personal information to third parties for those third parties’ direct-marketing purposes. We do not disclose personal information to third parties for their own direct-marketing purposes.

Nevada (NRS 603A.340). Nevada residents have the right to direct CleanClicks not to sell certain “covered information” for monetary consideration. CleanClicks does not sell covered information as defined by Nevada law. To submit a verified request, contact us at the address in Section 13.

10. Data Security

• Infrastructure. CleanClicks runs on serverless edge infrastructure with no origin servers, virtual machines, or traditional hosting to compromise.
• Encryption in transit. All data is transmitted over TLS 1.2 or higher. The tracking script is served from the Customer’s own subdomain via HTTPS.
• Encryption at rest. All stored data is encrypted at rest.
• PII handling. Our browser-facing tracking endpoints accept an email address only as its SHA-256 hash, and the conversion endpoint rejects a request whose body carries an email field. Server-to-server endpoints accept raw email addresses transmitted over TLS from authenticated Customer-side servers and hash them via SHA-256 immediately upon receipt, before any persistence or logging occurs. We screen the page addresses, referring addresses, campaign values, and page titles we receive with a conversion and remove an email address found in them before we keep or pass them on, except inside an advertising click-identifier value, where it can remain. Apart from such a value and the deletion-request retry record described in Section 5, raw email values are not written to persistent storage, are not retained in application logs, and are not transmitted to third parties in what CleanClicks’s servers build and send; only the SHA-256 hash is retained or onward-transmitted. The first-party analytics proxy does not screen the page addresses in the requests of the Customer Site’s own Google tag that it passes on, apart from what Section 4 says it removes after an opt-out, so an email address the Customer Site puts into a page address can reach Google that way.
• API authentication. All administrative and webhook endpoints use secure authentication mechanisms.
• Automatic deletion of visitor-collected data. Conversion records, hashed email-to-click-ID mappings, visitor identity records, audit logs (except the two audit records described in Section 5 that are kept with no expiry), and deduplication records expire automatically per the retention periods in Section 5, including any period counted again from an update. Expiration is enforced by the storage infrastructure’s native time-to-live mechanism, and the length of each period cannot be changed without a code change.
• Customer-configured data. Allowlist configurations, encrypted OAuth credentials, and account metadata persist for the duration of the active subscription. Upon cancellation, all such data is scheduled for deletion by the 90-day post-cancellation purge described in Section 5.

Security incident notification. In the event of a security incident affecting personal information, CleanClicks will (a) notify affected Customers without unreasonable delay and in no event later than is required to allow the Customer to comply with its own legal notification obligations, (b) cooperate with the Customer’s investigation and notification efforts, and (c) where CleanClicks is itself the business or controller (for example, with respect to cleanclicks.ai marketing-site data), notify affected individuals and applicable regulators in accordance with the breach-notification statutes of all applicable jurisdictions, including, where applicable, the California Customer Records Act (Cal. Civ. Code §1798.82) and the North Carolina Identity Theft Protection Act (N.C. Gen. Stat. §75-65).

No representation of perfect security. No security program can guarantee that personal information will never be accessed, used, or disclosed in an unauthorized manner. CleanClicks maintains the security program described above as commercially reasonable for a service of its type and risk profile, but does not warrant that the program will prevent all possible incidents.

11. Children’s Privacy

CleanClicks’s services are not directed to children. CleanClicks does not knowingly collect personal information from children under the age of 13 within the meaning of the Children’s Online Privacy Protection Act (“COPPA”), 15 U.S.C. §6501 et seq., and the implementing regulations at 16 C.F.R. Part 312. Customers are contractually prohibited from deploying CleanClicks on web pages directed to children under 13.

With respect to California residents between the ages of 13 and 15, CleanClicks does not “sell” or “share” personal information for cross-context behavioral advertising and accordingly the opt-in consent requirement of Cal. Civ. Code §1798.120(c) does not apply. If our practices change, an age-appropriate opt-in mechanism will be implemented before any such sale or share occurs.

Parents or guardians who believe a child under 13 has provided personal information through a Customer Site or through cleanclicks.ai may contact us at the address in Section 13 to request deletion. We will respond to verified parental requests promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with a revised “Last updated” date.

We will provide additional notice of material changes by (a) email to the address associated with your CleanClicks account, if you have one, and (b) a prominent notice on cleanclicks.ai for at least 30 days following the change. Your continued use of any Customer Site or of cleanclicks.ai after a change becomes effective constitutes your acknowledgment of the updated policy. Prior versions of this policy are archived and available on request to [email protected].

13. Contact

For privacy inquiries, data subject requests, or questions about this policy:

CleanClicks Operated by CJF & Associates LLC d/b/a ClickPath Consultants
Email: [email protected] Web form: cleanclicks.ai/privacy/request Appeals (state-DSAR denials): [email protected] 4030 Wake Forest Rd, Ste 349
Raleigh, North Carolina 27609 United States

For a complete directory of our privacy resources and to exercise your privacy rights, visit our Privacy Center.

14. Miscellaneous

Governing law and venue. This Privacy Policy and any dispute arising out of or relating to it are governed by the laws of the State of North Carolina, without regard to its conflict-of-laws principles. The exclusive venue for any such dispute is the state and federal courts located in Wake County, North Carolina, except where the law of the consumer’s state of residence requires otherwise (in which case the law and venue of the consumer’s state of residence will apply to the extent required).

Severability. If any provision of this Privacy Policy is held to be invalid or unenforceable, the remaining provisions will continue in full force and effect.

No waiver. Our failure to enforce any provision of this Privacy Policy is not a waiver of that provision or of our right to enforce it later.

Relationship to other agreements. This Privacy Policy supplements, and does not supersede, any other written agreement between CleanClicks and a Customer or other counterparty. In the event of conflict between this Privacy Policy and a written Data Processing Addendum or Master Services Agreement signed by both parties, the signed agreement controls.

Accessibility. This Privacy Policy is available in alternative formats on request to accommodate visual or other impairments. Contact [email protected].

Recent changes to this policy

What changed on October 21, 2026: We added Section 2.5, which explains what we do with access to a Google Ads account you connect: the accounts and conversion actions we read, the conversion actions we create when you ask, how we upload conversions, including with CleanClicks’s own Google Ads login, how we store the access, what disconnecting does and does not do, and that removing access in your Google Account alone does not stop uploads made with CleanClicks’s own login. Section 2.2 now points to Section 5 for how long paying-customer records are kept. Section 2.3 now says that paid accounts connecting Google Analytics 4 use the same access as the audit, and lists the Google Ads features under Google’s Limited Use rules. It also says which settings we change on a Google Analytics 4 property we create for you or one you pick, adds page-view and event counts, gross purchase revenue, data streams, Measurement Protocol secrets and report details to what we read, says that we store Google Analytics 4 access tokens encrypted and that disconnecting does not revoke the token with Google, and says how long the cached Google Analytics 4 comparison is kept and that, for a site with a tracking monitor, we keep a daily purchase comparison for 400 days. In Section 4, the row for Google Analytics 4 access now covers paid accounts as well as audit accounts and lists gross purchase revenue. Section 5 adds rows for the Google Ads connection, the account activity log and the Google Analytics 4 purchase comparison, says that a paid account’s Google Analytics 4 token is deleted when you disconnect, separates CleanClicks account records, which are deleted with the account, from billing records kept by Stripe, corrects which audit connections the daily cleanup job removes, and says that the post-cancellation purge is scheduled after 90 days, can take more than one run, can leave some configuration items in place, and leaves the edge copy of a Google Ads access token to expire on its own. Section 9.4 now says that disconnecting removes one site’s connection and does not revoke the token with Google, that server-side delivery to Google Analytics continues after you disconnect until you ask us to stop, how long the cached comparison is kept, and that disconnecting does not delete the daily purchase comparison.

What changed on October 20, 2026: Section 2 now says that click identifiers are kept in browser storage rather than in cookies, that we collect the page address with its campaign and click-identifier parameters and the page title, that a Shopify store collects through a pixel, how long the visitor identifier lasts, and when an email address placed in a page address can reach us. Section 4 now says what the opt-out button on the privacy page usually does not reach on a Shopify store, what the CleanClicks WordPress plugin sends straight to Usermaven, where CleanClicks sets Google’s consent signals and to what, and which consent value it sends to Google Ads, and it no longer lists an attribution identifier for Microsoft Advertising. Section 5 adds rows for analytics session records, the order-delivery ledger, browser storage, and the record we keep while a deletion request is retried. Section 7 lists CleanClicks’s cookies, says where campaign details, the hashed email address and the other items CleanClicks’s scripts keep in browser storage are kept and for how long, and gives the cookie categories our WordPress plugin registers. Section 8 says what a Global Privacy Control signal stops and where CleanClicks reads it. Sections 9.1 and 9.2 say what the opt-out button usually does not reach on a Shopify store, and to refuse in the store’s own cookie banner there. Section 10 says when an email address can be kept or passed on unhashed.

What changed on October 19, 2026: Section 4 now says that an opt-out applies to a request or order CleanClicks can tie to it, and how a refusal recorded against your email address is tied. It also says which cookie-banner refusals the analytics proxy can see, and when a purchase on a Shopify store can still reach Google Analytics with your Google Analytics identifiers after you opt out. Section 5 corrects how long visitor identity records are kept: 90 days, not 30.

What changed on October 17, 2026: Section 4 now describes what Google Analytics can still receive after you opt out without a Global Privacy Control signal (page visits, events and purchases with your identifying details removed), and corrects how long opt-out records are kept (up to 25 months, or 72 hours for some refusals) and that they are kept through a deletion request. Section 5 corrects audit-log retention, what the post-cancellation purge removes, and the reasons for the opt-out record lifetimes. Section 2 now says IP addresses and user-agent strings can stay in security audit logs for up to 180 days. Section 8 says the us-optout setting changes no analytics request, and Section 9.1 no longer lists clearing cookies as an opt-out. Sections 2.2 and 4 describe our internal Telegram billing alerts in full, and the Google Analytics row in Section 4 lists every identifier that can be sent as the client ID.

What changed on October 15, 2026: Section 2.4 now says that each outreach email uses text we approved in advance, and that we may first send a LinkedIn connection request. It adds a company’s country to what we collect, names Instantly, Aimfox and Moxie as service providers, and explains what we keep when you opt out or ask us to delete your record. Section 4 lists the same providers. On October 2, 2026, we updated Sections 2.2 and 4 to say that we also use Telegram for internal alerts to our team about billing events on paying accounts.

What changed on September 29, 2026: Section 2.4 now also names, as sources, a business-data service that lists companies by industry, size, and location, and LinkedIn profile pages we view by hand. On September 27, 2026, we added Section 2.4, which explains how we research business contacts for email outreach, and updated Sections 1.1, 2.1, 4, and 5 to match.