Every visit becomes an asset you keep.

A first-party collector on your own domain, one profile per person, and every recovery, review and reactivation feeding back into it. A website builder rents you a site and keeps the signal. Here it compounds, and it’s yours to export any time.

Book a founder callSee BarhaX live
yourstore.com/_eSHA-256 before it leavesServer-side purchases
A representative session

Capture. Resolve. Act. Compound. Then it does it again.

This is the whole moat in one mechanic: the same four-beat loop Home shows in miniature, run down to its real machinery. Every stage below is live in the admin your team actually uses.

Stage 01 of 04yourstore.com/_e

Every visit, on your own domain.

A same-origin path, not a third-party script. Safari ITP keeps the cookie at full lifetime, and there is no tracking subdomain for an ad-blocker to catch. It fires whether the visitor is anonymous or already known.

Grounded onsame-origin collectorfirst-party cookie, full lifetimeno Stape/DNS middleman

A closed tab shouldn't cost you the sale.

Most stores learn about this leak from the ad account's report, not the bank statement. Here's the actual difference between a browser-only pixel and a purchase event that fires from your server.

A browser-only pixel

Payment completes on Razorpay
The confirmation page tries to load the pixel script
Closed tab, or a blocker strips the scriptThe ad account never learns the sale happened, so spend keeps optimising blind on the events it did see.

CharvaX — server-side, always

Payment completes on Razorpay
The webhook lands on your server, independent of the browser or tab
The purchase event fires server-side, tagged with the same event ID your browser pixel would use
Meta, GA4 and TikTok are notifiedSame event ID either way, so a browser pixel that also fires gets deduped rather than double-counted.

Raw identity never leaves your server. The match signal does.

Before any identity data reaches Meta, Google or TikTok, it's hashed. The ad click-ids travel alongside it, so the platform can still match the sale to the ad that earned it.

  1. 01
    Browser event fires
    page_view, add_to_cart or purchase, captured with whatever ad click-ids are present: fbc, fbp, gclid, wbraid, gbraid, ttclid, _ga.
  2. 02
    Lands on your own domain
    The same-origin /_e path ingests it. No third-party subdomain, no DNS hop through a tag-management vendor.
  3. 03
    Identity is hashed, not sent raw
    Email, phone and name are SHA-256-hashed server-side before anything is serialised for delivery. Raw values never leave your database.
  4. 04
    Delivered server-to-server
    Meta CAPI, GA4’s Measurement Protocol and TikTok’s Events API each receive the hash plus the click-ids, but only once a credential is connected. No token, no send.
webhook → collector.dispatch
event → purchase · order RS-10482 · ₹1,258
◆ email → sha256(…) — hashed before serialisation
◆ phone → sha256(…) — hashed before serialisation
◆ name → sha256(…) — hashed before serialisation
◆ click-ids → fbc · fbp · gclid captured
◆ meta_capi → delivered · credential connected
◆ ga4_mp → delivered · credential connected
◆ tiktok_events → not connected · graceful no-op, nothing sent

We say “built for high match quality” on purpose. You won’t find a fabricated EMQ number here, or a “0% loss” claim. What we can promise is the mechanism: hashed identity, real ad click-ids, delivered server-to-server, and a graceful no-op (never a fake send) on any connector without a credential.

This is the actual settings page, not a rendering.

Every element below mirrors the real Marketing & Tracking surface in your admin. Enable the engine once; every ad connector after that adds a destination, never a script.

First-party Tracking Engine

Active

Runs on your own store — no third-party scripts, nothing personal sent in the clear.

Marketing & Tracking

Same-origin path

ITP & ad-blocker resilient

SHA-256 hashed

Identifiers protected

From your webhook

Purchases fire server-side

Email · phone · click-ID

Match signals sent

Meta Conversions APIServer-side · no page-speed cost
Google Analytics 4Server + browser · deduplicated
TikTok Events APIServer-side · no page-speed cost
Pinterest TagLoads in browser

13 connectors across advertising, analytics and search. Enabling one flips a server-side destination row. Only the browser-only ones (a couple of heatmap tools, the legacy pixels) ever touch your storefront’s page speed.

The same feature store fills your dashboards and feeds your crew.

Anonymous or known, every visitor becomes one profile — RFM, predicted CLV, churn and delivery risk, derived, never guessed. These are the exact lists your agents read from.

See the full customer intelligence
BEHAVIOURAL AUDIENCES · 7 DAYSA representative week
Browse-abandoners0
Viewed a product, no purchase, inside the recovery window
feeds → Cart Recovery
Checkout-abandoners0
Began checkout or entered payment, no purchase
feeds → Cart Recovery + retargeting
High-intent anonymous0
Repeat sessions, no identity yet: reachable, never fabricated
feeds → Win-Back + lookalike audiences
Anonymous visitors stay anonymous. They’re reachable through a hashed lookalike audience, never a fabricated identity. Every list here is derived from the same feature store the intelligence dashboards show, and every agent that reads from it cites its evidence.

Yours, in writing.

Storefront code, customer data and the core admin are yours — plus your domain, your memory, and every audience the flywheel builds. A written export guarantee, no lock-in.

BarhaX and the crew are the hosted layer that acts on what the flywheel builds. It’s the subscription, not a cage. Cancel it, and the data you compounded still leaves with you.

Book a founder callSee BarhaX live