Privacy policy
SenTrace ("SenTrace", "we", "us") is a marketing and growth platform for marketing agencies and business owners in Malaysia. It runs the website at sentrace.online and the portal at portal.sentrace.online. This policy explains what personal data we collect, why, who we share it with and the choices you have. We process personal data in line with Malaysia's Personal Data Protection Act 2010 (PDPA).
Who this policy covers
- Users of the portal: agency staff, business owners and their staff who log in to SenTrace.
- Our customers' customers: people who message, book, visit a website or click an ad of a business that uses SenTrace. For this data the business (or its agency) decides what is collected and why; SenTrace processes it on their behalf and on their instructions.
- Visitors to sentrace.online and people who send us an enquiry or application.
What we collect
- Account data: name, e-mail address, phone number, role, agency or business, and log-in records.
- Contact and conversation data a business keeps in SenTrace: names, phone numbers, e-mail addresses, messages received and sent through connected channels (such as WhatsApp, Messenger, Instagram and TikTok), appointments, visit requests, deals, payments recorded and consent given.
- Tracking and website data: when a business adds the SenTrace snippet or tracking links to its own website or ads, we record visits, pages, taps and clicks, the campaign and ad that brought the visit (for example a Google click identifier, GCLID), device type and a visit reference. Personal details are linked only when the person provides them, for example by booking.
- Data from connected accounts: when a user connects an advertising or messaging account (for example Google Ads or Meta), we receive the data that the user authorises, such as account and campaign names, spend, clicks and conversions.
- Enquiry data: what you send us through forms on sentrace.online.
Data we receive from Google
When a user connects a Google Ads account, SenTrace asks for the Google Ads scope (manage your AdWords campaigns) through Google sign-in. We use this access only to:
- read the account's campaigns, ad groups, ads, spend and performance, so the business can see which ad brought each enquiry and sale;
- upload offline conversions (confirmed visits and revenue, matched by the Google click identifier) to the account, when the user has set this up;
- check the account's set-up (customer ID, auto-tagging, conversion actions) during connection.
We store the access and refresh tokens encrypted and use them only for the connected business. We do not use Google user data for advertising, do not sell it, and do not use it to train general artificial-intelligence or machine-learning models. Users can disconnect at any time in SenTrace (Connections) or at myaccount.google.com/permissions.
SenTrace's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Data we receive from Meta
When a user connects a Facebook or Instagram ad account, SenTrace asks Meta (Facebook Login) for permission to read the ad account (ads_read), to list the ad accounts and pixels in the user's Business portfolio (business_management) and to list the Facebook Pages the user manages (pages_show_list). We use this access only to:
- read the account's campaigns, ad sets and ads, their delivery status, budgets, dates, spend and results, and the account's pixels, so the business can see which ad brought each enquiry, booking and sale;
- let the user confirm the right ad account, pixel and Page for the business when connecting;
- run a read-only audit of the ad account (for example tracking missing from ads, or spend on low-intent placements).
SenTrace does not create, change or delete ads, budgets or audiences. When a business chooses to send confirmed results back to Meta (the Conversions API), it does so with a dataset token the business creates in Meta Events Manager, and only events about its own customers are sent, hashed as Meta requires.
We store the access token encrypted and use it only for the connected business. Data from Meta is shown only to that business and the agency it has invited, is not sold, is not used for advertising, and is not used to train general artificial-intelligence or machine-learning models. When a business disconnects Meta, or 30 days after an account is closed, we delete the token and the ad data read from Meta. Users can disconnect at any time in SenTrace (Connections) or in Facebook at Settings & privacy → Settings → Business integrations, and can ask us to delete their data as described on our data deletion page.
How we use personal data
- to provide the portal: inbox, contacts, bookings, campaigns, reports, growth plans and attribution of sales to ads;
- to send messages and e-mails the business asks SenTrace to send, and service e-mails to users;
- to produce analysis and drafts with AI services on the business's instructions;
- to keep the service secure, prevent misuse and fix problems;
- to meet legal obligations.
Who we share it with
We do not sell personal data. We share it only with:
- the agency or business the data belongs to, and the people they give access to (including view-only share links they create);
- service providers that run parts of SenTrace for us, under contract: hosting, e-mail delivery, AI model providers, search and website-data providers, and the messaging and advertising platforms the user connects;
- authorities where the law requires it.
Some providers process data outside Malaysia. Where that happens we rely on their contractual and security commitments.
How long we keep it
We keep data while the agency or business account is active and as long as needed for the purposes above. Consent and attribution records are kept as an unchanged history. When an account closes, or a business asks us to, we delete or anonymise its data within a reasonable time, unless the law requires us to keep it.
Security
Data is sent over encrypted connections (HTTPS). Connection tokens and secrets are stored encrypted. Access inside SenTrace is limited by role, and actions are logged.
Your choices and rights
You may ask to access or correct your personal data, withdraw consent or ask us to stop processing it. If your data is held by a business that uses SenTrace, please contact that business first; we will help them respond. You can opt out of marketing messages from a business by replying STOP or as the message explains.
Contact
Questions or requests about privacy: gkliang@gmail.com.
Changes
We may update this policy. The date at the top shows the latest version; important changes are announced in the portal.