Privacy policy

Last updated: November 10, 2026

PaidEcho sends Stripe Payment Link sales to Meta's Conversions API and can send one abandoned-checkout reminder. This policy describes what we collect, why, and how long we keep it. It is written for the live service at paidecho.com.

Who we are

PaidEcho is an independent tool operated from the United States. It is not a Stripe or Meta product. Contact us at the address below.

What we collect

When you create an account we store:

• The business name you enter and your settings (for example, whether reminders are on).
• Your Meta Pixel / Dataset ID.
• Your Meta Conversions API token, Stripe webhook signing secret, and (if you paste one) a Stripe restricted key. These are encrypted at rest with a server key we hold. We never ask for a full Stripe secret key, and the app rejects keys that start with sk_.
• A dashboard token, stored only as a hash, so we can recognize it later without keeping the original.

When someone visits a page that loads our script, we store a random visitor ID, Meta click cookies (fbc and fbp) if present, that visitor's IP address and browser user-agent, UTM parameters, and the landing URL. We use this to match a later Stripe checkout to the ad click.

When Stripe sends us a checkout event we store the event id, session id, payment status, amount, currency, and campaign/ad parameters. We do not store raw buyer emails or phone numbers for advertising. Buyer email, phone, and similar fields are hashed with SHA-256 before they are sent to Meta. For a reminder email we use the email address Stripe provides, send at most one message, and keep only a hash of that email so we do not remind the same person twice and can honor an unsubscribe.

Why we use this data

• To run the service you signed up for: forwarding purchases to Meta, showing you a 30-day sales-by-campaign view, and sending one reminder if you turned that on.
• To keep the service secure (verifying Stripe signatures, encrypting tokens, rejecting invalid input).
• To operate the website and, when billing is turned on, to bill you through Stripe.

Who we share data with

We do not sell personal data. We share data only as needed to run the product:

• Cloudflare, which hosts the website, Worker, and database.
• Meta, which receives Conversions API purchase events you asked us to send (including hashed buyer details and click IDs).
• Stripe, which sends us checkout webhooks from your account and, once subscription billing is live, will process payments for PaidEcho.
• If you enable reminder emails and we have connected a sending provider, that provider (for example Resend) will receive the shopper's email address and the message content in order to deliver that one email. Reminder sending is not connected on day one; until it is, reminders are logged only and are not delivered.

We may also disclose information if required by law.

Cookies and similar data

Our site script stores a random visitor ID in the browser (typically in localStorage) and reads Meta cookies if your page already set them. We do not use advertising cookies on paidecho.com itself.

Retention and deletion

Account tokens and settings are kept until you ask us to delete the account, or until we close an abandoned account. Event and visitor records are kept so we can de-duplicate purchases, show the 30-day campaign view, and honor reminder/unsubscribe rules. A self-serve account-delete button is not available yet. Email support and we will delete your account data, including stored tokens, and stop forwarding events.

Your choices

You can turn off reminder emails in your setup, and shoppers can unsubscribe from a reminder with the one-click link in that email. You can request a copy or deletion of the account data we hold by emailing us. Access is currently invite-only.

Security and international processing

Tokens are encrypted at rest. The service runs on Cloudflare's network, so data may be processed in the United States and in other countries where Cloudflare operates. No method of transmission or storage is perfectly secure.

Children

PaidEcho is for businesses running online checkout. It is not directed at children under 13, and we do not knowingly collect data from them.

Changes

If we change this policy in a material way, we will update this page and the date above. Continued use of the service after a change means you accept the updated policy.

Questions: support@paidecho.com.