Last updated: 17 October 2026
This policy explains what personal data TrackImpact collects, why, who we share it with, how long we keep it, and the rights you have. It covers our website (trackimpact.io), our apps and our services, and the people we contact for business purposes.
Who We Are
TrackImpact is a trading name of Flex Luthor Limited, a company registered in England and Wales (company number 05416368), with its registered office at 10 Albert Road, Bolton, BL1 5HE, United Kingdom. We are the controller of your personal data, except where we process data on behalf of a team or organisation that uses TrackImpact (see "Teams" below).
For any privacy question or request, email support@trackimpact.io.
Information We Collect
When you visit our website
Technical information your browser sends (such as IP address, browser and device type, pages viewed, the page that referred you, and the time of your visit), and how you interact with our pages. If you arrive from a campaign link, we record the campaign that brought you (for example "utm_source=taaft"). See "Cookies, Analytics and Advertising" below for the tools involved and how consent works.
When you create an account or use the service
- Your name, email address and password (passwords are handled by our authentication provider and are never visible to us).
- Profile details you give us, such as job title, department and organisation.
- The records you log in TrackImpact: AI tools you use, tasks, time saved, estimated value, evidence and related notes.
- AI-generated content we create for you, such as AI profiles, recommendations and reports.
Teams
If you join a team, the team's administrator can see your name, email, department, and the adoption and impact metrics you log (for example, what you've logged, hours saved and estimated value). They cannot see your password, and we do not read the prompts or conversations you have in other AI tools. Team reports can anonymise names. Where an organisation connects its OpenAI or Anthropic administrator account to TrackImpact, we import usage data (such as token counts and models used per user) to show AI consumption alongside logged impact. For team data, the organisation that runs the team decides what is collected and why, and we process it on its behalf.
When you buy something
Payments are processed by Stripe. We receive your name, email, billing country, what you bought, the amount, and the status of your subscription. We never see or store your full card details.
When you download a guide, fill in a form or contact us
Your name, email address, phone number, organisation and job title where the form asks for them, and the content of your message. If you email support, we receive your email and its contents.
When you book a call
Bookings are made through Calendly, which collects your name, email and any details you enter. We receive these to hold the call.
TrackImpact Data Partnerships
TrackImpact Data Partnerships is a separate referral service that helps established companies check whether they may be able to license internal records to third-party AI data programmes (currently micro1 and Mode). If you use our fit check, download a data-licensing guide, or submit one of our forms on Facebook or Instagram (Meta Instant Forms), we collect your name, work email, phone number where asked, your company's website, and your answers about the company, such as its industry, number of staff, location, years trading, the types of records it holds and whether it controls the rights to them. When you submit an Instant Form, Meta passes your answers to us, and we receive them through our automation provider, Make.
We use this to email you the guide, the programmes you are likely to qualify for with links to their official applications, and the follow-ups described on the form. We do not pass your details to any programme: if you choose to apply, you do so directly on the programme's own site. The application links contain our referral code, which tells the programme that TrackImpact referred you, and the programme may pay us a referral fee under its own terms. That fee never comes out of any payment to your company. Data Partnerships never receives, stores or handles your company's records, and data from the TrackImpact platform is never used for it.
People we contact for business purposes
We may contact professionals whose work makes TrackImpact relevant to them, such as operations, learning and development, or AI-adoption leads. For this we use business contact information (name, job title, organisation, work email and professional profile) obtained from business data providers, currently Snov.io, or from public professional sources. You can ask us to stop contacting you at any time by replying to any of our emails or writing to the address below.
How We Use Your Information, and Our Legal Basis
Under UK and EU data protection law we must have a legal basis for each use of personal data:
| Purpose | Legal basis |
|---|---|
| Providing your account, the TrackImpact service, team features and reports | Contract (to provide the service you asked for) |
| Taking payments, managing subscriptions and keeping financial records | Contract; legal obligation (tax and accounting) |
| Generating AI profiles, recommendations and summaries | Contract |
| Answering support requests and messages, including triaging support email with AI tools | Legitimate interests (responding to you efficiently) |
| Sending service emails (account, security, billing, team invitations) | Contract |
| Sending product news, guides and follow-ups you signed up for | Consent, or for customers, legitimate interests (similar products). You can unsubscribe in any email. |
| Analytics and advertising cookies and pixels, and the matching server-side conversion events (see below) | Consent, given through our cookie banner |
| Privacy-friendly site measurement that doesn't store anything on your device (see below) | Legitimate interests (understanding and improving our website) |
| Data Partnerships: sending your guide, your matched programmes and the follow-ups you asked for | Consent, given when you submit the form. You can unsubscribe in any email. |
| Business outreach to professionals | Legitimate interests (offering a relevant business service) |
| Preventing fraud and abuse, keeping the service secure | Legitimate interests; legal obligation |
Where we rely on legitimate interests, we have weighed our interests against your rights, and you can object at any time (see "Your Rights").
Cookies, Analytics and Advertising
Our cookie banner (provided by Cookiebot) lets you accept or decline each category, and you can change your choice at any time from the cookie settings link in our footer. Full details of individual cookies are in our Cookie Policy.
- Statistics (consent): Google Analytics 4, to understand how visitors use the site. Without consent, Google Analytics receives only limited, cookieless signals under Google's Consent Mode.
- Marketing (consent): the Meta (Facebook/Instagram) Pixel and TikTok Pixel, to measure and improve our advertising.
- Preferences (consent): our live chat widget (tawk.to).
- Without cookies: PostHog and Microsoft Clarity (product analytics, including recordings of how pages are used) run in cookieless mode, storing nothing on your device, to help us understand how pages are used.
- Campaign attribution: if you consent to statistics or marketing cookies, we store the campaign that first brought you to our site in your browser for up to 30 days, so we can see which campaigns lead to sign-ups. Without consent, nothing is stored; the campaign is only carried within a single visit.
- Embedded content: videos are embedded from YouTube in privacy-enhanced mode, and some guides embed Google Slides. Those providers may receive technical data when the content loads or plays.
Server-side conversion measurement
Some events, such as a page visit, a sign-up, a trial start or a payment, are also reported to our providers directly from our servers, so they're measured accurately. We do this only with the same consent as the matching cookies: if you decline, or haven't chosen, nothing is sent.
- Meta and TikTok (only if you accepted marketing cookies) receive the event type and value, a one-way scrambled (hashed) version of your email address, your IP address and browser type, and any advertising click IDs from the link you arrived on.
- Google Analytics (only if you accepted statistics cookies) receives the first payment when a team trial converts to a paid subscription: the amount, currency, an order reference, the campaign that first brought you, and your Google Analytics identifier, so the payment is linked to your earlier visits. We never send Google your name or email.
Your choice is recorded when you start a checkout, and applies to the events from that purchase. You can change your cookie choices at any time from the cookie settings link in our footer.
Who We Share Your Information With
We do not sell your personal data. We share it only with service providers who process it for us under contract, and only as needed for the purposes above:
| Provider | What for |
|---|---|
| Amazon Web Services | Hosting, databases, sign-in (Cognito) and sending email. Our data is stored in AWS's Ireland and London regions. |
| Stripe | Payments and subscriptions |
| OpenAI, Anthropic | Generating AI profiles, recommendations and summaries, and triaging support email. Under their business API terms, they may not use this data to train their models. |
| Pinecone | Search over profile and AI-tool data |
| Google Analytics, Google Tag Manager, Google Fonts, YouTube and Google Slides embeds, and our support email inbox | |
| Meta, TikTok | Advertising measurement (see above). Meta also passes us the answers you submit in our Instant Forms on Facebook or Instagram. |
| Microsoft (Clarity), PostHog | Website and product analytics |
| HubSpot | Managing leads from guide downloads and contact forms |
| Calendly | Booking calls |
| tawk.to | Live chat |
| Snov.io | Business contact data and outreach email |
| Make | Passing Instant Form leads from Meta to our systems (Data Partnerships) |
| Cookiebot (Usercentrics) | Managing your cookie consent |
We may also disclose information if the law requires it, to protect the rights and safety of TrackImpact, our users or others, or as part of a business sale or restructuring, in which case the buyer would be bound by this policy.
International Transfers
Some of our providers are based in, or access data from, countries outside the UK and European Economic Area, including the United States. When personal data is transferred, we rely on adequacy decisions (such as the UK–US Data Bridge where the provider is certified) or on approved safeguards such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.
AI and Automated Processing
We use AI to generate profiles, recommendations, report summaries and support-email triage. These outputs support you and your team; we do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
Security of Your Information
We protect your data with encryption in transit, access controls and secure hosting. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and will notify you and the regulator of a breach where the law requires it.
Data Retention
We keep personal data only for as long as we need it for the purposes in this policy, and to meet legal obligations, resolve disputes and enforce our agreements.
While you hold a TrackImpact account, we retain the information associated with it, including your profile details, the impact records you log, and any AI profiles generated for you. Removal from a team does not delete this information: your account and its data are independent of any team you belong to and remain available to you after you leave or are removed from a team. Deleting your account, as described under "Your Rights" below, is a separate action.
After you delete your account, certain records may be retained where we are legally required or permitted to keep them, for example billing and transaction records held for tax, accounting and audit purposes, and limited records needed to comply with legal obligations, resolve disputes or prevent abuse. We may also retain information that does not identify you, or aggregated and anonymised data, for analytics and service-improvement purposes.
Leads and business contacts are kept while they remain relevant. If you unsubscribe we stop marketing to you, and if you ask us to delete your details, we will.
Your Rights
Under UK and EU data protection law, you have the right to:
- access the personal data we hold about you;
- correct inaccurate data;
- have your data deleted;
- restrict how we use your data;
- object to our use of your data based on legitimate interests, and to direct marketing at any time;
- receive your data in a portable format;
- withdraw consent at any time (for cookies, through the cookie settings link in our footer; for emails, through the unsubscribe link). This doesn't affect anything we did before you withdrew it.
To exercise any right, email support@trackimpact.io. We will respond within one month. If you are part of a team, some requests about team data may be passed to your organisation.
You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk), or to the data protection authority in your country. We'd appreciate the chance to resolve your concern first.
Deleting Your Account
You can delete your account at any time using the "Delete account" option in your account menu. Deleting your account permanently removes your personal account data from our active systems, including your profile, your logged impact records, and the AI profiles associated with you, and removes you from any team you are a member of. This action is permanent and cannot be undone.
Where you contributed impact records to a team while you were a member of it, those contributions are retained as part of that team's aggregate statistics in an anonymised form that no longer identifies you. Anonymised and aggregated information of this kind is not personal data and is kept so that a team's overall record of its activity remains accurate after a member leaves.
Only you can delete your individual account. A team administrator can remove you from their team, which ends your team membership and frees your seat, but cannot delete your individual account or your personal data. If you are the administrator of a team, you must delete or transfer that team before you can delete your own account.
Following deletion, we retain only the limited information described under "Data Retention" above (such as billing records we are legally required to keep).
Children
TrackImpact is a professional service and is not intended for anyone under 16. We do not knowingly collect personal data from children.
Third-Party Links
Our site links to websites we don't operate. Their privacy practices are their own, so please review their policies.
Changes to This Privacy Policy
We may update this policy from time to time. We'll post the new version on this page with a new "Last updated" date, and where changes are significant, we'll tell account holders by email.