Privacy Policy

Last updated: August 4, 2026

1. Information we collect

When you use our lead generation and management services through Meta Lead Ads (Facebook/Instagram), web forms on our widget, or by registering an account, we may collect the following information:

Personal data: Full name, email address, phone number
Form data: Information you voluntarily provide through lead forms on Facebook, Instagram, or our widget
Interaction data: Information about how you interact with our ads, forms, and website
Account data: Username, email, and password hash when you create an account
Technical data: IP address, browser type, device type, operating system, language, and pages visited
Advertising identifiers: Cookie identifiers used for marketing attribution such as _fbp, _fbc, GA4 client ID, and GCLID

2. How we use your information

We use the information we collect to:

Process and manage leads generated through Meta Lead Ads and web forms
Integrate leads with our CRM systems (Kommo, GoHighLevel)
Send conversion events to Meta, Google Analytics 4, and Google Ads to measure and optimize advertising campaigns
Provide, operate, and improve our services and user experience
Process subscription payments through Stripe
Attribute referrals to partners through our referral program
Prevent fraud, abuse, and illegal activity, and to protect the integrity of the platform
Comply with legal and regulatory obligations

3. Legal bases for processing

Consent: when you accept our marketing/analytics cookies and when you submit your data through forms.
Legitimate interest: for the operation and improvement of the service, fraud prevention, and security.
Legal obligation: when necessary to comply with the law.
Contract performance: when you use the platform as a registered customer.

4. Cookies and tracking technologies

We use cookies and similar technologies for the following purposes:

Strictly necessary: for the basic functioning of the site (e.g., session management). These do not require consent.
Analytics: Google Analytics 4 (_ga, _ga_* cookies) to understand site usage.
Marketing: Meta Pixel (_fbp, _fbc cookies) and Google Ads (GCLID) to measure and optimize advertising conversions.
Referrals: the "crm_ref_code" cookie to attribute signups to referral partners.

You can manage or reject analytics and marketing cookies through our consent banner, or by configuring your browser. We use Google Consent Mode v2, which respects your choices: if you reject marketing and analytics cookies, tags adapt their behavior and no advertising or analytics cookies are set until you provide consent. If you reject these cookies, we will still provide the service, but advertising campaigns may be measured less accurately.

5. Sharing information with third parties

We may share your information with:

Meta Platforms (Facebook/Instagram): for campaign measurement and optimization through their Conversions API (CAPI). Data is transmitted encrypted and in accordance with Meta's terms.
Google (Analytics 4 and Google Ads): for web analytics and advertising conversion measurement.
Stripe: for processing subscription payments. We do not store credit card data; payments are processed within Stripe's PCI-DSS environment.
Infrastructure and email providers: hosting, email delivery, and CRM (Kommo/GoHighLevel) according to your configuration.

We do not sell, rent, or exchange your personal data with third parties for unrelated commercial purposes. We only share the data strictly necessary to operate the service or when required by law.

5.1 Sub-processors table

The following providers act as data processors (sub-processors) on behalf of Pugn. Public links to their privacy policies:

Sub-processor	Service / Purpose	Country	Privacy policy
Stripe	Payment and subscription processing (PCI-DSS)	USA	stripe.com/privacy
Meta Platforms (Facebook/Instagram)	Conversions API (CAPI) for campaign measurement	USA	facebook.com/privacy/policy
Google (Analytics 4, Google Ads)	Web analytics and conversion measurement	USA	policies.google.com/privacy
Kommo (AmoCRM)	CRM for lead and contact management	International	kommo.com/legal/privacy/
GoHighLevel	CRM / marketing automation	USA	gohighlevel.com privacy
Mailgun	Transactional email delivery	USA	mailgun.com/privacy-policy
Deepgram	Voice transcription (chat and assistants)	USA	deepgram.com/privacy
Cloudflare	CDN and infrastructure protection	USA	cloudflare.com/privacypolicy

The list of sub-processors may be updated periodically. Any relevant addition or change will be notified through this notice and via the usual contact channels.

6. International transfers

Your data may be processed on servers located in different countries (including the United States and the European Union), by us or by service providers. In such cases we apply appropriate safeguards, such as standard contractual clauses or other equivalent mechanisms, to protect your information.

7. Data retention

Leads and contacts: retained while there is an active business relationship or as required by applicable law.
Technical records: event logs are retained for limited periods (typically 30 to 90 days) and are automatically cleaned up.
Cancelled accounts: data is retained for up to 30 days after cancellation before deletion, unless legal obligations require longer retention.
Consent records: records of your privacy, terms and cookies decisions (including date, version, IP and agent) are retained for 24 months after account closure or, as applicable, after withdrawal of your consent, as evidence of legal compliance. Once that period ends, they are automatically and permanently deleted.

8. Your rights

Depending on your jurisdiction, you may exercise the following rights:

Access: know what data we hold about you.
Rectification: correct inaccurate data.
Erasure: request deletion of your data ("right to be forgotten").
Objection: object to processing based on legitimate interest or marketing.
Restriction of processing: request that we restrict the use of your data.
Portability: receive your data in a structured, commonly used format.
Withdrawal of consent: withdraw your consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email support@pugn.io with the subject "Privacy Rights" and include your name and the data to which the request refers. We will respond within a maximum of 30 days. If you reside in the EU, you may also file a complaint with your data protection authority.

9. Minors

Our service is not directed to individuals under 18 years of age and we do not intentionally collect personal data of minors. If we detect that we have collected data from a minor, we will delete it immediately. If you are a parent or guardian and believe your child has provided us with data, please contact us.

10. Information security

We implement appropriate technical and organizational measures to protect your data: encryption in transit (HTTPS/TLS), securely hashed passwords, access controls, rate limiting, and security auditing. However, no method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

11. Changes to this policy

We may update this Privacy Policy periodically. We will post the date of the last update at the top of the page. If we make material changes, we will notify you by email or through a prominent notice on the platform. Continued use of the service after changes constitutes acceptance of the new policy.

12. Contact

For any questions about this policy or the processing of your data: support@pugn.io