Last updated: 5 November 2026
1. What Server Side Connect does
Server Side Connect sends leads from your website, with where they came from, to your CRM or email tool. It then sends to Google Ads what happens to those leads: deals in the stages you choose, and contacts in the lists you choose. This runs through our servers in Google Cloud in the EU (Belgium).
2. Who is responsible for what
- For the data of your website visitors and your contacts, you are the controller and we are the processor. We set this out in the data processing agreement (see Security & Compliance).
- Your own account data with us is covered by the privacy statement.
- You take care of the consent that is needed: for the ad click through your cookie banner, and for Customer Match (audiences) in your CRM or email tool.
3. Access to your tool
You sign in to your tool and give us access. We never ask for your password or an API key. The access details your tool gives us are stored encrypted (Google Cloud KMS) for as long as the connection exists.
| Tool | What we write | What we read |
|---|
| HubSpot | create and update contacts; a group of custom properties “Server Side Connect” | deals (stage, amount, currency, contact), pipelines, lists, and email and phone of list members |
| Mailchimp | contacts in your audience, without a newsletter subscription; custom fields | segments and the email of their members |
| Pipedrive (on request) | create and update persons; custom fields | deals, pipelines, filters, and email and phone of their members |
| Brevo (coming soon) | contacts, on no list; custom attributes | deals, lists, and email and phone of list members |
| Zoho CRM (on request) | create and update leads; custom fields | deals (stage, amount, time of change), the converted lead of a deal (only the ad click), custom views on contacts and the email of their members |
| monday.com (coming soon) | create and update items on the board you choose; custom columns | items and status changes on the boards you choose, the linked contact of a deal and its email, groups as lists |
We never delete anything in your tool. Disconnecting revokes our access in your tool and deletes on our side the access and everything we kept about that connection. Mailchimp has no revoke: remove the app yourself under your installed apps. The fields and contacts in your tool stay.
4. Leads from your website
- When a form is submitted, the lead tag in your server container sends us the contact details your website passes along (such as name, email and phone), the source and the campaign. The ad click (gclid, gbraid, wbraid, fbc) is only included if your visitor gave consent for advertising in your cookie banner.
- Contact details only go on to your tool. They sit briefly in our queue until they have been delivered, and never end up in our database or in log files.
- Leads in your tool: by default we first check whether your own form already created the lead; then we only fill in our fields (ad click, source, lead ID) where they are empty, otherwise we create the lead. That is why we pass a lead on after about two minutes. You can set this per tool, including “write nothing”.
- For each lead we keep a record without contact details: a lead ID, the contact ID in your tool, which kind of ad click there was (not the click itself), the consent status and the source. That is how the dashboard shows you what came in.
5. To Google Ads
- You link your Google Ads account to our manager account (MCC). With that link we create and change, in your account, the conversion actions and Customer Match audiences you choose in the dashboard, and we pass on conversions and audience members. We do not touch campaigns, budgets or other settings.
- Conversions: for each deal that enters a chosen stage, the deal ID, the stage, the amount and currency, the ad click, and the contact's email address and phone number, hashed (SHA-256). Deals without an ad click are not sent. For Zoho CRM we take the ad click of a deal from the lead it was converted from, if needed.
- Finding the ad click again for monday.com: when you convert a lead to a contact in monday, the data we put on the lead can be lost. To still pass the right ad click when a deal is won, for customers who connected monday.com we briefly keep, per lead, the ad click ID (gclid, gbraid or wbraid) and a one-way code made from your account and the lead’s email address with a secret key we manage. We do not store the email address itself here. Only when the visitor consented to advertising. We use it only to find the ad click of a won deal.
- Audiences: email address and phone number of the members of the lists you choose, hashed (SHA-256) before they leave our server. Contacts who indicated in your tool that they do not want personalised ads are not sent.
- We send through the Google Data Manager API. What Google does with it is covered by your terms with Google, including the Customer Match policy.
- You confirm once that your contacts gave consent for Customer Match. We keep when that was and a hash of the email address of the person who confirmed.
6. What we keep and for how long
| Data | Retention |
|---|
| Access to your tool (encrypted) | As long as the connection exists; deleted when you disconnect |
| Contact details of leads | Not kept; only in the queue until they are in your tool |
| Lead record (without contact details) | 365 days |
| Deals sent (deal ID, stage, ad click) | 30 days, to prevent sending twice |
| Members per audience (contact IDs from your tool, no email) | As long as the list is selected and the connection exists, so contacts who leave your list also leave the audience |
| Email addresses and hashes for Google | Not kept |
| Ad click per lead for monday.com (click ID and one-way code, no email) | 90 days; deleted immediately when you disconnect monday.com |
| Stage per deal at first connection (deal ID and stage, so old deals do not count as new conversions) | As long as the connection exists; deleted when you disconnect, at the latest after 400 days without change |
| Counters (numbers per day) | No personal data |
7. Cancelling
If you cancel the add-on, we stop sending anything to your tool or to Google. Conversions and audiences already in Google Ads stay there; you remove them yourself in Google Ads. If no other add-on uses the link with our manager account, we remove it. If you also want us to delete the access to your tool, disconnect your tool.
8. Who processes the data
- Google Cloud (Google Ireland Ltd): hosting of our servers and database, in the EU (Belgium).
- Google Ads: receives the conversions and audiences in your own Google Ads account.
- Your tool (HubSpot, Mailchimp, Pipedrive or Brevo): you are their customer; we only write and read what is listed above.
Server Side Connect is built by us, not by Brevo. Brevo has not reviewed, certified or endorsed this app.
9. Questions and your rights
How to exercise your rights and how to reach us is in the privacy statement. A request from one of your visitors or contacts is passed on to you, because you are responsible for it.