Legitimate Interests Assessment: Conversion Attribution

Assessment date: 8 September 2026 · Review date: 8 September 2027

This assessment explains why Subnet Calc may process limited advertising-referral information to measure signups and purchases. It should be read with our Privacy Policy and Sub-processor List.

What We Process

When a visitor arrives through a supported advertising link, we may record the advertising source, click identifier, capture time, campaign parameters, landing path, and the account, checkout, or purchase identifiers needed to connect the referral to an outcome.

The customer frontend first holds this information in memory. We do not use a marketing cookie or localStorage for this purpose. If a person signs up or signs in, the referral may be linked to their account for up to 90 days. Derived campaign and conversion fields may be retained with the related financial record for reporting, audit, fraud prevention, dispute handling, or legal obligations. Raw click identifiers are deleted or irreversibly suppressed from the account-linked record after 90 days unless a documented exception applies.

Purpose and Lawful Basis

Our legitimate interests are to measure which advertising referrals produce genuine signups and purchases, attribute advertising spend to revenue, detect low-quality traffic, and improve campaign and budget decisions. The processing relies on GDPR Article 6(1)(f), legitimate interests.

The processing is necessary because browser-only conversion tags cannot reliably record purchases when visitors decline optional cookies, block trackers, clear browser data, or complete a purchase on another device. The data is limited to what is needed for referral measurement and is not used to decide access to the Service or to infer special-category characteristics.

Safeguards

  • Account-linked attribution is limited to 90 days.
  • Only known attribution fields are accepted; values are length-limited and control characters are removed.
  • Google Ads receives only fields needed for offline conversion matching and revenue measurement. We do not upload email addresses, passwords, authentication tokens, or payment-card data.
  • GA4 cookies and behavioural events remain behind Cookiebot consent and are separate from the server-side revenue record.
  • Google's role for this processing is determined under the applicable Google Ads service terms, which incorporate appropriate international-transfer safeguards.

Rights and Review

You may request access, rectification, erasure, restriction, or object to this processing through our support page. We will assess objections promptly and stop this processing unless we can demonstrate compelling legitimate grounds or need the information for legal claims.

This assessment does not approve future Reddit, Meta, or LinkedIn sharing, and any persistent browser-storage implementation requires a separate consent and Cookie Policy review.

Approval

Controller / product owner: Ross Mason, approved 8 September 2026

Next review: 8 September 2027, or sooner if the processing, vendors, retention period, or advertising channels change.