1. Who we are
SideRelay is a server-side tracking service operated by Illumetric Technologies AB, a Swedish limited company. Where we decide why and how personal data is processed, Illumetric Technologies AB is the data controller.
Illumetric Technologies ABPontus Ols Väg 8
263 61 Viken, Sweden
Organisation number: 559497-2886
VAT number: SE559497288601
Email: [email protected]
For privacy requests, contact our data protection contact at [email protected].
2. When we are controller and processor
Illumetric as controller
We act as controller for data about visitors to siderelay.com, prospective customers, account holders, billing contacts, and people who contact us. This includes decisions about authentication, service administration, billing, support, security, and our legal obligations.
Illumetric as processor
A SideRelay customer normally decides which website, app, advertising, and conversion data to send, why to process it, and which destinations receive it. For that customer tracking data, the customer is the controller and Illumetric acts as processor on the customer's documented instructions. Our data-processing commitments are described in the Terms of Service and any applicable order.
If your data came from a customer's website: contact that website or company first to exercise privacy rights or change consent choices. They control the tracking setup, and we assist them with valid requests.
3. Personal data we process
The information depends on how you use SideRelay and may include:
- Account and identity data: name, work email address, company, role, organization membership, authentication-provider ID, password hash, session information, two-factor authentication status, and encrypted authentication secrets or recovery codes.
- Commercial data: billing contact, company and VAT details, subscription, usage, invoices, payment status, and limited payment-method information supplied by Stripe. SideRelay does not store complete card numbers.
- Tracking and conversion data: event names and IDs, timestamps, page and referral information, consent state, browser and device information, IP address, user agent, cookie or click identifiers, order or lead details, and identifiers supplied for conversion matching. Customers decide which optional fields to send.
- Configuration and integration data: websites and sources, event rules, destinations, Google Tag Manager resources, domain settings, encrypted OAuth tokens, API credentials, and connection health.
- Activity and security data: trace and delivery results, provider response codes, request timestamps, login attempts, audit events, rate-limit and abuse signals, support activity, and error logs.
- Communications: support requests, feedback, and other messages to us.
We receive data from you, your organization, connected websites and backends, identity and payment providers, connected advertising platforms, and automatically when the service is used. Customers must not send special-category personal data, complete payment-card data, passwords, or other data that is not needed for tracking.
4. Why we process personal data
| Purpose | Typical data | GDPR legal basis |
|---|---|---|
| Provide accounts, workspaces, tracking, integrations, delivery, and support | Account, configuration, customer tracking, and communications data | Contract or steps requested before entering a contract |
| Manage subscriptions, usage, invoices, and customer relationships | Account, company, billing, usage, and payment-status data | Contract and legal obligations for accounting and tax |
| Protect the service, prevent abuse, diagnose failures, and improve reliability | Session, device, security, trace, delivery, error, and support data | Legitimate interests in operating a safe and dependable business service |
| Send service notices and respond to questions | Contact details, preferences, and communications | Contract, legitimate interests, or consent where required |
| Meet legal requirements and respond to valid legal requests | Relevant account, billing, security, and customer records | Legal obligation or legitimate interests in establishing legal claims |
For customer tracking data, the customer determines the legal basis. Depending on its setup, that may be consent, legitimate interests, contract, or another basis allowed by law.
5. How we use Google user data
Google sign-in
If you choose Google sign-in, SideRelay receives your name, email address, profile image, and Google account identifier. We use this data only to authenticate you, create or link your SideRelay account, show your profile, and protect your session.
Google Tag Manager connection
If an authorized user connects Google Tag Manager, SideRelay requests access to view the selected accounts, containers, workspaces, versions, and templates. It can also create or edit SideRelay-managed container resources, create immutable versions, and publish a version only when the user starts that action. SideRelay works inside its own managed workspace and does not use this connection to alter unrelated customer resources.
OAuth refresh tokens are encrypted at rest. Access tokens are short-lived and are not stored long term. We use Google user data only to provide the visible sign-in and Tag Manager features the user requested. We do not sell Google user data, use it for advertising, or share it with data brokers. Our staff do not access it except when the user asks for support and authorizes the access, when needed to investigate security or abuse, or when required by law.
You can revoke SideRelay's Google access in your Google Account connections or ask us to remove the stored connection. Revoking access stops new Google API access. We then delete the active OAuth credential, subject to short-lived backups and records we must retain by law.
SideRelay's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
8. EU hosting and international transfers
SideRelay's main application, PostgreSQL data, and managed compute are hosted in the European Union. Cloudflare operates a global edge network, and connected advertising, identity, payment, or email providers may process data outside the EU/EEA. When a transfer requires a safeguard, we or the relevant customer use an adequacy decision, Standard Contractual Clauses, or another lawful transfer mechanism.
9. How long we keep data
- Encrypted event payload details and detailed destination responses are kept for seven days by default.
- Trace and delivery metadata is kept for 30 days by default.
- Daily usage and data-quality aggregates are kept for 13 months by default.
- Account, configuration, support, and integration data is kept while the account or connection is active and then deleted or anonymized when no longer needed.
- Billing, tax, fraud-prevention, dispute, and security records may be kept longer where law or a legitimate legal need requires it.
A customer can choose a shorter retention period where the service supports it. Backup copies are isolated and expire according to the backup schedule.
10. How we protect data
SideRelay uses encryption in transit, encrypted event details and credentials at rest, organization-scoped access, host-only sessions, access controls, backups, rate limits, and monitoring intended to protect confidentiality, availability, and integrity. Sensitive credentials are masked after saving and are not returned by normal APIs. No internet service can promise absolute security, so customers should also limit the data they send and protect their own accounts and keys.
11. Your privacy rights
Depending on applicable law, you may have the right to:
- access your personal data and receive information about its processing;
- correct inaccurate or incomplete data;
- request deletion or restriction of processing;
- object to processing based on legitimate interests;
- receive data you provided in a portable format where applicable;
- withdraw consent without affecting earlier lawful processing; and
- complain to your local data protection supervisory authority.
Send requests about your SideRelay account to [email protected]. We may need to verify your identity. For tracking data sent by one of our customers, contact that customer first; we will assist them as required.
12. Children
SideRelay is a business service and is not directed to children. Customers must not knowingly use SideRelay to profile children or send children's personal data without a lawful basis and appropriate safeguards.
13. Changes and contact
We may update this policy when SideRelay, its providers, or applicable law changes. The date at the top shows the latest revision. We will provide additional notice when a material change requires it.
For privacy questions, data requests, or information about subprocessors and transfer safeguards, email [email protected]. For general questions, email [email protected].