Security and Privacy

Better attribution without losing control over customer data.

Agencies share their clients’ data. That’s why FYAI is built from the ground up with security and privacy in mind: EU storage, segregated customer data, access per client account, and processing nothing more than necessary.

  • EU Storage
  • Segregated Customer Data
  • Hashed to the Platforms
  • Read-Only CRM Integrations

EU Storage

Storage and processing in the EU. Conversions are only sent to the ad platforms you enable, hashed, under the EU Standard Contractual Clauses.

Segregated Customer Data

Data, integrations, and access are separated per client account, with an overview of your portfolio.

Your Consent Settings

The FYAI tag runs in your Tag Manager under your consent settings. A transmitted consent status is recorded per lead.

Access Management

Team roles for your employees, access per client account for your client.

No more data than necessary, and only where you send it.

Data minimization is built into the design, not a setting you have to find.

Nothing Stored Before Activation

Until you activate a form, FYAI only stores field names, never entered values. You choose per field what is processed.

Hashed for Transmission

Email address and phone number are sent as SHA-256 hashes to the ad platforms. Raw values never leave our infrastructure.

Only to the Platform that Brought the Lead

A lead with a Google click ID only goes to Google; a Meta lead only goes to Meta. No platform receives leads from another channel.

Read-Only CRM Integrations

We integrate HubSpot, Pipedrive, Salesforce, and other CRMs with read-only permissions. FYAI writes nothing to your client’s CRM.

Audit Log and API Logging

Form activations, exports, and imports are in the audit log, and every outgoing API call is logged for 90 days. This allows you to show what happened in case of an incident or access request.

Security

TLS everywhere, tokens stored encrypted, passwords hashed, and rate limiting on tracking and export endpoints.

Your Client is the Data Controller, FYAI is the Data Processor

Under the GDPR, your client (or you, for your own company) is the data controller. FYAI processes data on instruction. Requests from visitors go through the controller, and FYAI assists with handling them.

Which sub-processors we use and for what purpose is stated in our privacy policy.

Data Retention Periods
Lead DataAs long as the workspace is active
Deleted RecordsRemoved after 90 days
API Logs90 days
Export Files30 days
Audit Log24 months

Lead data can be stored for a shorter period, upon your instruction.

Per Client

Segregated data and access per client account

  • ✓Multi-client from day one. Each client has their own stack, data, integrations, and access, while you maintain an overview of everything.
  • ✓Team roles for your employees, access per client account for your client.
  • ✓Storage and processing in the EU.
Example · portfolio with 11 client accounts
Client 01✓
Client 02✓
Client 03✓
Client 04✓
Client 05✓
Client 06✓
Client 07✓
Client 08✓
Client 09✓
Client 10✓
Client 11 · live6 clients · €74,000

Example: single setup, segregated data and access per client

What Agencies Always Ask Us

Where is the data stored?

Storage and processing take place in the EU. Conversions are only sent to the ad platforms you enable.

Who is the data controller?

Your client, or you for your own company. FYAI is the data processor and processes data on instruction.

How long do you retain data?

Lead data as long as the workspace is active, or shorter upon your instruction. Deleted records are permanently removed after 90 days, API logs after 90 days, export files after 30 days. The audit log is retained for 24 months.

Can I have data deleted?

Yes. A deleted record is permanently removed after 90 days. A request from a visitor goes through the controller, and we assist with handling it.

Which sub-processors do you use?

The current list is available in our privacy policy.

What about the United States?

The ad platforms (Google, Meta, LinkedIn, TikTok, Snap, Pinterest, and OpenAI) are US parties. Conversions are only sent to the platforms you enable, only to the platform that brought the lead, hashed, and under the EU Standard Contractual Clauses. Storage and processing remain in the EU.

See what your campaigns are truly worth.

FYAI is the bridge between marketing and sales. Within FYAI, you qualify and enrich your leads, and FYAI sends those results back to the relevant ad channels.

Scroll to Top
Secret Link