Measure with
clear boundaries.

Who is responsible

The website customer decides the purposes and lawful basis for its visitor analytics and integrations. Synthia processes that data on the customer’s documented instructions. Synthia separately acts as a controller for Zijra account administration, account billing, service security and support correspondence.

Synthia’s business correspondence address is 157 Joyner Field, CM18 7QB, United Kingdom.

Applicable contracts, transfer safeguards and backup arrangements still need review. This notice does not replace an executed data processing agreement. You can request a DPA and read our processing information.

What a website collects

The tracker records page paths, event names, owner-provided event properties, referring pages, campaign tags, browser/device information and active session time. Coarse country, region and city are used only when trusted deployment metadata supplies them. Missing locations remain unknown. The analytics tables do not store raw visitor IP addresses. Hosting providers may process request IP addresses and browser headers, and crawler verification can use addresses transiently. The tracker does not record screen replay or form inputs, or infer religion. Website owners must keep personal or sensitive information out of paths, event names and properties unless their disclosed purpose and lawful basis cover that processing.

Consent and identity

The default tracker does not create a persistent cross-visit visitor identifier. The absence of cookies does not automatically create an EU consent exemption. The website customer must assess the applicable privacy and device-access rules and establish a lawful basis for its processing. Zijra requires valid visitor consent before optional attribution identity is stored in localStorage, visits are linked, or an identify call supplies a user ID, name, image or profile properties.

The same consent requirement applies to the visitor links and consent flags supplied in payment-provider or backend metadata. A flag alone is not evidence that valid consent was obtained. Customers must maintain the notice, consent records and withdrawal controls for their integration. Linked visits, profile IDs and Stripe or other payment references are personal or pseudonymous data; replacing a name with an identifier does not make them anonymous.

Withdrawal and its limits

Withdrawing consent clears browser identity on a best-effort basis and requests erasure of the linked visitor history. Server erasure depends on that request being delivered and accepted. Page navigation, a closed browser or network failures can prevent delivery despite limited retries. Contact the website owner if the request could not be completed.

An accepted request removes the stored raw visitor history and visitor links on payment records. A site-scoped hashed withdrawal marker remains until the website is deleted to prevent reuse of the withdrawn identifier. The marker is pseudonymous data. A later consent creates a fresh consent context; customers must also remove or update their own provider and backend identity metadata.

Financial amounts and provider references remain separate records. Previous daily summaries can remain, and prior exports, screenshots or downloaded reports cannot be recalled. These boundaries do not turn retained financial records into anonymous data.

Payment and provider data

Authorized integrations read provider activity to verify orders, captured payments, refunds and supported subscription transitions. Test and live receipts are kept separate. Unmatched revenue remains unattributed. Provider secrets are encrypted and stored on the server; they are excluded from exports, public reports and browser responses. OAuth and public report access can be revoked.

A money-only import without a visitor link is not anonymous: a merchant can still resolve transaction or customer references to people using its provider account. Such imports need their own lawful basis, purpose and retention assessment. Zijra account billing is separate from a customer’s merchant analytics; Stripe can have processor and independent controller roles under its applicable terms.

Retention and deletion

New Free workspaces keep six months of detailed website activity. Paid plans keep up to 13 months of detail. Completed days can then remain as daily totals and dimension counts within the plan’s reporting window: three years for Founder and five years for Growth, Studio and Scale. Owners can select shorter retention in website settings.

Valid saved legacy retention settings remain effective until changed. Earlier defaults were 90 days of raw activity and 12 months of daily aggregates; these are not the defaults for new workspaces. The maintenance worker archives expired completed days before erasing raw activity and expires older aggregates. Its operation is required to enforce expiry. Daily totals cannot reconstruct individual journeys or deduplicate visitors across days.

Financial receipts and provider references have a separate retention boundary from raw website activity. Provider source records, infrastructure logs, support mail and backups follow their own retention arrangements. Backup expiry, restoration safeguards and any mandatory financial retention must be documented in the applicable agreement; this page does not promise a fixed backup-deletion deadline.

Owners and administrators can prepare a private website export. Export files expire after 24 hours, with temporary download links valid for five minutes. Account deletion requires your current password and email confirmation, removes workspaces you own and their stored activity, secrets and grants, and cancels Zijra test subscriptions. Workspaces with live billing require support review before deletion so subscription and financial records remain available. Memberships in other people’s workspaces are removed while those workspaces remain.

Account and email

Supabase authentication uses session cookies to keep your workspace signed in. Resend handles account messages and reviewed team invitations when configured. Scheduled email reports are not available in the current public release. Delivery history distinguishes queued, accepted, delivered, failed and uncertain messages. Delivered status requires a verified provider receipt; acceptance alone does not prove inbox delivery.

Service providers and international processing

Supabase provides the current core database, authentication and private storage in London, United Kingdom. Vercel hosts the application with the current production function configuration in iad1, United States, alongside global content delivery and international support and operations. Resend stores email data in the United States. Stripe operates globally for billing and authorized payment integrations. Hostinger receives public support mail; its mailbox processing region has not yet been confirmed.

London database hosting does not mean that all processing stays in the UK or EU. Provider purposes, data categories, locations and official agreement sources are listed in our provider inventory. Applicable contracts and international transfer safeguards must be checked for the actual accounts and services used; provider links do not establish that a specific agreement has been executed.

Personal data breaches

If Synthia becomes aware of a personal data breach affecting data processed for a customer, we will notify the affected customer without undue delay. We will share known facts, likely effects, available containment measures and a contact, then provide phased updates as further information becomes available. The customer as controller separately assesses its notification duties: where required, notification to the regulator is without undue delay and, where feasible, within 72 hours of the controller becoming aware. This is separate from our notification to the customer.

Your rights and contact

For visitor activity collected by another website, contact that website owner first. Synthia assists customers with requests concerning data processed on their instructions. Depending on the applicable law, rights can include access, correction, erasure, restriction, objection, portability and withdrawal of consent. You can also raise a complaint with the relevant data protection authority.

For your Zijra account, privacy questions or help routing a request, contact Synthia at support@ummahsignal.com. We may need to verify your identity or authority before acting. The remaining commercial agreement details are still being completed.