Privacy

Privacy Policy

Last updated: 2026-07-01

This policy explains what personal data Daniil Kosolapov, an individual trading as "Roitrack" ("Roitrack", "we", "us") collects when you use the Roitrack website, the customer portal at account.roitrack.app, and the Roitrack license validation service — collectively, the "Service". It does not cover data processed by the Roitrack software running on your own server; that data stays on your infrastructure and never reaches us.

1. Data controller

The data controller is Daniil Kosolapov, an individual trading as "Roitrack", postal address available on request via [email protected]. For any privacy-related question, contact [email protected].

2. What we collect and why

We use two third-party measurement tools on our marketing site, both behind the consent controls in section 4: Google Analytics 4 (Google Ireland Limited), to see which pages people read and where visits come from, and the Meta (Facebook) advertising pixel (Meta Platforms Ireland Limited), to measure which of our own ads lead to sign-ups and purchases. Neither runs on your tracker installation, and neither ever sees your campaign data. We do not use cross-site trackers beyond these.

3. Legal basis (EU/UK visitors)

Under the GDPR / UK GDPR:

• Contract — data listed above is processed to provide the Service you've purchased or signed up for.
• Legitimate interests — IP addresses and validation event logs are processed to prevent abuse, detect fraud, and keep the license system honest. You can object to this processing by contacting us.
• Legal obligation — payment records are retained as required by tax and accounting laws in Vietnam.

4. Cookies

We use a small number of strictly necessary cookies:

• roitrack_license_session and account portal auth cookies — HTTP-only, mark you as logged in. Cannot be read by JavaScript, expire on logout or after a period of inactivity.

And analytics and advertising cookies:

• _fbp and _fbc — set by Meta on roitrack.app. They identify the browser and, if you arrived from one of our ads, that click. We store them against your account at sign-up so that a later purchase can be attributed to the ad that led to it. Expire after 90 days.
• _ga and _ga_<id> — set by Google Analytics on roitrack.app. They tell one browser from another so that repeat visits are not counted as new people. They hold a randomly generated identifier, not anything you have told us. Expire after 2 years.

These are not set until you allow them. If you are in the EEA or the UK, nothing from Meta or Google is loaded and no analytics or advertising cookie is written until you choose “Accept” on the banner shown on your first visit; choosing “Decline” loads nothing and deletes anything already there. Elsewhere they load on arrival, and the controls below still apply.

We do not sell or share your data with advertisers for their own purposes. If you would rather not be measured this way, declining is enough; blocking connect.facebook.net and googletagmanager.com in your browser, or using an ad blocker, prevents these cookies entirely. Nothing on this site or in your account depends on them.

Change my cookie choice Cleared — you will be asked again on your next visit.

4a. Advertising measurement

When you sign up or purchase, we send a hashed copy of your email address, a customer identifier, and the Meta click identifiers above to Meta Platforms Ireland Ltd via their Conversions API, so that we can tell which of our ads worked. The email is hashed (SHA-256) before it leaves our server; we never send it in the clear. We do not send licence keys, tracker data, or anything about your campaigns.

4b. Website analytics

Google Analytics records which pages were viewed, roughly where the visit came from (referrer, and country derived from the IP address), and basic device and browser information. Google does not receive your name or email address from us, and analytics data is never joined to your account or to anything inside your tracker. IP addresses are not stored by Google Analytics 4. You can also opt out across every site that uses it with Google's browser add-on.

5. Payment processing

All payments are processed by Lemon Squeezy as our merchant of record. Card details are entered on Lemon Squeezy's secure checkout page and are never transmitted to or stored by Roitrack. We receive only the customer identifier, subscription status, invoice metadata, and country. See Lemon Squeezy's privacy policy for how they handle your card data.

6. Email delivery

Transactional emails (welcome, verification, password reset, receipt, dunning) are sent through Resend. Resend processes the recipient email address and message body for the sole purpose of delivering the message.

7. Hosting and infrastructure

Our website is hosted on Cloudflare Pages. The customer portal and license service run on virtual servers in the European Union. Cloudflare acts as a network reverse proxy and a DDoS/security layer.

7.1 International transfers

Roitrack is operated from Vietnam by an individual. Personal data collected through the Service is stored on servers located in the European Union. Where the operator accesses that data from Vietnam for support and administration, this may constitute an international transfer under the GDPR and UK GDPR. Such transfers rely on the Standard Contractual Clauses adopted by the European Commission.

7.2 Vietnamese users

For users resident in Vietnam, we process personal data in accordance with Decree 13/2023/ND-CP on Personal Data Protection.

8. How long we keep your data

• Account and license records — for as long as your account is active, plus a reasonable period for support, dispute resolution, and legal record-keeping.
• Validation event logs — rolling 12 months.
• Session cookies — cleared on logout or when they expire.
• Payment records — as required by applicable tax and accounting laws in Vietnam (typically 5–10 years).
• Analytics and advertising data — held by Google and Meta under their own retention policies; the cookies themselves expire as listed in section 4, and declining deletes them immediately.

9. Sharing your data

We do not sell your personal data. We share it only with the processors listed above (Lemon Squeezy, Resend, Cloudflare, and — for measurement on the marketing site, where you have allowed it — Meta and Google) so we can deliver and measure the Service. Each processor is contractually bound to protect your data. We may also disclose data if legally required to (court order, valid law-enforcement request).

10. Your rights

Depending on where you live, you may have rights to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Object to certain processing based on legitimate interest
• Receive your data in a portable format
• Lodge a complaint with your local data protection authority

To exercise any of these rights, email [email protected]. We respond within 30 days.

11. Security

Passwords are hashed with bcrypt. Sessions live in HTTP-only cookies. Traffic to our servers is served over TLS. Backups of our license database are encrypted before leaving the primary server. We do not claim any system is perfectly secure — if you have a security concern, please email us so we can address it.

12. Children

The Service is not intended for children under 16. We do not knowingly collect personal data from anyone under 16.

13. Changes to this policy

We may update this policy from time to time. When we do, we'll update the "Last updated" date above. Material changes will be announced by email to registered customers.

14. Data protection contact

As a small operator, Roitrack is not required to appoint a formal Data Protection Officer. Privacy questions and rights requests are handled directly by the founder at [email protected].