Privacy Policy

Overview

CRM Portal(“we”, “us”, or “the Service”) is a multi-tenant customer relationship management and marketing analytics platform operated by Meraki Communications. It enables businesses to capture leads, track website visitor attribution, send newsletter campaigns, and sync with advertising platforms such as Google Ads and Meta (Facebook).

This Privacy Policy describes how personal data is collected and processed when you interact with websites that use our tracking script (tracker.js), submit forms, subscribe to newsletters, or use the CRM Portal dashboard. We are committed to transparency and to complying with the GDPR, CCPA, and other applicable data protection laws.

Data We Collect

We collect the following categories of personal data:

Information you provide directly

Lead form submissions — name, email address, phone number, message, and any custom fields you complete on a website form.
Newsletter subscriptions — your email address when you opt in to receive marketing emails.
Account credentials — admin email, name, and password (stored as a bcrypt hash) when a team member creates an account to use the dashboard.

Information collected automatically

Visitor & attribution data — a persistent client-side visitor ID, session ID, UTM parameters (source, medium, campaign, content, term), click IDs (gclid, fbclid, msclkid, ttclid, and others), referrer URL, landing page, and landing query string.
Device & environment data — device type, browser, operating system, approximate country (derived via IP-based GeoIP), SDK platform, and user agent string.
Engagement data — tracked events, conversion events, page views, session counts, and email open/click activity for newsletter campaigns.
Technical identifiers — IP address (hashed for consent audit records), Meta browser IDs (fbp, fbc), and TikTok pixel ID (ttp).

Consent records

When you interact with a consent banner, we store a record of your choices across four scopes: analytics, marketing,advertising, and data sale/sharing. This record includes a hashed email (where available), a hashed IP address, your user agent, the consent version, and the source of the consent (banner, privacy center, API, or import).

How We Collect Data

tracker.js — a first-party JavaScript snippet embedded on client websites that captures visitor attribution and event data and sends it to our tracking API.
Web forms — data you submit through lead capture forms hosted on client websites.
Newsletter widget — email subscriptions collected via an embeddable subscription widget.
Ad platform webhooks — lead data delivered from Google Lead Form and Meta Lead Ads via signed webhooks.
Google Sheets sync — lead data imported from connected Google Sheets spreadsheets.
Dashboard usage — activity logs and audit logs generated when authenticated admins use the CRM Portal dashboard.

How We Use Your Data

We process personal data for the following purposes:

To capture, manage, and respond to leads submitted through client websites.
To measure marketing attribution and understand which campaigns and channels drive conversions.
To send newsletter and marketing email campaigns to subscribers who have opted in.
To build audiences and sync them with advertising platforms for retargeting and lookalike modeling, only where advertising consent has been granted.
To generate analytics, dashboards, and AI-powered insights for our customers.
To detect and prevent fraud, abuse, and unauthorized access.
To maintain audit trails for security and compliance purposes.

Legal Basis for Processing (GDPR)

Under the GDPR, we rely on the following legal bases:

Consent (Art. 6(1)(a)) — for analytics tracking, marketing emails, advertising data sharing, and data sale/sharing, recorded via our consent management system. Consent is opt-in, can be withdrawn at any time, and expires after 13 months unless renewed.
Contractual necessity (Art. 6(1)(b)) — to process lead form submissions and deliver the services requested by the data subject or our customer.
Legitimate interests (Art. 6(1)(f)) — for security, fraud prevention, audit logging, and internal analytics about how the Service performs.
Legal obligation (Art. 6(1)(c)) — where we are required to retain records to comply with applicable law.

Cookies & Tracking Technologies

Our tracker.js uses a persistent client-side identifier stored in a first-party cookie or localStorage to recognize returning visitors and attribute their sessions. We also capture advertising click IDs (gclid, fbclid, msclkid, ttclid, etc.) from URL parameters.

Analytics, marketing, and advertising tracking only activate after the relevant consent has been granted through the website’s consent banner. Where no consent record exists, tracking defaults to off.

You can manage or withdraw your consent at any time through the consent preferences on the website where you provided it. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Marketing & Ad Platform Integrations

CRM Portal integrates with Google Ads and Meta (Facebook) to import leads, sync campaign performance, and build audiences for retargeting.

OAuth connections are made at the agency level using credentials stored in server environment variables — not in the database.
Access and refresh tokens obtained during OAuth are encrypted at restusing AES with a versioned encryption key.
For Meta Lead Ads, we subscribe the Pages you manage to the leadgenwebhook field and create one ad account record per Page, all sharing the same encrypted user token.
For Google Lead Forms, each ad account receives a unique webhook key that routes incoming leads to the correct site.
Audience syncing and advertising-related data sharing only occur when advertising consent and, where applicable, data sale consent have been granted.

Data Retention

Consent records are retained for the duration of the consent plus an audit period. Active consent expires after 13 months per GDPR guidance unless renewed.
Lead datais retained for as long as the customer’s account is active, or until the customer or data subject requests deletion.
Newsletter subscriber records are retained until the subscriber unsubscribes or requests deletion. Unsubscribe requests are processed immediately.
Audit & activity logsare retained for security and compliance purposes in accordance with our customer’s configured retention policies.
Visitor tracking datais retained per the customer’s settings and is automatically purged when no longer needed for attribution.

Your Rights

Depending on your jurisdiction, you may have the following rights:

Access — request a copy of the personal data we hold about you.
Rectification — request correction of inaccurate data.
Erasure — request deletion of your personal data (“right to be forgotten”).
Restriction — request that we limit processing of your data.
Portability — receive your data in a structured, machine-readable format.
Objection — object to processing based on legitimate interests.
Withdraw consent — withdraw previously given consent at any time, including via the consent banner or by contacting us.
Opt out of sale/sharing— exercise your CCPA right to opt out of the “sale” or “sharing” of personal information.

To exercise any of these rights, contact us at privacy@merakicommunications.com. We will respond within 30 days.

Security Measures

We implement industry-standard security measures to protect your data:

Encryption at rest — OAuth access and refresh tokens are encrypted using AES with a versioned key before being stored in the database.
Password hashing — admin passwords are hashed with bcrypt.
Two-factor authentication — available for all admin accounts.
Role-based access control — granular module-level permissions per role, with multi-tenant site isolation.
Token rotation — refresh tokens are rotated on each use, with replay detection that revokes the entire session family if a used token is presented again.
Account lockout — progressive lockout after repeated failed login attempts.
Audit logging — comprehensive audit trails for sensitive actions.
Webhook signature verification — Meta webhooks are verified via HMAC-SHA256; Google Lead Form webhooks are authenticated via a unique per-account webhook key.

Children’s Privacy

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe we have collected data from a child, please contact us and we will promptly delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. For material changes, we will provide a more prominent notice (such as on the login page or via email to affected subscribers). Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

Contact Us

If you have any questions about this Privacy Policy or your personal data, please contact our Data Protection team:

Email: privacy@merakicommunications.com
Operator: Meraki Communications

For GDPR-related complaints, you also have the right to lodge a complaint with your local data protection authority.