What data goes where.

Fictional shop, real sandbox records, Meta test events.

Meta getsA Purchase test event: hashed email, value, an event id from the PayPal capture, the click id, the timeTest events
Google would getAn offline conversion row: click id, time, value, order id; previewed, not sentPreview
Never sentCard data, names, addresses or a raw email addressNever
StoredPayments, refunds, click and lead ids, hashed email, delivery status, invoices, approvalsWorkers KV
Before a real shopExplain what goes to each platform and record the customer's consentNot built
Meta identifiers by lead source
  • Website click: the click id as Meta's fbc, plus the hashed email when there is one.
  • Messenger chat: action_source: business_messaging, messaging_channel: messenger, the page id and the page-scoped user id Meta gave that conversation. That id is sent to Meta as is (Meta does not take it hashed) and is never shown on public pages.
  • Lead form: action_source: system_generated and the lead id Meta issued for the form submission, as Meta's Conversion Leads integration expects.

Meta checks these ids: it accepted a Purchase for a real test lead made with its Lead Ads Testing Tool and refuses made-up ones. The demo's Messenger and lead-form leads have made-up ids, so their events are shown, not sent. These are test events; they do not count toward a real ad campaign.

Storage and retention

Cloudflare Workers KV stores payment and refund records, click ids, Messenger page-scoped ids and Meta lead ids (kept server-side, removed from public pages and APIs), hashed email, event delivery status, invoice records, and approval records. An invoice record can include the lead's raw email so the sandbox invoice can be sent. Payment and invoice records have no automatic deletion date and remain until removed from KV. Rate limit counters expire after two days. Webhook receipt records expire after fourteen days. The email used for a Meta match is hashed before it enters the event.

Consent, before a real shop

Before enabling conversion sharing, explain what data goes to each ad platform and get the shop's required customer consent. Record consent, send events only when consent allows it, provide a way to refuse, and honor a later withdrawal. The demo does not collect or prove real customer consent. This page describes the current demo behavior; the PayPal environment is Sandbox.