Your data.
Clear responsibilities.

Processing scope

The customer determines its analytics purposes, lawful basis and instructions. Synthia processes customer website data to collect, store, organise, report, export and erase it on those instructions for the service period and applicable retention. The people concerned include website visitors, customer users and contacts, and people identified in authorized payment/provider records.

Data includes page paths, supplied event properties, browser and device details, coarse deployment geography, campaign context, consented identifiers and profiles, and authorized payment or customer references. Linked visits and payment IDs are personal or pseudonymous data. Money-only imports remain personal where a merchant can resolve the references. The tracker does not record form inputs or screen replay, or infer religion. Analytics tables omit raw visitor IP addresses; hosting and trusted crawler verification can process request addresses.

Synthia separately acts as a controller for Zijra accounts, account billing, service security and support. Customer website analytics and Zijra’s own billing are separate purposes. Customers must obtain valid consent before optional localStorage identity, identify or attribution linking, including consent-based visitor links supplied through provider or backend metadata, and assess the lawful basis and device-access rules for their other tracking.

Instructions, confidentiality and security

Workspace owners and administrators configure tracking, retention, integrations, exports and sharing. Website allowlists and scoped permissions limit access. Provider credentials stay encrypted on the server. Public links expose only their selected aggregate metrics and can expire or be revoked.

The executed DPA must limit processing to documented instructions, with any legally required exception explained as permitted by law. It must cover personnel confidentiality, appropriate security measures, authorized subprocessors and change notices, and a way to raise objections. Current product controls do not establish a certification or replace that contract.

Assistance, audit and end of service

The executed agreement must describe assistance with individual rights requests, security incidents, impact assessments and regulator consultations as applicable. It must provide information and an audit or inspection process for demonstrating the processor’s obligations. The methods, timings and safeguards for that assistance must be agreed in the executed DPA.

At the end of processing, it must provide for the customer’s choice to return or delete personal data and existing copies, subject to applicable legal retention duties. Backup handling, restoration restrictions and deletion cycles still require agreement. These points form part of the Article 28 contract requirements.

Retention, export and erasure

New Free workspaces keep six months of detailed website activity. Paid plans keep up to 13 months of detail. Completed days can then remain as daily totals and dimension counts within the plan’s reporting window: three years for Founder and five years for Growth, Studio and Scale. Owners can select shorter retention in website settings.

Valid saved legacy retention settings remain effective until changed. Earlier defaults were 90 days of raw activity and 12 months of daily aggregates; these are not the defaults for new workspaces. The maintenance worker archives expired completed days before erasing raw activity and expires older aggregates. Its operation is required to enforce expiry. Daily totals cannot reconstruct individual journeys or deduplicate visitors across days.

Financial receipts and provider references have a separate retention boundary from raw website activity. Provider source records, infrastructure logs, support mail and backups follow their own retention arrangements. Backup expiry, restoration safeguards and any mandatory financial retention must be documented in the applicable agreement; this page does not promise a fixed backup-deletion deadline.

Owners can prepare private exports, revoke grants and request account deletion. Visitor withdrawal needs a delivered and accepted request to erase server history; a hashed withdrawal marker remains until website deletion. Financial amounts and provider references, earlier daily summaries and previously downloaded material have separate limits. The privacy notice explains these boundaries and failed-delivery risks. Account deletion with live billing requires support review.

Service providers and processing locations

This inventory uses provider brands. The exact contracting entity, applicable plan and executed agreement must be checked for each service. Official provider documents are linked as sources; a link is not evidence that a particular DPA has been executed.

Optional merchant, search, marketing and repository connections read the account the owner authorizes. These providers retain their own source records and permissions. London core hosting does not keep all processing in the UK or EU. Applicable transfer mechanisms, including any required EU standard contractual clauses and UK transfer terms, need review against the actual contracts and data flows; none is established merely by listing a provider.

Personal data breach notification

If Synthia becomes aware of a personal data breach affecting data processed for a customer, we will notify the affected customer without undue delay. We will share known facts, likely effects, available containment measures and a contact, then provide phased updates as further information becomes available. The customer as controller separately assesses its notification duties: where required, notification to the regulator is without undue delay and, where feasible, within 72 hours of the controller becoming aware. This is separate from our notification to the customer.

Commercial agreement checkpoint

Synthia is the operator and support@ummahsignal.com is the contact for a DPA request. Applicable vendor agreements, transfer assessment, backup handling and customer-specific instructions still need completion or review. This processing-information page does not claim those contracts have been executed or that the service has a compliance certification. Request and review an executed DPA before relying on it for your processing.

Request a DPA