Tellmetric
Legal

Privacy Policy

Last updated: 29 September 2026

  1. Introduction
  2. Information We Collect
  3. How We Use Your Information
  4. Data Sharing
  5. Data Security
  6. Data Retention
  7. Cookies
  8. Your Rights (GDPR)
  9. International Transfers
  10. Children's Privacy
  11. Changes to This Policy
  12. Contact

1. Introduction

Tellmetric ("we", "our", "us") operates the tellmetric.com website and SaaS platform. This Privacy Policy explains how we collect, use, disclose and safeguard information when you use our service, and what happens to the data of the people who click your ads and interact with your Telegram funnel.

For the purposes of the EU General Data Protection Regulation (GDPR), the data controller for customer account data is:

Company
Tellmetric
Responsible person
Volodymyr Yurkov
Address
Naritaweg 165, 1043 BW Amsterdam, Netherlands
KvK (Dutch Chamber of Commerce) number
99455242
VAT identification number
NL005387124B49
Email
info@tellmetric.com · contact form

For the tracking data described below, our customer is the controller and we act as their processor under our Data Processing Agreement. If you are an end user of a customer's funnel, please direct requests about that data to the customer whose ad or link you interacted with; we will assist them.

2. Information We Collect

Account information. When you register we collect your name (optional), email address and password. Passwords are stored only as a bcrypt hash. If you sign in with Google, we receive your email address and name from Google and never see your Google password. We also keep an activity log of changes made in your workspace (who changed what, from which IP address) for security and support.

Payment information. Payment processing is handled by Stripe. We do not store your card details. We receive your Stripe customer id, subscription status and, where you use pay-as-you-go, the usage we report for billing.

Tracking data. When visitors interact with a Tellmetric tracking link, or with a website that carries our tracking script, we collect:

  • Ad click identifiers (fbclid, fbc, fbp for Meta; ttclid for TikTok; ScCid and the _scid cookie for Snapchat; rdt_cid and the _rdt_uuid cookie for Reddit; the _spdt cookie for Spotify; gclid, gbraid and wbraid for Google) and campaign parameters such as UTM values and placement
  • IP address and the browser user-agent string
  • Approximate country, either supplied by the hosting or content-delivery provider or derived locally from the IP address (country level only)
  • The landing-page URL (with only campaign and click parameters kept) and the referrer
  • A randomly generated, pseudonymous visitor id and the timestamp of the visit or click

Telegram data. When people join a connected group or channel, message a connected bot, start a bot through a tracked deep link, pay with Telegram Stars or use a Mini App that reports events, we collect their Telegram user id, first name and username, the membership change (joined, left, removed) and the timestamp, in order to match the action to the click that led to it. If a person voluntarily includes an email address or phone number in a message, form or Mini App, we may store it with the matched visit and use a hashed version for configured conversion events.

Conversion data. Deposits, payments, sign-ups and leads that our customer reports to us through the postback endpoint, the events API or a hosted conversion form: the event type, value and currency, a transaction id, the click id, and any email, phone number or name the customer includes. Email addresses and phone numbers are hashed with SHA-256 before they are sent to an ad platform.

Ad spend. When a customer connects an ad account, we import daily spend per campaign, ad set, ad and country in order to show cost per result. This is business data, not personal data.

3. How We Use Your Information

We use the collected information to:

  • Provide and maintain the tracking and attribution service
  • Match website visits and link clicks to the Telegram interactions and conversions that follow
  • Send conversion events to Meta's Conversions API, TikTok's Events API and Google Ads on the customer's behalf, and forward them to a tracker or server the customer configures
  • Meter usage against plan allowances, process payments and manage subscriptions
  • Send service-related emails (password reset, invitations, billing, replies to the contact form)
  • Monitor and improve the security, reliability and performance of the service

We do not use tracking data for our own advertising, profiling or analytics across customers, and we do not sell it.

4. Data Sharing

We do not sell personal information. We share data only with:

  • Ad platforms (Meta Platforms, TikTok, Google): conversion events with hashed identifiers, as configured by the customer. Each platform is an independent controller of what it receives.
  • Stripe: payment processing and invoicing for customer subscriptions.
  • Telegram: bot, group and payment interactions are received through Telegram's Bot API.
  • Our hosting provider: servers, database and backups in the European Union.
  • Our email delivery provider: transactional emails to customers.
  • A customer's own tracker or server: when the customer sets an outbound postback address.

IP-to-country enrichment uses an edge header from our hosting provider or a locally stored GeoLite database. Visitor IP addresses are not sent to MaxMind or any other lookup service.

We may disclose data where the law requires it, to protect our rights or the safety of others, or as part of a merger or acquisition, in which case this policy continues to apply.

5. Data Security

We implement appropriate security measures, including:

  • Encryption of sensitive data (bot tokens, access tokens, OAuth grants) at rest with authenticated encryption; API keys are stored as hashes
  • HTTPS/TLS encryption for all data in transit
  • Bcrypt password hashing, signed session cookies and a strict Content Security Policy
  • Rate limiting and brute-force protection on sign-in, sign-up, the public endpoints and the contact form
  • Role-based access to workspaces, an activity log of every change, and operator access that is logged and time-limited
  • Regular security reviews of the code and dependencies

6. Data Retention

We retain account data for as long as the account is active, and delete it within 30 days of account deletion (backups within a further 35 days). Tracking and conversion data is retained for as long as the customer's workspace exists so that reports and attribution keep working, with these automatic limits:

  • Raw IP addresses and user-agent strings are removed from events 30 days after they were recorded; only the derived country remains
  • Landing-page visits are deleted after 90 days
  • The workspace activity log is kept for 12 months
  • Server logs are kept for 14 days

Customers can delete links, forms, workspaces and their whole account themselves, and can ask us to delete specific records at any time.

7. Cookies

On tellmetric.com we use only essential cookies: a signed session cookie for authentication and CSRF protection, and a preference for the light or dark theme. We use no advertising or analytics cookies on our own site.

Our tracking script, when a customer installs it on their landing page, stores a pseudonymous visitor id in the customer's own first-party storage and reads the ad platforms' standard first-party cookies (for example Meta's fbc and fbp) that the customer's site sets. These are set by the customer's domain, not ours, and the customer is responsible for the consent notice their site shows.

8. Your Rights (GDPR)

If you are located in the European Economic Area or the United Kingdom, you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Object to or restrict processing of your data
  • Receive your data in a portable format
  • Withdraw consent at any time, where processing is based on consent
  • Lodge a complaint with a supervisory authority, in the Netherlands the Autoriteit Persoonsgegevens

To exercise these rights, write to us at the address below or use the contact form. We answer within one month. If you are an end user of a customer's funnel, we will forward your request to that customer, who decides on it as controller, and assist them.

9. International Transfers

Our servers, database and backups are located in the European Union. Data sent to Meta, TikTok, Google and Stripe may be transferred to the United States or elsewhere under their respective data-processing terms, relying on an adequacy decision or the EU Standard Contractual Clauses. Telegram processes bot interactions under its own terms.

10. Children's Privacy

Our service is not intended for individuals under 16. We do not knowingly collect data from children, and customers agree not to point tracked campaigns at them.

11. Changes to This Policy

We may update this policy from time to time. We will notify customers of material changes via email or a notice on our website before they take effect, and the date at the top of this page always shows the current version.

12. Contact

For any questions about this Privacy Policy, or to exercise any of your rights, contact us at:

Company
Tellmetric
Responsible person
Volodymyr Yurkov
Address
Naritaweg 165, 1043 BW Amsterdam, Netherlands
KvK (Dutch Chamber of Commerce) number
99455242
VAT identification number
NL005387124B49
Email
info@tellmetric.com · contact form