Provider: Karelia Labs, Sweden ("we", "us")
Contact for privacy questions: support@karelialabs.atlassian.net
Version / date: 1.0 / 2026-10-20
1. What this policy covers
Karelia Conversions ("the Addon") is an addon for Statamic 6 websites. When a visitor sends a form, signs up or places an order, the Addon reports that conversion from the site's own server to the advertising accounts the site connects: the Meta Conversions API, Google Analytics 4 (Measurement Protocol) and the TikTok Events API. This policy explains what personal data the Addon handles, where it goes, and what we, the provider, do and do not receive.
2. The short version
- The Addon runs on the site's own server and sends data only to the Meta, Google and TikTok accounts the site itself sets up. It never contacts us, sends no usage data, analytics or telemetry, and has no account with us.
- Email addresses, phone numbers and names are hashed with SHA-256 on the server before they are sent, and so are addresses sent to Meta. Google Analytics 4 only accepts city, postcode and country in plain text, so those three are sent to Google unhashed. TikTok receives no name or address.
- By default nothing is sent and no click IDs are kept until the visitor has accepted marketing cookies. The site connects its own cookie banner to decide this.
- The Addon's log on the site's server holds no names, email addresses, phone numbers or IP addresses.
3. Data handled by the Addon
| Data | Examples | Purpose | Where | Retention |
|---|---|---|---|---|
| Form, sign-up or order data | Email address, phone number, first and last name, city, postcode, country, order value and products | Build the conversion, so the platform can match it to an ad click | In the server's memory while sending; hashed before it leaves, except city, postcode and country for Google Analytics 4 (see section 4) | Not stored by the Addon |
| Technical data of the request | IP address, browser user agent, page address, referrer | Required or recommended by the platforms for matching | Sent with the conversion | Not stored by the Addon |
| Platform cookies already on the site | Meta _fbp and _fbc, Google _ga, TikTok _ttp | Tie the conversion to the visitor's ad click or analytics session | Read from the request and sent with the conversion | Not stored by the Addon |
| Ad click IDs and UTM tags | fbclid, gclid, gbraid, wbraid, ttclid, msclkid, utm_source, utm_medium, utm_campaign, landing page | Know which ad or campaign the visitor came from | First-party cookie karelia_conversions_attr, set by {{ conversions:script }} only after consent | 90 days by default, set by the site |
| Consent | karelia_conversions_consent cookie, or the site's own banner cookie, checked with an exact rule so a refusal never counts | Respect the visitor's choice | Visitor's browser | 1 year, or as the banner decides |
| Checkout context for Cargo orders, only with consent | IP address, browser user agent, platform cookies, click IDs and UTM tags of the shopper | Report the purchase when the payment provider confirms it later | Laravel's cache on the site's server | Until the order is paid, at most 14 days |
| Conversion log | Event type, time, form or source name, value and currency, the campaign and click type (e.g. "Meta ads"), whether there was consent, and each platform's result | Show the site's editors what was sent | JSON lines in storage/statamic/karelia-conversions on the site's server | 30 days by default, set by the site |
The log never contains names, email addresses, phone numbers, IP addresses, click IDs or hashed values.
4. Data sent to advertising platforms
Conversions go over HTTPS to the accounts the site has configured, and only for the platforms it switches on:
- Meta Platforms (Meta Conversions API): hashed email, phone, name, city, postcode, country and user ID; IP address, user agent,
_fbp,_fbcorfbclid; event name, page address, value, currency and products. - Google (Google Analytics 4 Measurement Protocol): GA client ID from
_ga, hashed email, phone and name, city, postcode and country in plain text (Google's API does not accept them hashed), consent signals (ad_user_data,ad_personalization), event name, value, currency and products. - TikTok (TikTok Events API): hashed email, phone and user ID; IP address, user agent,
_ttporttclid; event name, page address, value, currency and products.
What these companies do with the data is governed by the site operator's own agreements with them and by their privacy policies. When the site sends conversions without consent (the setting "always"), it is responsible for having another legal basis for that.
5. Data we receive as the provider
- Support requests: if you contact support we receive what you send us (typically name, email address, site address and the problem description). We use it to answer you and keep it as long as needed for support and legal obligations, for at most 24 months after the last message, unless a longer period is required by law (for example bookkeeping rules).
- Licences: licences are sold through the Statamic Marketplace on statamic.com. Statamic handles the checkout, taxes, receipts, licence keys and refunds under its own terms, and payments to us go through Stripe. We receive the information Statamic gives sellers about a sale, such as the buyer's name or company, email address, the licence and the amount.
- Website: the Karelia Labs website sets no cookies and uses no analytics or trackers.
We never receive conversions, form data, hashed values, access tokens or anything else the Addon handles on the site.
6. Roles and legal basis
For data handled by the Addon, the site operator decides why and how it is used and is the controller. The site operator chooses the platforms, which forms count, and whether consent is required, and is responsible for informing visitors (for example in its own privacy and cookie policy) and for a legal basis. We do not process the site's personal data.
For our own data (support requests and sales records) we are the controller. The legal basis is our contract with you, our legitimate interest in running and supporting the Addon, and legal obligations (bookkeeping).
7. Sub-processors and recipients
We use no sub-processors for site data, because we receive none. Support requests, whether sent through our support portal or by email, are handled in Atlassian's Jira Service Management, with Atlassian as our processor under its Data Processing Addendum. Statamic and Stripe handle sales and payments under their own terms.
8. International transfers
Conversions go to Meta, Google and TikTok, which may process them outside the EU/EEA under the site operator's agreements with them. Our own support data is stored in Atlassian's cloud. Atlassian may process it outside the EU/EEA, for example in the United States, and protects such transfers with the EU Standard Contractual Clauses and its certification under the EU-U.S. Data Privacy Framework.
9. Retention and deletion
- The log keeps 30 days by default and is pruned daily by Laravel's scheduler, or with
php please conversions:prune. - Calling
KareliaConversions.consent(false)removes the attribution cookie in the visitor's browser. - Data already sent to a platform is kept by that platform under its own rules. Use the platform's own tools for deletion requests.
10. Security
Access tokens and API secrets are read only from the site's .env file and never shown in the Control Panel. Requests to the platforms use HTTPS. The Control Panel log needs its own permission and shows no personal data.
11. Your rights
Under the GDPR you may have the right to access, correct, erase, restrict or object to the processing of your personal data, to data portability, and to complain to a supervisory authority (in Sweden: Integritetsskyddsmyndigheten, IMY). For data from a website that uses the Addon, please contact the operator of that website, because we have no access to it. For our own data contact support@karelialabs.atlassian.net.
12. Children
The Addon is a tool for website operators and is not directed at children.
13. Changes
We will update this policy when the Addon's data handling changes and publish the new version with a new date. Material changes are announced in the changelog.