Leadwon Cloud and your data

Google Ads and Microsoft Advertising only let approved applications upload conversions and read costs, with developer credentials that a single website cannot get. Leadwon Cloud holds these credentials and passes your site’s requests on. It runs on our servers in Germany. The free plugin does not use it.

What Leadwon Cloud stores

• Your license and the sites it is active on, with a secret key per site.
• The connection to your Google Ads and Microsoft Advertising accounts: the access granted when you signed in, encrypted, and the account you chose.
• If you use the agency dashboard: the totals your sites report, for up to 90 days, deleted when a site leaves the dashboard.
• A technical log of requests, without their content and without query strings, kept for 14 days.

What it does not store

Leads, names, email addresses, phone numbers and messages are not stored in Leadwon Cloud. To report a conversion to Google Ads or Microsoft Advertising, your site sends the click ID, the conversion action, the time and value and, with enhanced conversions, the email address and phone number hashed with SHA-256 on your site. Leadwon Cloud forwards this to the platform and keeps nothing of it.

What goes elsewhere directly

• Meta: events go from your site to the Meta Conversions API, with your own access token.
• HubSpot and Pipedrive: Leadwon Cloud only handles the sign-in and renews the access. Lead data goes from your site to the CRM directly.
• Slack, Microsoft Teams, Telegram and webhooks: sent from your site to the addresses you entered.

Security

• All connections use HTTPS. Requests from your site are signed with the site’s secret key.
• Access tokens are stored encrypted, on your site and in Leadwon Cloud. On your site, the key is derived from the WordPress salts, or set with LEADWON_PRO_KEY in wp-config.php; if you change the salts, connect the ad accounts again.
• Each site may only use the ad accounts it connected, and only while its license is active.
• Disconnecting a platform on the Ad platforms page revokes the access at the platform.