Privacy Policy

Last updated: October 5, 2026

TrafficPixel, Inc. ("TrafficPixel," "we," "us") provides a marketing-attribution and lead-management platform for businesses that close offline — currently automotive retailers and financial-services firms. This policy explains what information we collect, how we use it, and the choices available to you. If you have questions, write us at [email protected].

1. Who this policy covers

TrafficPixel is a business-to-business service. Our direct customers are businesses that advertise and sell offline — today these include car dealerships and dealer groups, banks, and financial-services firms. Throughout this policy we use "customer" or "the business" to mean the TrafficPixel customer whose website or phone number you interacted with. This policy describes:

• Business users — the people at our customers who log into the TrafficPixel dashboard.
• Site visitors — people who visit a customer's website where TrafficPixel's tracking script is installed. We process these visitors' data on behalf of that business.
• Callers — people who call a customer through one of TrafficPixel's tracked phone numbers, including the AI Receptionist feature.
• Marketing prospects — visitors to our own website at trafficpixel.io.

2. Information we collect

From business users

• Account info: name, email, role, business affiliation.
• Authentication: hashed passwords, session tokens. Where a user chooses to sign in with a linked identity provider, we store the tokens needed to maintain that link.
• Usage logs: pages viewed, features used, IP address, browser/OS, audit logs of changes you make in the dashboard.
• Billing info (handled by our payment processor; we store the last four digits and brand of the card only).

From site visitors (collected on behalf of the business)

• Pageviews, scroll depth, gallery interactions, calculator inputs, and form-field engagement on the customer's site.
• Referrer (where the visitor came from), UTM and click-ID parameters, search keywords supplied by the ad platform.
• IP address, approximate geolocation (city / region / country), device type, browser, operating system, screen size.
• A first-party cookie identifier we set on the customer's domain (no cross-site tracking).
• Contact information you provide to the business through their forms — name, email, phone, product or vehicle of interest, message.

From callers

• Caller phone number, call duration, call recording (when the business has enabled recording and applicable consent rules permit it).
• For AI Receptionist calls: the audio of the conversation and an automated transcript, processed via our voice provider (Deepgram) and large-language-model provider (Anthropic) to route the call.

From the business's own records

A customer may send us records of completed transactions from their dealer management system (DMS), CRM, or core banking system — typically the buyer's or client's name, phone number, email address, the date of the transaction, and its value. We use this only to match a completed transaction back to the earlier marketing activity that produced it, so the business can measure which campaigns actually generate business. This information comes to us from the business, not from you, and the business remains responsible for it.

From advertising platforms

When the business authorizes us to connect their Google Ads, Microsoft Ads, or Meta (Facebook/Instagram) Business accounts, we read campaign-level reporting: campaign name, status, daily budget, spend, impressions, clicks, and conversion counts. We do not collect individual user identifiers from ad platforms. The Meta Marketing API integration uses a Business Manager System User token and accesses only ad accounts the business has shared with us through Meta's standard agency-partnership flow.

3. How we use information

• Provide the service. Show the business their visitor activity, leads, calls, and ad performance.
• Identity stitching. Connect a visitor's web sessions, form submissions, and phone calls into a single profile so the business sees the full journey to a lead.
• Bot and abuse detection. Identify automated traffic so the business's metrics aren't polluted.
• Send the lead. Forward inbound calls and form submissions to the business's CRM — for automotive customers, in the industry-standard ADF/XML format.
• Measure results. Report completed transactions back to the advertising platform that produced the click. We send the platform's own click identifier and the value of the transaction — we do not send names, email addresses, or phone numbers to advertising platforms.
• AI features. Generate optional summaries of visitor activity, classify lead intent, and run the AI Receptionist.
• Improve the service. Aggregate, anonymized analytics about how customers use our platform.
• Legal and security. Comply with law, prevent abuse, secure our infrastructure.

4. Service providers we share with

We use the following service providers to operate TrafficPixel. Each receives only the data needed to perform its function:

• Cloudflare — content delivery and edge proxy.
• Twilio — phone number provisioning, call routing, SMS.
• Deepgram — speech-to-text transcription and voice synthesis for the AI Receptionist.
• Anthropic — the language model that powers the AI Receptionist and generates lead summaries. Anthropic does not retain TrafficPixel data for training.
• Meta Platforms, Google, Microsoft — for ad-platform reporting we ingest with the business's authorization, and for reporting completed transactions back against their click identifiers.
• MaxMind — approximate geolocation from IP address.
• Vultr — primary hosting infrastructure.
• SendGrid — transactional email delivery.

We do not sell or rent personal information to third parties for advertising purposes.

5. Cookies and tracking

On a customer's website, TrafficPixel sets a first-party cookie (tpx_cid) that identifies a visitor across sessions on that single business's domain. The cookie is scoped to that domain — it does not track visitors across other websites. The business is responsible for displaying any cookie banners or consent notices required in their jurisdiction, and can configure TrafficPixel to require opt-in consent before any tracking begins.

On trafficpixel.io we use minimal first-party cookies for sign-in and basic analytics.

6. How long we keep data

• Visitor session and event data: 24 months by default; the business can request shorter retention.
• Call recordings: as configured by the business, default 12 months.
• AI Receptionist transcripts: 12 months.
• Lead, call, and transaction records: retained for the life of the business's contract, then archived per their export request.
• Aggregate analytics (no personal identifiers): kept indefinitely.

7. Your rights

If you are a site visitor, caller, or lead whose information has been collected through one of our customers, that business is the data controller for your information — the dealership, bank, or other firm whose website you visited or whose phone number you called. TrafficPixel processes it on their behalf. To request access, correction, or deletion of your data, you can:

• Contact that business directly, or
• Email us at [email protected] and we will route the request to the appropriate business and process it on their behalf.

California residents have rights under the CCPA / CPRA, and EU/UK residents have rights under GDPR. To exercise any of these (including the right to know, delete, correct, or opt out of sale or sharing), contact [email protected]. We will respond within 30 days.

8. Financial-services customers

Some of our customers are financial institutions subject to the Gramm-Leach-Bliley Act (GLBA) and its Safeguards Rule. Where we process information on behalf of such a customer, we act as a service provider, and:

• We use nonpublic personal information only to perform the services the institution has engaged us for, and for no other purpose.
• We do not disclose it except to the service providers listed in Section 4, as directed by the institution, or as required by law.
• We maintain the administrative, technical, and physical safeguards described in Section 11, and will enter into a written agreement reflecting these obligations at the institution's request.
• The institution's own privacy notice governs its relationship with its customers; this policy describes only what TrafficPixel does as its service provider.

9. Data deletion

To request deletion of personal data associated with your activity, email [email protected] with the subject "Data Deletion Request" and the website or phone number where your activity occurred. We will process your request within 30 days and confirm completion in writing.

10. Children

TrafficPixel is not intended for children under 13 (or 16 in jurisdictions where that is the relevant age). We do not knowingly collect personal information from children. If you believe a child's data has been collected, contact us and we will delete it.

11. Security

We use TLS for data in transit, encryption at rest for backups, scoped database credentials, role-based access controls, and audit logging. No system is 100% secure; we work to maintain reasonable, industry-standard protections.

12. International transfers

TrafficPixel is operated in the United States. If you access the service from outside the U.S., your information will be transferred to and processed in the U.S. We rely on Standard Contractual Clauses for transfers from the EEA, UK, and Switzerland.

13. Changes to this policy

We will update this policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes will be communicated to business users through the dashboard.

14. Contact

TrafficPixel, Inc.
Privacy questions: [email protected]
General: [email protected]