PRIVACY, SECURITY & CONSENT
Your store data and lead data stay encrypted, consented, and regionally hosted.
Everything flows through CustomerLabs before reaching ad platforms. Here is exactly how we protect it — and how we handle consent.
TLS 1.2+ in transit. Encryption at rest. SHA-256 hashing. 8-region hosting. Consent Mode v2. Meta LDU. Signed DPA. GDPR, HIPAA, CCPA compliant.
WITHOUT THIS
Your data flows through a tool you can't audit. That's the real risk.
You send customer data through third-party tools every day. Most don't tell you where it's hosted, who processes it, or what happens after you cancel.
No visibility into data hosting
Your data sits in an unknown region. You signed a privacy policy, not a DPA.
Raw PII reaches ad platforms
Email, phone, and names travel unhashed to Meta and Google. One breach away from a compliance incident.
No deletion guarantee
You cancel the tool. Your customer data? Still on their servers. No retention policy. No deletion SLA.
CustomerLabs provides enterprise-grade infrastructure security — regional hosting, encryption, signed DPA, sub-processor transparency — plus payload-level controls that scrub, hash, and rename before data leaves your system. Most tools stop at a privacy policy page.
HOW IT CONNECTS
Your data → encrypted, hashed, scrubbed → compliant delivery
Your data
Ecommerce platformCRMBackend eventsForms & leadsCollect
Encrypt in transit. Hash PII. Scrub sensitive fields. Host in your chosen region. Deliver clean payloads to every destination.
Process
Filter, transform, resolve identity
Deliver
Route to every connected platform
Your platforms
Meta CAPIGoogle AdsGA4CRM destinations“CustomerLabs transformed our data accuracy and ad performance. Server-side event tracking, easy setup, and seamless integration with Facebook and Google Ads. 180-day persistent customer audiences. Exceptional support.”
HOW IT WORKS
Enterprise security is built in. Not bolted on.
Every event is protected by default — from ingestion to delivery.
Encrypted in transit
TLS 1.2 or higher for every data transfer. Nothing travels in plaintext.
Encrypted at rest
Cloud KMS encryption on GCP. Your data is encrypted on disk.
PII hashed before delivery
Email, phone, name — all SHA-256 hashed before reaching Meta, Google, or any destination. Raw PII never leaves CustomerLabs.
Hosted in your region
Choose from 8 regions: US, EU, London, Australia, India, Singapore, Middle East, Saudi Arabia. Your data stays where you need it.
Configure once. Applies to every event across all destinations.
DATA CONTROLS
Masking, access, and monitoring inside the platform.
Control what leaves, who can touch it, and what gets logged.
Field-level data masking
Mask or redact sensitive fields before delivery. Health conditions, financial details, treatment types — scrubbed field by field.
URL and event scrubbing
Remove sensitive parameters from URLs and event names. Meta's enforcement reads payloads, not privacy policies.
Role-based access control
Least-privilege access. Unique credentials per person. Audit logs on every admin action.
Monitoring and alerting
Suspicious activity triggers alerts. Incident response workflows kick in automatically.
Access controls and audit logging inside the dashboard.
CONSENT MANAGEMENT
No consent, no event. Built into the delivery layer.
Consent verification happens before any event leaves your system.
Consent status check before delivery
Every event checks consent status before firing. No consent = no event sent. Automatic, not manual.
Google Consent Mode v2
Send consent signals (ad_storage, analytics_storage, ad_personalization, ad_user_data) with every event. Required for EU traffic on Google Ads.
Meta Limited Data Use (LDU)
Enable LDU for California and other restricted regions. Meta processes events with reduced data usage automatically.
Consent-based routing
Route events differently based on consent state. Full consent → full payload. Partial consent → stripped payload. No consent → event blocked.
Consent checks run before any event reaches a destination.
COMPLIANCE & DPA
Signed DPA. Named sub-processors. Defined retention.
Your legal team gets the documentation they need. Your marketing team keeps the data flowing.
Signed Data Processing Agreement
Formal DPA covering data handling, security obligations, breach notification, and deletion guarantees. Available at app.customerlabs.com/dpa/.
GDPR, HIPAA, CCPA/CPRA compliant
EU SCCs for cross-border transfers. HIPAA safeguards for health data. CCPA/CPRA compliance for California consumer data. UK GDPR and Swiss FADP covered.
Named sub-processors with 30-day notice
GCP for hosting. AWS for specific components. SendGrid for email. Full transparency. 30 days advance notice before any sub-processor change.
90-day retention with secure deletion
After contract ends, data is retained up to 90 days for export. Then securely deleted from production. No surprise retention.
DPA, sub-processor transparency, and retention policies.
WHAT THIS UNLOCKS
With enterprise privacy built in, your team can:
Security that enables marketing, not blocks it.
Pass enterprise security reviews faster
Signed DPA, named sub-processors, regional hosting, encryption documentation. Your procurement team gets answers, not delays.
Send data to ad platforms without raw PII
SHA-256 hashing on email, phone, and name. Meta and Google get hashed identifiers. Raw data never leaves CustomerLabs.
See server-side deliveryRecover tracking in health, wellness, finance, and restricted categories
URL scrubbing removes sensitive parameters. Event renaming avoids Meta restrictions. Good Body Clinic was back online in under 24 hours.
See destination controlsRESULTS
Proof from teams running privacy-safe operations
Enterprise security. Real campaign results.
CUSTOMER PROOF
<24hGood Body Clinic restored compliant tracking in under 24 hours
Meta restricted their health/wellness events. CustomerLabs scrubbed URLs, renamed events, and delivered via server-side CAPI. Conversion tracking was back the same day.
Read the Good Body Clinic case study →CUSTOMER PROOF
9.3Wellness brand hit 9.3 EMQ with full privacy controls active
PII hashing, URL scrubbing, event renaming — all enabled. EMQ still reached 9.3. Privacy controls preserved signal quality instead of destroying it.
Read the wellness brand case study →“Excellent first-party tracking without the gimmicks. We identify more customers than other services and feed that data back into Meta and Google to target users who are actually purchasing.”
FAQ
Common questions about privacy, security, and consent
Direct answers first.
Where is my data hosted?
You choose from 8 regions: US, EU, London, Australia, India, Singapore, Middle East, Saudi Arabia. Your data stays in that region.
Does CustomerLabs support Google Consent Mode v2?
Yes. Consent signals (ad_storage, analytics_storage, ad_personalization, ad_user_data) are sent with every event. Required for EU traffic on Google Ads since March 2024.
How does consent-based routing work?
Events check consent status before delivery. Full consent sends full payload. Partial consent sends stripped payload. No consent blocks the event entirely.
Does CustomerLabs support Meta Limited Data Use (LDU)?
Yes. LDU is enabled per destination. Meta processes events from California and other restricted regions with reduced data usage automatically.
Does CustomerLabs have a signed DPA?
Yes. A formal Data Processing Agreement at app.customerlabs.com/dpa/. Covers data handling, breach notification, sub-processor transparency, and deletion guarantees.
Does raw PII reach Meta or Google?
No. Email, phone, and name are SHA-256 hashed before leaving CustomerLabs. Ad platforms receive hashed identifiers only.
What happens to my data after I cancel?
Data retained up to 90 days for export. Then securely deleted from production. No indefinite retention.
Can I run ads in restricted categories?
Yes. URL scrubbing, event renaming, and field masking handle health, wellness, and finance restrictions. Good Body Clinic restored tracking in under 24 hours.
READY TO DEPLOY
Enterprise security and consent for your first-party data.
Encrypted. Consented. Regionally hosted. Compliant. Book a demo.