Privacy policy
This policy describes the Tao Track beta at taotrack.com. It was updated on 22 October 2026.
Tao Track is operated as a beta web application for business customers. Questions about this policy go to support@taotrack.com.
Who this covers
Two groups. Account holders are the people who sign in to a workspace. Visitors are the people who click a customer’s ad, open the customer’s landing page, or start the customer’s Telegram bot.
For visitor data, the customer decides the purpose and the legal basis, including consent on the landing page. Tao Track stores and processes that data so the customer can see attribution. The customer is responsible for the notice on their own site.
Account data
We store the email address, a password hash, workspace membership, and session records needed to keep someone signed in. The session cookie is HttpOnly. We use it to recognise the account in the dashboard. The marketing pages on taotrack.com do not set a tracking cookie.
Visitor and ad data
For a measured click and the events that follow, we store:
- Our click id, and the time of the click.
-
Ad parameters the link received, including TikTok’s click id
(
ttclid), UTM parameters, and campaign, ad group, and ad ids. - The landing address and the referrer of that request.
- Event name, time, value, and currency. Names used in the beta are page view, telegram click, bot start, lead, qualified lead, purchase, deposit, and custom.
- A visitor id and a session id, and only after the landing page grants consent. If consent is withdrawn, those ids are deleted and the pixel stops sending.
- The numeric Telegram user id, and the time it was first seen for that bot. We do not store the Telegram username or display name. The id is masked in the dashboard.
We do not store IP addresses or raw user agents. Country is not collected in this beta. We do not store the text of Telegram messages. A bot token is encrypted and is not shown again after it is saved.
TikTok
If a customer connects a TikTok ad account, we store the tokens required to call the API, encrypted, and the reporting rows TikTok returns: campaign structure and daily metrics such as spend. We use them to show cost and return next to our events.
If the customer enables conversion feedback, we send the chosen
events to TikTok’s Events API with ttclid when we have
it, our event id, the event time, and value and currency when the
event has them. We do not send email, phone, IP, or user agent,
because we do not collect them for this purpose.
We do not request access to TikTok profiles, private user content, or permission to post. Disconnecting the ad account stops further sync and further sends.
How long it is kept
| Data | Default in the beta |
|---|---|
| Clicks | 180 days |
| Events | 24 months |
| Telegram update ids used for deduplication | 30 days |
| Delivery log | 90 days |
Reports can keep campaign ids after a click is deleted, so older totals do not disappear. Deleted rows are not restored. A customer can set a different retention period where the product allows it.
Deletion and export
An owner or admin can delete one Telegram user inside a project. That removes the link between that numeric id and its clicks. They can delete a project, or a whole workspace. Deleting a workspace removes the tenant data tied to it. Account deletion for the login itself can be requested at support@taotrack.com.
A full self-serve export is not in the beta yet. A customer can ask the same address for a copy of their workspace data.
Who we share it with
We use infrastructure that hosts the application and its database. We send conversion events to TikTok only when the customer has connected an ad account and enabled those events. We do not sell personal data.
Changes
If this beta policy changes, the date at the top of this page will change with it. Continued use of the beta after that date is use under the updated policy.