Hashed on your server, sent only to your accounts
Conversions go straight from your server to the Meta, Google and TikTok accounts you connect. Contact details are hashed before they leave, access tokens stay in your .env file, and the addon never contacts us.
Where your data goes
On your own server, which sends each conversion over HTTPS to the platforms you switch on: graph.facebook.com for Meta, google-analytics.com (or its EU endpoint, if you choose it) for GA4, and business-api.tiktok.com for TikTok. It never contacts Karelia Labs: it has no telemetry, no analytics and no account with us. Statamic itself checks licence keys with statamic.com; that is part of Statamic, not of the addon.
What is stored
The addon stores two cookies in the visitor's browser after consent, and a log on your server.
| Data | Where and why | How long |
|---|---|---|
| Ad click IDs and UTM tags of the visit (fbclid, gclid, gbraid, wbraid, ttclid, msclkid, utm_*), the landing page and the referring site | First-party cookie karelia_conversions_attr in the visitor's browser, only after consent. Credit the right ad | 90 days by default |
| The visitor's consent, when the addon keeps it itself | Cookie karelia_conversions_consent. Respect the choice | 1 year |
| The log: event, time, form or source, value, campaign, click type, consent and each platform's answer. No names, emails, phone numbers, IPs or hashes | JSON lines in storage/statamic/karelia-conversions. Show what was sent | 30 days by default |
| Settings: platforms switched on, IDs, forms and values, consent mode | Statamic's addon settings. Access tokens and API secrets only in .env | Until changed |
Personal data
To match a conversion, the platforms receive the visitor's email, phone and name hashed with SHA-256 (Meta also the address, hashed; Google Analytics 4 gets city, postcode and country in plain text, because its API requires that; TikTok gets no name or address), and their IP address, browser user agent, ad click ID and the platforms' own cookies (_fbp, _fbc, _ga, _ttp) as they recommend. Your site is the controller of this data and decides, with your cookie banner, when it may be sent. The log in the Control Panel holds none of it.
Permissions
The addon adds two Statamic permissions in a Conversions group under Users, Roles.
| Permission | Why the app needs it |
|---|---|
| View conversions | Open the log and totals. No personal data is shown |
| Send test events | Use the test buttons |
Access control
The Control Panel pages and the test endpoint check the permissions on the server. Settings are changed under Tools, Addons, which needs Statamic's own Configure addons permission. Access tokens are never shown or editable in the Control Panel.
Untrusted input
Form values are read as data and only normalised and hashed, never run. Click IDs and UTM values from the address bar are cut to 500 characters, kept only after consent and sent as text. The consent and attribution script is inline, has no dependencies and accepts a CSP nonce.
Dependencies
The addon depends only on Statamic and Laravel, installed by Composer, and calls the platforms with Laravel's HTTP client. Its Control Panel script is built with Statamic's own Vite tooling against Statamic's components and bundles no third-party code.
Other points
Consent
With the default consent mode, nothing is sent and no click IDs are kept until your banner calls KareliaConversions.consent(true) or sets its own cookie. GA4 also gets the consent signals ad_user_data and ad_personalization.
When a platform is down
Each platform is called separately with a short timeout. A failure is recorded in the log with the platform's message and never stops the form or the other platforms.
Logging
The addon writes the conversion log described above, including each platform's error message when sending fails. It writes nothing to Laravel's log during normal use and never logs personal data.
Sub-processors
None for us: we receive no site data. Meta, Google and TikTok receive conversions under your own agreements with them. Licences and payments are handled by Statamic and Stripe. For the other parties involved in our own support and bookkeeping, see the privacy policy.
AI and language models
None. The addon contains no language model and sends no content to any.
Vulnerabilities
Report a suspected vulnerability to support@karelialabs.atlassian.net. Please include what you found, how to reproduce it and which version is affected, and give us a reasonable time to fix it before you publish details. We read every report.
Deleting data
The log is pruned daily after 30 days, or with php please conversions:prune. KareliaConversions.consent(false) removes the attribution cookie. Data already sent is kept by each platform under its own rules. Removing the addon with Composer leaves the log folder in place; delete it to remove the log.