Security & privacy

• Email and phone enter the pipeline as hashes only. The raw values are never stored.
• IP addresses are resolved to country, region and city at ingest. The address itself is not persisted.
• Retention is yours to set, and old records are pruned daily.

Ship with data-consent="denied" and nothing is collected until your banner calls roas.consent(true).

Every record stores the consent state it was collected under, so a visitor who changes their mind mid-visit is recorded correctly rather than retroactively.

A GDPR erasure request removes every trace of one person by email, across touchpoints and events alike.

It is deliberately never scheduled or automated: it is irreversible, and belongs to a human rather than a clock.

See the Privacy Policy and Data Deletion pages for the full detail.