Skip to content
LEGAL & DATA PRIVACY

Privacy Policy

Last updated: October 17, 2026

1. Introduction

Skewix ("we", "our", or "us") is committed to protecting your privacy and maintaining cryptographic data hygiene. This Privacy Policy explains how we collect, process, hash, and safeguard information when you use our forensic ad-spend-to-revenue reconciliation and server-side CAPI/OCI signal recovery platform.

2. Information We Collect & Process

2.1 Account & Workspace Information

When you register a workspace, we collect:

  • Work email address and authentication credentials (hashed via PBKDF2-SHA256)
  • Name and organization / workspace name
  • Subscription tier and Stripe billing metadata

2.2 Connected Platform & Revenue Ledger Data (8 Connectors)

When you authorize any of our 8 supported connectors (Stripe, HubSpot CRM, Meta Ads, Google Ads, Google Analytics 4 (GA4), TikTok Ads, LinkedIn Ads, and Microsoft Advertising), we ingest:

  • Campaign performance metrics (billed spend, impressions, clicks, claimed conversions, and claimed conversion value)
  • Revenue truth ledger records from Stripe (charge.succeeded, charge.refunded, charge.dispute.created) and HubSpot CRM (closedwon deal records)
  • OAuth 2.0 refresh tokens, system user tokens, and restricted API keys (encrypted at rest using AES-256-GCM)

2.3 1st-Party Edge Click Collector & SHA-256 PII Hashing

When you deploy the Skewix 1st-Party Edge Click Collector (/api/collect/script.js) or ingest checkout webhooks:

  • We capture advertising click identifiers (gclid, gbraid, wbraid, fbclid, _fbp, _fbc, ttclid, li_fat_id, and msclkid) in 1st-party storage to link ad clicks to settled transactions.
  • For server-side conversion recovery (Meta CAPI v19.0, Google Ads Enhanced Conversions / OCI, TikTok Events API v1.3, and LinkedIn Conversions API), customer identifiers such as email addresses are normalized and cryptographically hashed using Web Crypto SHA-256 at the Cloudflare edge prior to dispatch.

3. How We Use Your Information

  • To execute deterministic 3-way forensic tie-outs between ad spend, analytics sessions, and settled Stripe/HubSpot cash
  • To classify revenue variance and dispatch authorized server-side CAPI/OCI conversion recovery payloads
  • To execute operator-configured campaign budget guardrails and send Slack or email materiality alerts
  • To generate cryptographic CSV and PDF CFO audit packets

4. Cryptographic Security Architecture

We implement strict edge-native security controls:

  • AES-256-GCM Token Vault: All platform OAuth tokens and API keys are encrypted using Web Crypto AES-256-GCM before storage in Cloudflare D1.
  • PBKDF2-SHA256 Authentication: Passwords and session tokens are verified natively on Cloudflare Workers with zero third-party authentication trackers.
  • SHA-256 PII Hashing: Outbound CAPI and OCI payloads use one-way SHA-256 digests for user match keys.
  • Tenant Isolation: Every SQL query and forensic tie-out is strictly scoped to your authenticated workspace ID.

5. Data Retention

Forensic ledger data is retained according to your workspace subscription tier (30 days on Starter, 180 days on Growth, and 365 days on Enterprise). Upon account deletion:

  • Connected platform tokens and forensic ledger rows are permanently purged within 30 days
  • Billing and invoice records are retained for 7 years to comply with tax and accounting regulations

6. Subprocessors & Infrastructure

We rely on a minimal, high-security set of infrastructure providers:

  • Cloudflare (Workers compute, D1 database, KV, and Workers AI)
  • Stripe (Subscription billing and customer portal)
  • Resend (Transactional and materiality alert emails)

7. Your Privacy Rights

Depending on your jurisdiction (including GDPR and CCPA), you have the right to access, correct, export, or request deletion of your personal data, or revoke platform OAuth connections at any time from your workspace settings.

8. Cookies

Skewix uses strictly necessary 1st-party cookies for session authentication and theme preference. We do not load third-party advertising trackers on our application or marketing properties.

9. Contact Us

For privacy inquiries, DPA requests, or security disclosures, contact [email protected].