Documentation Privacy and security

Using Dealroot in line with the GDPR

Consent, retention, data subject requests and your privacy policy.

Dealroot is built so that you can use it in line with the GDPR and similar laws. You stay the controller of your visitors’ data; it is stored in your own WordPress database. This page lists what to set up. It is no legal advice: whether you need consent and what your privacy policy has to say depends on your site, so ask your data protection officer or legal advisor if unsure.

Campaign tracking with cookies usually needs prior consent in the EU and the UK. Under Leads → Settings → Tracking, let Dealroot wait for consent through the WP Consent API or your own consent tool. See Cookie consent.

With Dealroot Pro, visitors who refused marketing cookies are not reported to Meta, and their email address and phone number are not sent to Google Ads or Microsoft Advertising.

2. Retention

Under Leads → Settings → Privacy, enter after how many days Delete leads after removes them, for example 365. Older leads are deleted automatically; 0 keeps them.

Visits and form starts are counted only as anonymous daily totals, which identify nobody.

3. Requests from people

Dealroot works with the WordPress tools under Tools → Export Personal Data and Tools → Erase Personal Data. A request for an email address includes all leads with that address. Conversions still waiting for an erased lead are not sent; data already sent to an ad platform or CRM has to be deleted there.

4. Privacy policy

Dealroot suggests text under Settings → Privacy → Policy guide: the cookies, the reporting to ad platforms if you use Pro, the CRM if you connect one, and notifications to Slack or Microsoft Teams. Adapt it to your site and add it to your privacy policy.

5. Agreements

When you report conversions, the ad platforms receive data about your leads. Accept their terms for this in your ad accounts, for example the customer data terms in Google Ads for enhanced conversions. For HubSpot and Pipedrive, their data processing agreements apply. For Dealroot Cloud, see Dealroot Cloud and your data.

What helps by design

  • No data goes to Dealroot unless you use Dealroot Pro, and then no lead data is stored there.
  • Email addresses and phone numbers are hashed with SHA-256 on your site before an ad platform receives them.
  • Fonts, scripts and the tracking itself are served from your site; Dealroot loads nothing from other services.
  • Access tokens are stored encrypted.