Privacy Policy

In short

Tycoon Tracking is a private, internal reporting tool. It shows the operator of this site — and a small number of named business partners — how much was spent on advertising and how much revenue came back. It is not a consumer product, it has no public sign-up, and it does not sell, rent, broker or share data for anyone else's advertising.

1. Who we are

"Tycoon Tracking", "we" and "us" mean the operator of tycoontracking.com, who is the data controller for the information described below. You can reach us at privacy@tycoontracking.com.

2. What we process, and why

a. Advertising performance data (Meta)

Through the Meta Marketing API we read performance metrics for advertising accounts that we own or that have granted us read access: amount spent, impressions, clicks, and the names and identifiers of campaigns, ad sets and ads. Our access is read-only (the ads_read permission). We do not request, receive or store personal information about Meta users, their profiles, friends, messages or content. We use this data only to calculate our own advertising cost and profitability.

b. Sales and transaction records (our own merchant accounts)

Our merchant and affiliate platforms — currently ClickBank, and affiliate networks where we run offers — notify us of transactions on our own accounts: order or receipt identifiers, product identifiers, amounts, currency, timestamps, and transaction type (sale, rebill, refund, chargeback). Those notifications can also include buyer details supplied by the platform, such as name, email address, country and postal code. We store the notification as received and use it only to reconcile our own revenue against our own advertising cost. We do not market to these buyers from this system, and the merchant of record for each purchase remains the platform where it was made.

c. Click measurement data

On pages where our own measurement snippet or tracking link is installed, we record: a randomly generated click identifier, the advertising click identifier present in the URL (for example fbclid), the campaign parameters on the URL, the IP address, the browser user agent, and the timestamp. This exists for one purpose: to attribute a later sale to the advertisement that produced it. We do not use it to build advertising profiles, and we do not share it with third parties for their own purposes.

3. What we never do

• We do not sell, rent or trade any of this data.
• We do not use it to target, profile or advertise to individuals on behalf of any third party.
• We do not combine it with data purchased from data brokers.
• We do not make automated decisions that produce legal effects for individuals.
• We do not use Facebook Login, so we hold no Meta user accounts or profiles.

4. Legal bases (GDPR)

Where the GDPR applies we rely on our legitimate interest in measuring the performance of our own advertising and in keeping accurate financial records (Article 6(1)(f)), and on legal obligation for the retention of transaction records (Article 6(1)(c)). Where consent is required for measurement cookies or similar technologies on a website that uses our snippet, that consent is collected on that website before measurement begins.

5. Who can see the data

Access is limited to the operator and to named partners who are given an account. A partner account is technically restricted to a single business line: it can only see the advertising spend and revenue of that line, and never other lines, other partners or overall totals. Beyond that, data is processed on our behalf by our infrastructure and platform providers — Cloudflare (hosting and database, stored in the European Union), Meta (advertising metrics) and our merchant platforms. We disclose data otherwise only where legally required.

6. How long we keep it

• Click measurement records (click id, fbclid, IP, user agent): deleted automatically after 180 days.
• Raw notification payloads from merchant platforms: deleted automatically after 90 days.
• Financial summaries (amounts, dates, order identifiers, advertising spend): kept for as long as we need them for accounting and tax purposes.

These periods are enforced automatically by a scheduled job, not by hand.

7. Security

All traffic is served over HTTPS. The dashboard requires a password; partner passwords are stored only as salted PBKDF2 hashes; repeated failed sign-ins are rate-limited. API credentials are held as server-side secrets and are never exposed to the browser. Our Meta credential is read-only and cannot create, modify or pay for advertising.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, and the right to data portability. Write to privacy@tycoontracking.com and we will respond within 30 days. See also our data deletion instructions. If you are in the EU or UK you may also complain to your local supervisory authority.

9. Children

This tool is not directed to children and we do not knowingly process data about anyone under 16.

10. Changes

If we change this policy we will update the effective date at the top of this page. Material changes will be reflected here before they take effect.