Privacy Policy

Last updated: 4 March 2026

SourceTag ("we", "us", "our") is a New Zealand company that operates the SourceTag lead attribution service. This policy explains what data we collect, how we use it, and your rights.

What we collect

Account data

When you create an account, we collect your name and email address. If you sign in with Google, we receive your name, email address, and profile picture from Google. Payment information is collected and processed by Stripe. We do not store your card details.

Site configuration

We store your site domain, channel rules, and field mapping configuration. This is used to generate your tracking script.

Lead counters

When a visitor submits a form on your site, our script sends a count event (site ID + timestamp) to our servers. We do not collect or store any visitor personal data, form contents, or attribution data. The attribution data stays in the visitor's browser cookie and is submitted directly to your form. It never passes through our servers.

Cookies on your visitors' devices

Our tracking script sets a first-party cookie on your website visitors' devices. This cookie contains attribution data (UTM parameters, channel, landing page, visit count). The cookie is set under your domain, not ours. You are the data controller for this cookie data.

How we use your data

To provide the SourceTag service
To process payments via Stripe
To send service-related communications (account notices, onboarding guides, product updates)
To send marketing emails if you opt in (you can unsubscribe at any time)
To monitor service health and prevent abuse

Marketing emails

We use Klaviyo to send onboarding emails and occasional product updates. You can opt in during signup or from your account settings. Every marketing email includes an unsubscribe link. We do not share your email address with third parties for their own marketing purposes.

Analytics on sourcetag.io

We use Google Analytics and our own SourceTag attribution tracking on sourcetag.io. Google Analytics collects anonymous usage data (pages visited, browser type, general location) to help us improve the site. See Google's privacy policy for details on how Google processes this data.

Data sharing

We share data only with our sub-processors (see Sub-processors list). We do not sell data to third parties.

Data retention

Account data: retained while your account is active, deleted within 30 days of account closure
Lead counters: retained for 24 months for billing and reporting purposes
Marketing email data: retained while you are subscribed, removed on unsubscribe
Visitor cookies: 400-day lifetime, stored on the visitor's device under your domain

Your rights

Under GDPR and the NZ Privacy Act 2020, you have the right to:

Access your personal data
Correct inaccurate data
Delete your account and data
Export your data
Object to processing
Unsubscribe from marketing emails at any time

If you are not satisfied with our response, you have the right to lodge a complaint with the New Zealand Office of the Privacy Commissioner.

Contact

SourceTag
Auckland, New Zealand
Email: privacy@sourcetag.io