DataFirefly Server-Side

DataFirefly Server-Side delivers complete, reliable WooCommerce conversion tracking with a single connection key:

• Full funnel — page view, product view, add to cart, initiate checkout, add payment info, purchase.
• Dual delivery, deduplicated — every event fires a light client pixel (Meta / GA4 / TikTok) and a signed server-side event sharing the same event id, so ad blockers never cost you a conversion and nothing is ever counted twice.
• Per-destination control — enable or disable the Meta, GA4 and TikTok client tags individually. A disabled destination’s third-party script (and its cookies) is never loaded in your visitors’ browsers.
• Consent-first (GDPR) — with “Require consent” on (the default), nothing fires and nothing is sent — client-side or server-side — until the visitor explicitly grants marketing consent (DataFirefly Cookie Consent, WP Consent API, Complianz, Cookiebot, IAB TCF v2). This includes the server-side purchase event: the consent decision is captured at checkout and enforced even when the purchase confirmation arrives later from a payment gateway.
• Reliable — failed sends are queued and retried with exponential backoff; an Activity panel shows delivery status live.
• Secure by design — no destination credential ever reaches the browser; the HMAC secret never leaves the server; the public beacon endpoint is rate-limited, size-capped and strictly sanitized; purchase events are server-authoritative and cannot be spoofed.

This plugin is the WooCommerce connector for the DataFirefly server-side tracking service. It requires a DataFirefly account (https://datafirefly.com), and no data is ever transmitted anywhere until the shop administrator explicitly connects the plugin with their account’s connection key. See the “External services” section below for full details of what is sent, when, and to whom.

External services

This plugin relies on the following external services. No data is sent to any of them until the shop administrator explicitly connects the plugin to a DataFirefly account, and — when the “Require consent” setting is enabled (the default) — no visitor data is sent unless that visitor has explicitly granted marketing consent.

1. DataFirefly server-side tracking dispatcher (the service this plugin connects to)

• What it is and what it is used for: DataFirefly is the tracking service this plugin is a connector for. The dispatcher (https://serverside.datafirefly.com) receives your shop’s e-commerce events, signs them and forwards them server-side to the advertising/analytics destinations configured in your DataFirefly account (Meta Conversions API, Google Analytics 4 Measurement Protocol, TikTok Events API).
• What data is sent and when: after the administrator connects the plugin, e-commerce events are sent to the dispatcher — funnel events (page view, product view, add to cart, checkout) carrying pseudonymous browser identifiers (cookie ids such as _fbp, _ga, click ids), page URL, IP address and user agent; and the purchase event carrying order data (order id, amount, currency, products) and the customer’s billing details (email, phone, name, city, postcode, country). When “Require consent” is enabled, none of this is sent for a visitor who has not granted marketing consent.
• Service provider: DataFirefly Limited — Terms and Conditions — Privacy Policy

2. Meta (Facebook) Pixel

• What it is and what it is used for: when the Meta destination is configured in your DataFirefly account and enabled in the plugin settings, the plugin loads the Meta Pixel script in the visitor’s browser to record client-side ad events (deduplicated with the server-side events).
• What data is sent and when: the script is loaded from https://connect.facebook.net and, once loaded, Meta receives the standard pixel data (page URL, browser information, event data, Meta cookies) — only after marketing consent is granted when “Require consent” is enabled, and never if the destination is disabled.
• Service provider: Meta Platforms — Terms of Service — Privacy Policy

3. Google Analytics 4 (gtag.js)

• What it is and what it is used for: when the GA4 destination is configured and enabled, the plugin loads Google’s gtag.js script in the visitor’s browser to record client-side analytics events (deduplicated with the server-side events).
• What data is sent and when: the script is loaded from https://www.googletagmanager.com and, once loaded, Google receives the standard GA4 data (page URL, browser information, event data, Google cookies) — only after marketing consent is granted when “Require consent” is enabled, and never if the destination is disabled.
• Service provider: Google — Terms of Service — Privacy Policy

4. TikTok Pixel

• What it is and what it is used for: when the TikTok destination is configured and enabled, the plugin loads the TikTok Pixel script in the visitor’s browser to record client-side ad events (deduplicated with the server-side events).
• What data is sent and when: the script is loaded from https://analytics.tiktok.com and, once loaded, TikTok receives the standard pixel data (page URL, browser information, event data, TikTok cookies) — only after marketing consent is granted when “Require consent” is enabled, and never if the destination is disabled.
• Service provider: TikTok — Terms of Service — Privacy Policy