01 / Scope and services
This Privacy Policy explains how Valerii Voinovskyi, operating under the EffDes Agency brand, handles information through the EffDes Agency website and UTM Contact Attribution for Wix, including the optional Google Ads and Meta connections, business enquiries, first-party EffDes Insights subscriptions, the separate Brevo checklist subscription, support and privacy requests.
02 / Website information we process
Agency enquiries include the name, work email and business challenge submitted through the form, plus any optional company or website, desired result, timeframe and additional context. The form also records the landing page, referrer, available UTM source, medium, campaign, term and content values, GCLID, submission identifier and submission time.
The first-party EffDes Insights form stores the submitted email address in Cloudflare D1 with a subscriber identifier, source type, canonical source URL, form identifier, server-generated submission time, consent checkbox state, exact consent wording and version, Privacy Policy version, consent method, confirmation status, any applicable confirmation time, unsubscribe status and time, and linked consent-event identifiers. Repeated submissions use a normalized email for deduplication while preserving consent and withdrawal events.
Separately, if a visitor uses a checklist email-subscription form, Brevo processes the email address provided, the visitor's subscription choice, and technical records needed to send and document the double opt-in request and confirmation. The email address is added to the selected subscriber list only after the visitor confirms through the double opt-in email.
The public website uses Google Analytics 4 through Google Tag Manager to measure bounded website interactions only after a visitor grants Analytics consent. Advertising tracking is not enabled through this implementation. Recorded events may include page or content views, product views, calls-to-action, and UTM Builder start and completion, together with bounded page paths, content or product identifiers, content clusters, CTA locations, and destination categories or paths. The approved event payload does not include arbitrary UTM Builder input or raw user-entered URLs, and the implementation is not intentionally configured to send names, email addresses, phone numbers, Wix Contact IDs, customer IDs, consent choices, confirmation status or form contents to Google Analytics 4. Normal hosting and security operations may separately process technical request data such as an IP address and browser or request metadata.
03 / How website information is used
Website information is used to understand and respond to Agency enquiries, preserve relevant enquiry context, secure and troubleshoot the website, respond to support and privacy requests, maintain necessary business records and meet applicable legal obligations.
The first-party EffDes Insights form uses Single Opt-in with an unchecked consent checkbox. When a visitor submits the form, completes the security verification and gives the stated consent, the address becomes an active subscriber without a separate email-confirmation step. EffDes stores the status SINGLE_OPT_IN_RECORDED together with the linked consent event and uses those records to document the request and consent, administer subscription and withdrawal status, prevent repeated automated submissions, and send the described EffDes news, practical Wix marketing tips and occasional product offers. The status is not Double Opt-in confirmation.
Brevo is used separately to manage requested checklist subscriptions, send double opt-in confirmation messages, deliver the requested checklist and, only where the subscriber has confirmed the subscription, send the occasional practical marketing messages described beside that form.
EffDes does not sell enquiry or subscriber information or use it to build an unrelated contact database. Email addresses collected from public websites or other public sources are not automatically treated as subscribers.
04 / UTM Contact Attribution information and use
The application processes available campaign context: utm_source, utm_medium, utm_campaign, utm_term, utm_content and gclid. Landing and referrer URLs are minimized. The Cloudflare Worker receives consent-eligible attribution snapshots and supported Wix event information, correlates available records, and stores Customer Actions, attribution details and related technical records in Cloudflare D1.
Supported Forms, Chats, Bookings and Orders may be associated with Wix contacts, action dates, attribution details and manually reviewed Results. First Touch, Last Touch and Conversion Touch help a business review the campaign context associated with each customer action. One contact can have multiple actions with separate attribution records. When a corresponding Wix contact can be resolved, the application can link to that contact and use Wix CRM for native CRM Notes. The dashboard provides search, filters, attribution details, native Wix CRM Notes and Open Contact.
05 / Google Ads and Meta connections (optional)
These connections are optional and are off until a Site Owner sets them up. Each Site Owner connects only their own Google Ads account and their own Meta dataset. Nothing is sent to an advertising platform until the Site Owner has connected it, turned on automatic delivery and entered a confirmed sale.
What is sent. For a sale that the Site Owner marked as ordered and confirmed, and only when the visitor gave advertising consent in the site's consent settings, the application sends the sale value, its currency, the sale date and time and a sale identifier. To Google Ads it also sends the Google click identifier (GCLID) captured on the site. To Meta it also sends the Meta click identifier, and the buyer's email address and phone number when the contact has them; email and phone are normalized and hashed with SHA-256 before they leave the application. The application does not send names, other contact fields, form contents or customer notes. The sale value is entered by the Site Owner or their team; the application does not read it from Wix orders.
Google. The Site Owner signs in with Google and approves one permission, https://www.googleapis.com/, which allows uploading conversions through the Google Data Manager API. The application does not read campaigns, audiences, reports or any other Google account data. We store an OAuth refresh token for the installation, encrypted with AES-256-GCM and bound to that installation, together with the selected Google Ads account and conversion action IDs and the delivery status. Short-lived access tokens are obtained when needed and are not stored. The use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the conversion upload the Site Owner requested; we do not sell it, share it for other purposes, use it for advertising to the user, use it to train models, or allow people to read it except where needed for security, to comply with law or with the user's consent.
Meta. The Site Owner pastes a Conversions API access token and the dataset (pixel) ID created in their own Meta Events Manager. The token is stored encrypted with AES-256-GCM and bound to the installation, together with the dataset ID and the delivery settings and status. It is used only to send the Site Owner's confirmed sales to that dataset. Meta cannot withdraw an event after it is sent; use Meta's own tools for requests about data Meta already holds.
Stopping and removing the connection. The Site Owner can click Disconnect in the application at any time: the stored token and the background delivery job for that installation are deleted. For Google, the application also asks Google to revoke the authorization when no other installation of the application holds a Google connection; the Site Owner can always revoke access in their Google Account permissions (myaccount.google.com/permissions). A Meta Conversions API token created by the Site Owner stays valid in Meta until the Site Owner revokes it in Events Manager. EffDes can also pause delivery to either platform without deleting any stored data, for example during an incident; delivery resumes when the pause is lifted.
Where it is processed. The Worker that holds these credentials and sends the data runs on Cloudflare, and the requests go directly from the application to Google and to Meta. The sale records themselves are stored in the application's data on the Site Owner's Wix site.
06 / Browser attribution and consent
Advertising attribution is consent gated and depends on the site's consent configuration and available browser context. Browser restrictions, missing campaign parameters and consent choices can limit attribution. Attribution snapshots carry a 90-day server-side eligibility period for attribution lookback. A separate 30-minute correlation window may be used to connect a supported action with available event information. These are processing windows, not a general retention period for Customer Actions, Results or technical records.
The current production application does not promise that a later browser consent withdrawal immediately invalidates attribution evidence already received by the server. Changing or withdrawing consent can limit future browser capture according to the site's consent controls and available delivery, but previously stored application records are not represented as automatically or immediately deleted. A privacy or deletion request can also be made through the contact below.
The website stores the visitor’s Analytics or Essential-only preference locally in the browser. Google Tag Manager and Google Analytics 4 load only after Analytics consent is granted; if Analytics consent is denied, this analytics implementation does not load or transmit events. Advertising storage, advertising user data, and advertising personalization remain denied. After Analytics consent, Google Analytics 4 may use cookies and technical identifiers as part of its service.
07 / Storage and infrastructure
UTM Contact Attribution uses a Cloudflare Worker and a separate Cloudflare D1 database. D1 stores attribution snapshots, Customer Actions, manually reviewed Results when present, and related correlation, webhook, Chat and operational records. The Worker receives browser attribution and supported Wix event information, performs the available correlation and serves the application's data workflows.
Wix remains the source of supported Wix events and corresponding contacts. When contact resolution is available, the application associates the Customer Action with the Wix Contact and uses Wix CRM for contact access and native CRM Notes. Wix CRM is not the exclusive store for the application's attribution snapshots or Customer Actions.
Separately, Cloudflare Pages serves the EffDes website, Agency enquiry endpoint and first-party newsletter endpoints; the website D1 database stores submitted Agency enquiries, first-party newsletter subscriber records and their separate consent-event history. The website database was created with an Eastern Europe location hint, which optimizes placement but is not a legal data-residency restriction. No particular storage country is promised for the application's separate D1 database.
No third-party email-delivery service is currently connected to the first-party EffDes Insights form. If one is later used, this policy will identify the service and the applicable processing before that delivery flow is enabled.
Separately, Brevo provides the checklist subscription-management and email-delivery service. The checklist form is delivered from Brevo infrastructure, and the submitted email address, subscription choice, confirmation status and necessary technical confirmation records are processed in the connected Brevo account. The first-party EffDes Insights form does not send its records to Brevo.
Google Analytics 4 receives only the bounded, consented website-interaction payload described above and is not configured through this implementation to receive Agency enquiry submissions, newsletter or checklist email addresses, subscription choices, confirmation status or UTM Builder input.
08 / Data sharing
For customer attribution data processed for a Wix site, the Site Owner determines the purposes and means of processing and acts as controller where those roles apply. EffDes provides the application's attribution processing on the Site Owner's instructions and acts as processor for that processing. Cloudflare processes Worker and D1 data as EffDes's service provider and subprocessor. Wix processes supported Forms, Bookings, Orders, Inbox, CRM Contact and CRM Note information under its agreement with the Site Owner. This Privacy Policy does not itself constitute or confirm execution of a separate data processing agreement between a Site Owner and EffDes.
EffDes acts as controller for its own administrative data, including application installation and account identifiers, service administration, entitlement, security and abuse-prevention records, and support communications. Wix and Cloudflare may process parts of that administrative data as service providers, while each provider may separately determine purposes for its own account, platform, security and legal-compliance processing under its terms.
The application exchanges the information needed for supported event handling, contact resolution and CRM Notes between its Cloudflare processing and Wix services. Cloudflare also processes website information to provide hosting, request handling, security, Agency enquiry storage and first-party newsletter storage.
Brevo processes only the separate checklist subscription and email-delivery information described above under Brevo's applicable service terms and data-processing terms. Information may also be disclosed when required by law or valid legal process, to protect rights and service security, or in connection with a business reorganization subject to appropriate safeguards.
If a Site Owner connects Google Ads or Meta, the data described in the Google Ads and Meta connections section is sent to that platform on the Site Owner’s instruction, to the Site Owner’s own account, and is then handled by that platform under its own terms and privacy policy. EffDes does not send it to any other recipient.
EffDes does not authorize service providers to use enquiry or subscriber information for their own unrelated marketing.
When Analytics consent is granted, Google processes the bounded website analytics data described above through Google Tag Manager and Google Analytics 4 according to Google’s applicable terms and privacy framework.
09 / Security
EffDes uses technical and organizational measures intended to protect information against unauthorized access, alteration, disclosure and loss. Measures are selected according to the nature of the information and service. No internet service or storage system can be guaranteed completely secure.
10 / Retention and uninstalling
Agency enquiries and related attribution data are retained only for as long as reasonably necessary to respond to the enquiry, maintain relevant business records, resolve disputes and meet applicable legal obligations. Retention may vary depending on the nature of the enquiry and any resulting business relationship.
First-party EffDes Insights subscriber records and consent-event history are retained only for as long as reasonably necessary to administer the subscription, document the consent or withdrawal, honor unsubscribe choices, resolve disputes and meet applicable legal obligations. A withdrawal may require retaining a limited suppression and consent record so that the choice remains effective. Deletion can be requested through the privacy contact below; the request may be subject to identity verification and records that must be retained for a legal or suppression purpose.
Checklist subscription information and confirmation records are retained separately for as long as reasonably necessary to administer an active subscription, document consent, honor unsubscribe or suppression choices, resolve disputes and meet applicable legal obligations. The period may vary according to the record and the connected Brevo account configuration; this policy does not promise a fixed period. A subscriber can unsubscribe from marketing emails using the unsubscribe option included with those messages.
Attribution snapshots carry an expiry value 90 days after capture for the application's attribution lookback. The expiry controls eligibility; it is not represented as automatically deleting the row. The 30-minute correlation window is also not a data-retention period.
Apart from the connection credentials described above, Current Production does not have a confirmed general automatic deletion mechanism for Customer Actions, Results, webhook receipts, correlation state, Chat or other operational records, tenant records or uninstall data. No fixed product deletion schedule is promised for those records. Cloudflare may separately retain technical logs and database recovery history under the active service configuration and provider terms.
When Wix reports that the application was removed from a site, the application deletes the stored Google and Meta connection credentials for that installation and stops its background delivery job. If that report is not received, the same deletion is made when Wix repeatedly confirms that the installation no longer exists. A connection made after a removal is not affected by an earlier removal report. Disconnecting inside the application deletes the same credentials immediately.
Uninstalling does not by itself delete the application’s other records: Customer Actions, attribution snapshots and related technical records in Cloudflare D1, and related Wix CRM Notes, may remain after uninstalling or reinstalling, and sale records stored in the application’s data on the Site Owner’s Wix site remain under that site’s control. To ask about retained application data or request deletion, contact support@effdes.agency. Privacy requests are handled within the time limits required by applicable law; the absence of an automated deletion mechanism for these records or a separate product deletion SLA does not limit statutory rights or response deadlines.
11 / Privacy requests
Depending on location and applicable law, individuals may have rights to request access, correction, deletion, restriction, objection, portability or withdrawal of consent.
A visitor can use the Wix site's available consent controls to change or withdraw the relevant choice. In the current production application, a browser withdrawal is not represented as guaranteed immediate server-side invalidation or deletion of attribution evidence that was already received. The visitor can also contact the Wix site operator or support@effdes.agency about the affected application records.
First-party EffDes Insights subscribers can withdraw consent through their individual unsubscribe link or by contacting support@effdes.agency. Checklist subscribers can use the unsubscribe option in a marketing email. Unsubscribing may require EffDes or the applicable service provider to retain a limited suppression record so that the choice continues to be honored.
Website, subscription and application privacy requests can be sent to support@effdes.agency. Include enough context to identify the affected service without sending passwords or unnecessary personal information. Identity and authority may need to be verified before a request is completed. Visitors can also contact the business operating the Wix site about its use of their information.
12 / International processing
The operator is based in Kyiv, Ukraine. Cloudflare operates a global network, so website requests, UTM Contact Attribution Worker and D1 processing, and related technical metadata may be processed outside Ukraine and the visitor's country. The application's Cloudflare D1 database has no configured jurisdiction restriction, and this policy does not promise a particular storage country.
Cloudflare publishes a Data Processing Addendum that includes transfer mechanisms for applicable restricted transfers. This policy does not state that a separate Cloudflare DPA or Standard Contractual Clauses package has been executed for the specific account without documentary confirmation.
Wix publishes a Data Processing Addendum for Users-of-Users information that describes the Site Owner as controller and Wix as processor and sets out transfer mechanisms for applicable international transfers. Its application follows the Site Owner's agreement with Wix. This policy does not promise a particular storage country for Wix data.
When a Site Owner connects Google Ads or Meta, the data described above is transmitted to Google or Meta, which process it according to their own terms and may do so in other countries. This policy does not promise a particular storage country for that data.
Checklist subscription information is transmitted to and processed through Brevo and its applicable subprocessors as configured for the connected service. Brevo's applicable data-processing terms govern restricted international transfers where required. This policy does not promise a particular storage country for Brevo data.
13 / Children
UTM Contact Attribution is a business tool intended for Wix site owners and operators and is not designed for use by children as an application user. The application may process information associated with visitors of a Wix site when the site operator uses supported Forms, Chats, Bookings or Orders. The Wix site operator is responsible for configuring its site, consent practices and use of visitor information in accordance with applicable requirements.
14 / Policy changes
This policy may be updated when the services, processing practices or legal requirements change. The effective date will be revised, and material changes will be communicated through an appropriate service or account channel when required.
15 / Contact
Privacy requests can be started through support@effdes.agency.
UTM Contact Attribution is operated by Valerii Voinovskyi under the EffDes Agency brand.
49 Heroiv Dnipra Street, Kyiv, 02000, Ukraine