Privacy policy

EventsIQ is operated by INTCEL LLC, 30 N Gould St, Ste 66582, Sheridan, WY 82801, United States. You can reach us at support@eventsiq.io.

• Our customers' account data. When a business signs up, we decide how its account data is used. For this data we are the controller.
• Data we process for our customers. Our customers are advertisers. When someone clicks one of their ads or fills in one of their forms, we process that click and that lead on the customer's behalf and on their instructions. For this data the customer is the controller and we are their processor (or service provider). If you filled in a form or clicked an ad, the business that ran it is responsible for your data and is the first place to ask about it.

For the people who use the EventsIQ app we keep:

• name, company name, username and email address;
• a password, stored only as a bcrypt hash, and two-factor authentication settings if you turn it on;
• preferences such as your timezone and dashboard layout;
• a Stripe customer reference for billing. Card details are handled by Stripe and never reach our servers;
• if you allow browser notifications, the push subscription your browser gives us;
• images you upload, such as logos for your forms;
• the connections you make to ad platforms (see Google user data and Meta, TikTok and Snapchat).

When someone clicks a customer's tracking link, our tracker records the click for that customer and redirects to the landing page. For each click we record:

• a click id we generate, the time, and the customer's campaign, link and tracking domain;
• the link's full query string, which can include ad click ids such as gclid, fbclid, ttclid and msclkid, and UTM tags;
• the IP address, the browser's user agent, the referring page and the preferred language;
• device type, operating system and browser, worked out from the user agent;
• approximate location (country, region, city) and network operator, as reported by our hosting provider for the IP address;
• the landing page the visitor was sent to.

Click records are used to attribute the customer's leads and conversions to the ad that produced them, to count clicks in the customer's reports, and to protect the tracker from abuse. How the tracker behaves is described on our click tracking page.

When someone submits a form built with EventsIQ, or a lead arrives from an ad platform, we store:

• the answers given in the form, which the customer chooses and often include name, email and phone number;
• the IP address, user agent, referring page and the page the form was on;
• approximate location from the IP address. Where our hosting provider cannot supply it, we look it up with an IP geolocation service (ipapi.co, ipwho.is or ipapi.is), which receives the IP address;
• tracking values from the landing page address and the click that led there, such as ad click ids and UTM tags;
• what happened to the lead afterwards: which destination accepted it, at what price, and the calls made about it.

On our customers' websites. Our form script stores tracking values in first-party cookies and browser storage on the customer's own domain, so a lead can be attributed even when the visitor moves between pages:

• eiq_ values (for example the click id, ad click ids and UTM tags), kept for 90 days, and the landing page address in eiq_landing_url, kept for 90 days;
• eiq_vid, a random visitor id kept for 400 days and renewed on each visit, used to recognise a returning visitor and as an anonymous identifier in conversion reports;
• a location result in session storage, cleared when the browser tab closes.

The script also reads cookies the ad platforms set themselves (Meta _fbc and _fbp, TikTok _ttp, Snapchat _scid, Google _gcl_aw) so the lead can be matched to the ad. A customer can turn our storage off on their site; asking the visitor for consent where the law requires it is the customer's responsibility.

On our own site and app. We use a session cookie to keep you signed in (up to 15 days), a short-lived cookie during two-factor sign-in (10 minutes), a cookie that lets a browser which passed two-factor authentication skip the code (30 days), a short-lived cookie while you connect an ad platform (15 minutes), and browser storage for display preferences. We do not use advertising or analytics cookies. Our pages load fonts from Google Fonts, which receives your IP address.

• to provide the service: running forms, recording clicks, routing leads and producing reports;
• to send leads and conversion events where our customer has told us to send them;
• to bill customers, give support and send service messages;
• to keep the service secure and prevent fraud and abuse.

We do not sell personal data, we do not use it to advertise our own services, and we do not use our customers' data to train machine learning models.

Service providers that run parts of EventsIQ for us, under contracts that limit them to that purpose:

• Vercel (application hosting, United States);
• Cloudflare (click tracker, tracking domains and certificates);
• MongoDB Atlas (database);
• Stripe (payments);
• Google Workspace (email we send);
• Cloudinary (images customers upload);
• ipapi.co, ipwho.is and ipapi.is (IP location lookups).

Destinations our customers choose. Leads go to the destinations a customer sets up, such as CRMs, webhooks and the companies the customer sells leads to. Conversion events go to the ad platforms a customer connects (Google, Meta, TikTok, Snapchat) and to trackers such as ClickFlare. Email addresses, phone numbers and names are sent to the ad platforms only as one-way SHA-256 hashes, together with the ad click ids, and where the platform asks for it the IP address and user agent. We do not send IP addresses or user agents to Google for visitors in the European Economic Area, the United Kingdom or Switzerland. When we send data to Google we report the person's consent to ad use as not specified, because we do not collect that choice ourselves.

When the law requires it, or to protect our rights, our users or the public.

A customer can connect a Google Ads account. We then request these permissions: your basic Google account identity and email address (openid, email), Google Ads (https://www.googleapis.com/auth/adwords) and Google Data Manager (https://www.googleapis.com/auth/datamanager). We use them only to:

• list the Google Ads accounts you can access, so you can choose which to connect;
• read campaign names and daily spend, clicks and impressions, to show your cost and return on ad spend;
• read your conversion actions and customer lists, so you can pick where events go;
• upload the conversions and customer list members you tell us to send, from your own leads.

We store your Google account id and email, the ids, names, currency and timezone of the accounts you connect, the spend figures we import, and a refresh token, which is encrypted at rest with AES-256-GCM. We never store your Google password. You can disconnect at any time in EventsIQ, or revoke access in your Google account settings.

EventsIQ's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not use it to train AI models, and people at EventsIQ do not read it except with your permission, for security, or where the law requires.

When a customer connects Meta, TikTok or Snapchat, we store the access tokens those platforms issue and the names and ids of the pages and ad accounts chosen. We use them only to receive the customer's lead ads, import their ad spend, send the conversion events and audience members they configure, and nothing else. Customers can disconnect at any time.

Our application runs in the United States, and click data is processed on Cloudflare's global network. If you are outside the United States, your data is transferred there. Where the law requires it, we rely on safeguards such as the European Commission's standard contractual clauses.

• Click records are deleted automatically 13 months after the click. A lead keeps the campaign and ad details of the click it came from, so its attribution is not lost when the click record goes.
• Leads and the logs of calls made about them are kept while the customer's account is active. Customers can delete leads, and the logs that belong to them, at any time.
• Notification history is deleted automatically after 90 days.
• When an account is closed, we delete everything it holds: forms, leads, clicks, campaigns, logs, ad spend, audience uploads, tracking domains and platform connections. Copies kept at the edge of our network are deleted within a day. Billing records are kept as long as tax law requires.
• Browser storage on customers' sites expires as described under cookies above.

All traffic to our app and tracking domains is encrypted with HTTPS. Passwords are hashed, ad platform tokens are encrypted at rest, two-factor authentication is available, and access to customer data inside our team is limited to what is needed to run and support the service. No system is perfectly secure, and we will tell affected customers without undue delay if a breach affects their data.

Depending on where you live, including under the GDPR, the UK GDPR and California law, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict how it is used, and to complain to a data protection authority. We do not sell or share personal data for cross-context behavioural advertising.

If you are a EventsIQ user, write to support@eventsiq.io. If you filled in a form or clicked an ad run by one of our customers, contact that business first, since it controls your data. If you contact us instead, we will pass your request to them.

EventsIQ is a business service and is not directed at children under 16.

We will update this page when our practices change and change the date at the top. For a material change, we will tell account owners by email before it takes effect.

INTCEL LLC, 30 N Gould St, Ste 66582, Sheridan, WY 82801, United States. Email: support@eventsiq.io