Privacy Policy

Zenovay ("Zenovay", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website zenovay.com (the "Site") and use our analytics platform and related services (the "Services"). This Privacy Policy describes what personal data Zenovay processes and how. Where Zenovay processes visitor data on behalf of website operators, Zenovay acts as the data processor and the website operator is the data controller. For data processed about you directly as a Zenovay account holder, Zenovay acts as the data controller. Depending on your location, the applicable data protection framework may include Regulation (EU) 2016/679 (GDPR), the UK GDPR (as retained by the Data Protection Act 2018), and the Swiss Federal Act on Data Protection (revFADP/nDSG).

Please read this Privacy Policy carefully. It describes our data practices; it is not a contract and does not create rights beyond those applicable law gives you. You confirm that you have read it when you create your account, and by accessing or using the Services you acknowledge it in any event. If you have questions, please contact us at [email protected]. [email protected].

Information We Collect

We collect information about you in various ways when you use our Services. The information we collect falls into the following categories:

Information You Provide Directly

We collect information that you provide directly to us, including:

• Account Information: When you create an account, we collect your name, email address, company name, and password.
• Payment Information: When you subscribe to a paid plan, our payment processor (Stripe) collects your payment card information, billing address, and related payment details. We do not store complete payment card numbers on our servers.
• Profile Information: You may choose to provide additional information such as your job title, phone number, profile picture, and company website.
• Communications: When you contact our support team or communicate with us, we collect the content of your messages, support tickets, and any attachments you send.
• Survey Responses: If you participate in surveys or provide feedback, we collect your responses and any personal information you choose to share.
• Authentication Credentials: If you choose to register a passkey or WebAuthn credential, we store a credential ID and public key associated with your authenticator device. We do not store private keys or biometric data. These credentials are deleted when your account is closed.

Support Communications

When you contact our support team or use our AI support assistant:

• Chat History: We store chat conversations so that support has the history of your issue and so we can review and improve the quality of our support. We do not use them to train or fine-tune any AI model. Chat transcripts are retained for up to 2 years and then deleted.
• Support Tickets: Ticket content and metadata are retained for 2 years after the ticket is resolved or closed and then deleted; attachments are deleted earlier, as described below.
• Project Access: If a workspace owner or admin grants support access on a support ticket, an authorized member of the Zenovay support team may open that workspace dashboard in read-only mode to diagnose and resolve the issue. This covers the workspace projects, analytics, configurations, and activity, and may include information about other members of the workspace. Support cannot modify your data in this mode. Access is opened through a single-use link, is time-limited and expires automatically, can be revoked at any time from your security settings, and every access is logged. The log of that access is retained for accountability and is available to a workspace owner on request at [email protected]; it is not shown in your workspace activity log by default.
• AI Processing: Your support messages may be processed by AI models operated by OpenAI, routed through Cloudflare AI Gateway, in order to suggest answers and categorise issues. To answer usefully, the request typically includes your message together with your name, email address, plan and the websites on your account. You can ask for a human at any time.
• Attachments: Files you attach to a support ticket (screenshots, logs, etc.) are stored securely and deleted 90 days after the ticket is resolved or closed. Files you share in the help center chat are deleted 90 days after the upload.
• Ask Zenovay Attachments: Files you attach to a question in Ask Zenovay (the in-app AI assistant) are kept for 30 days so the conversation can refer to them, and are then deleted. The conversation itself stays in your account until you delete it or your account.

Information Collected Automatically

When you access or use our Services, we automatically collect certain information, including:

• Usage Data: We collect information about your use of our Services, including the pages you view, features you use, links you click, searches you perform, and the date and time of your visits.
• Device Information: We collect information about the devices you use to access our Services, including device type, operating system, browser type and version, screen resolution, IP address, unique device identifiers, and mobile network information.
• Location Data: We derive approximate location (country, region, city) from your IP address using the geolocation providers listed on our Subprocessors page, in order to provide region-specific features and to meet local requirements. We do not collect GPS or other precise location data.
• Cookies and Similar Technologies: We use strictly necessary cookies for security and authentication. Our own analytics on zenovay.com starts in Cookieless Mode and sets its first-party analytics cookies only if you allow them in our cookie banner. See our Cookie Policy for the full list.
• Cookies and Similar Technologies: We use strictly necessary cookies for security and authentication. Our own analytics on zenovay.com starts in Cookieless Mode and sets its first-party analytics cookies only if you allow them in our cookie banner. See our Cookie Policy for the full list. See our Cookie Policy for more details.

Cookies and Local Storage

The following table describes the cookies and local storage items used by our Services:

Information From Third Parties

We may receive information about you from third-party sources, including:

• Authentication Services: If you sign up or log in using a third-party service (Google OAuth, GitHub OAuth), we receive basic profile information from that service.
• Data Enrichment Services: We may use third-party data enrichment services to enhance analytics insights for business intelligence purposes.
• Bot Protection: Cloudflare Turnstile may be used to verify that interactions are from legitimate users.

Analytics Data We Process on Behalf of Customers

As an analytics platform, we process data about visitors to our customers' websites on their behalf. This section describes the data we collect and process when you visit a website that uses Zenovay analytics. Our customers (the website operators) are the data controllers for this data, and we act as their data processor.

Visitor Data Collected

When you visit a website using Zenovay analytics, we may collect:

• Network Information: IP address, approximate geographic location (country, region, city)
• Device Information: Device type, browser, operating system, screen resolution, viewport dimensions
• Page Information: URLs visited, page titles, referrer URLs, time spent on pages
• Behavioral Data: Scroll depth, click counts, form interactions, engagement time
• Campaign Data: UTM parameters and advertising platform click identifiers (e.g., Google, Facebook, TikTok)
• Conversion Data: Custom conversion events, goal completions, and associated values as defined by the website operator
• Session Information: Session duration, pages viewed per session, returning visitor status

Automated Decision-Making and Profiling

Two different things get called automated decision-making, and it matters which one is meant. The first is visitor value scoring. Our Services calculate a score between 0 and 100 for visitors to our customers' websites, from signals such as approximate location, device type, browsing behaviour and session characteristics. The calculation runs automatically, and the score is shown to the website operator so that it can prioritise its own follow-up. Zenovay itself takes no action on the basis of that score: it does not block, restrict or price anything. Where a website operator uses the score to make a decision about a person, that operator is the controller for that decision, and rights in respect of it are exercised against the operator, not against Zenovay.

The second is our own abuse and security controls. To protect the platform, Zenovay scores signup attempts and request patterns automatically, and an account or an IP address can be blocked or suspended automatically when a threshold is crossed, before any person has looked at it. Zenovay is the controller for that processing. If your account or your access has been restricted by one of these controls, you can:

• Ask us why the restriction was applied and what kind of signals led to it
• Put your point of view to us and contest the restriction
• Ask a person at Zenovay to review the decision and reverse it if it was wrong

To use any of these, contact . Article 22 GDPR and Article 21 of the Swiss Federal Act on Data Protection give you these rights where a decision is based solely on automated processing and has legal effects for you or similarly significantly affects you. We offer the same route whether or not your case reaches that threshold, because we would rather look at it than argue about it. [email protected].

Optional Analytics Features

Website operators may enable additional features that collect more detailed data:

• Session Replay: Off unless a website operator switches it on. When it is on, we record how a visitor interacted with the page: mouse movement, clicks, scrolling, and the page as it was rendered. Input fields are masked by default, and password and payment-card fields are blocked from capture altogether. Text that the page itself displays is recorded as displayed unless the operator turns on text masking, so an operator whose pages show personal data will have that data inside the recording. Recordings are sampled rather than exhaustive.
• Heatmaps: Aggregated visualisation of where visitors click and scroll, together with the text of the element clicked. The background image behind a heatmap is not taken from a visitor's screen: it is a fresh server-side screenshot of the public page, rendered without any visitor's cookies or session.
• User Identification: Website operators may choose to associate analytics data with user identifiers (name, email, company) that they provide to us through their implementation.
• Business Intelligence: We infer the organisation behind a visit from network information, using the third-party enrichment providers listed on our Subprocessors page. This runs by default rather than on request, and is suppressed for visitors sending a Global Privacy Control signal. It identifies organisations, not individuals.
• AI-Powered Insights: Analytics data may be processed through AI models provided by OpenAI (via Cloudflare AI Gateway) to generate automated insights and recommendations for website operators.

IP Address Handling

We process IP addresses to determine approximate geographic location and for security purposes. Your IP address is:

• Used in its plain form first, because it has to be: it is what resolves the approximate location, applies rate limits and detects abuse. It is then converted into a daily-salted SHA-256 hash, and it is that hash, not the address, which is written to the analytics database.
• Retained only in hashed form, according to the data retention period configured by the website operator (see Data Retention section)
• Sent to the geolocation providers listed on our Subprocessors page so that the approximate location can be resolved, and, where company identification applies, to the company-identification provider. It is not shared with anyone else
• Also used for B2B company identification, which infers the organisation behind a visit from network information. This runs on visits to our customers' websites by default and is suppressed when the visitor's browser sends a Global Privacy Control signal. The identifier it stores is a hash of the address that does not rotate daily, so company-level visits can be correlated over time

First-Party Tracking

Some customers may configure Zenovay to operate through their own domain (first-party tracking). In this configuration:

• Analytics requests appear to originate from the customer's domain rather than Zenovay's domain
• This changes how ad-blockers and browser tracking-protection features interact with the tracking, which is usually why an operator chooses it. In this configuration the tracker does not act on the legacy Do Not Track browser setting; the Global Privacy Control signal is always honoured, in this configuration as in every other
• The customer is responsible for disclosing this practice in their own privacy policy

How We Use Your Information

We use the information we collect for various purposes, including:

• Provide and Maintain Services: To create and manage your account, process transactions, provide customer support, and deliver the features and functionality of our Services.
• Improve and Develop Services: To understand how users interact with our Services, identify trends, diagnose technical issues, and develop new features and improvements.
• Communicate With You: To send you service-related notifications, respond to your inquiries, provide customer support, and send marketing communications (with your consent).
• Personalization: To personalize your experience, provide relevant content and recommendations, and remember your preferences.
• Security and Fraud Prevention: To detect, prevent, and respond to fraud, abuse, security risks, and technical issues.
• Legal Compliance: To comply with legal obligations, respond to legal requests, enforce our terms and policies, and protect our rights and the rights of others.
• Analytics and Research: To conduct research, create statistical and aggregated data, and analyze usage patterns to improve our Services.
• Marketing and Advertising: To send you promotional materials and measure the effectiveness of our marketing campaigns (with your consent where required).

Legal Basis for Processing

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, our legal basis for collecting and using your information depends on the specific processing activity:

How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

Service Providers

We share information with third-party service providers who perform services on our behalf, including:

• Cloud Infrastructure: Cloudflare for edge computing, content delivery, and security services
• Payment Processing: Stripe for processing payments and managing subscriptions
• Email Services: Resend for transactional email delivery
• Geolocation: Mapbox for map visualization and geographic data
• Geolocation Fallback: IPwho.is for IP geolocation lookups when primary service is unavailable
• AI Services: OpenAI for AI-powered analytics insights (optional feature)
• AI Routing: Cloudflare AI Gateway for AI model routing and caching
• Authentication: Google OAuth for social sign-in
• Authentication: GitHub (Microsoft) OAuth for social sign-in
• Bot Protection: Cloudflare Turnstile for CAPTCHA and bot protection
• Error Monitoring: Sentry for application error tracking, performance monitoring, and crash reporting. May collect technical data including IP addresses, device information, and request metadata.
• Database Hosting: Oracle Cloud Infrastructure (Zürich, Switzerland) for hosting our primary database (account and authentication data) and its backups since 28 October 2026, and website visitor analytics since 23 October 2026
• File Storage: Backblaze B2 (Amsterdam, Netherlands, EU) for storing uploaded files, session replays and heatmap screenshots since 29 October 2026, and encrypted copies of the nightly database backups since 31 October 2026

These service providers have access to your information only to perform tasks on our behalf and are obligated to protect your information. For a complete list of our subprocessors, please see our Subprocessors page.

Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information is transferred and becomes subject to a different privacy policy.

Legal Requirements and Protection

We may disclose your information if required to do so by law or if we believe such action is necessary to:

• Comply with legal obligations, court orders, or governmental requests
• Enforce our Terms of Service or other agreements
• Protect and defend our rights or property
• Prevent fraud or abuse of our Services
• Protect the safety of our users or the public

Data Security

We implement appropriate technical and organizational security measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL
• Encryption of sensitive data at rest
• Periodic security reviews leveraging infrastructure provider certifications
• Access controls and authentication requirements
• Access to systems holding personal data limited to the operator and to personnel expressly authorised by the operator, each bound by a duty of confidentiality
• Incident response and breach notification procedures

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Data Breach Notification

What we owe on a personal data breach depends on the role we hold. Where we process visitor data on behalf of a customer we are the processor: we notify that customer without undue delay after becoming aware of the breach, and the customer, as controller, decides on any notification to an authority or to the individuals concerned. Where we are the controller, which is the case for account, billing and support data, we will:

• Notify the competent authority. Where the GDPR or the UK GDPR applies, that is the competent supervisory authority, without undue delay and, where feasible, within 72 hours of becoming aware of the breach, under Article 33 GDPR. Where Swiss law applies, that is the Federal Data Protection and Information Commissioner (FDPIC/EDOEB), as soon as possible, and only where the breach is likely to result in a high risk to the data subject's personality or fundamental rights, under Article 24 of the Swiss Federal Act on Data Protection. Swiss law sets no 72-hour deadline; we state the two rules separately because they are not the same rule
• Communicate the breach to affected individuals without undue delay where it is likely to result in a high risk to their rights and freedoms, under Article 34 GDPR, and where it is needed for their protection or the FDPIC asks us to, under Article 24(4) of the Swiss Federal Act on Data Protection
• Document all breaches, including facts, effects, and remedial actions taken

Data Protection Impact Assessment

Where processing is likely to result in a high risk to individuals, applicable law requires a data protection impact assessment before that processing begins. For processing we carry out as controller, making that assessment is our responsibility. For visitor analytics we act as processor, and the assessment belongs to the website operator, which decides what to collect and which features to switch on - in particular session replay, user identification and B2B company identification. We will provide the information reasonably needed for such an assessment on request at [email protected].

Data Retention

We retain your information for as long as necessary to provide our Services, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods depend on the type of information:

Account Data

• Account Information: Kept while your account exists. If nobody signs in to or uses an account for more than 4 months and it does not belong to a workspace on a paid plan, we send a warning email to the account's address and delete the account 21 days later, with a final reminder 3 days before the deletion, unless someone signs in before then; the deletion then works exactly like deleting the account yourself, and we send a confirmation email. Deleting your account deletes it: the deletion runs immediately, is permanent and cannot be reversed, and we do not hold a copy for a grace period. If a deletion was a mistake, contact [email protected] within 7 days and we may be able to recover it from a backup, though we cannot promise that. Audit-log entries recording administrative actions are kept for up to 24 months with hashed identifiers only
• Payment Records: Retained for 7 years to comply with tax and accounting requirements
• Communications: Support tickets and communications retained for 2 years
• Logs and Security Data: Abuse and security-signal records are kept for 90 days. Account audit logs are kept for 24 months. Infrastructure logs held by our hosting provider are subject to that provider's own retention

Analytics Data

Analytics data (visitor records, page views, and behavioral data) is retained based on your subscription tier:

• Free Plan: 1 year (365 days)
• Pro Plan: 2 years (730 days)
• Scale Plan: 4 years (1,460 days)
• Enterprise Plan: Custom retention period as agreed

Session replay recordings and heatmap data are premium features with their own, much shorter retention: 60 days on Pro, 120 days on Scale and 180 days on Enterprise. They are deleted on that schedule regardless of the analytics retention period above.

Data Retention Lifecycle

When data passes your plan's retention period, it goes through three stages, so that nothing disappears without warning:

• Phase 1 - Soft Hide (Day 0): Data older than your retention period is hidden from analytics views but remains in our systems. Your current analytics continue working normally.
• Phase 2 - Grace Period (30 days): You receive email notifications about the hidden data. During this period, you can upgrade your plan to recover the data.
• Phase 3 - Permanent Deletion (Day 30+): After the grace period, hidden data is permanently deleted and cannot be recovered.

If you downgrade to a lower tier, any data exceeding your new plan's retention period will immediately enter Phase 1 (soft hide), giving you 30 days to upgrade and recover your data.

Aggregated daily statistics follow the same retention lifecycle as your plan. You can request deletion of your information at any time by contacting us or deleting your account through the Services.

International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have data protection laws that are different from the laws of your country.

When we transfer personal information from the EEA, UK, or Switzerland to other countries, we use appropriate safeguards, including:

• EU-US Data Privacy Framework (DPF): Where our service providers are certified under the EU-US DPF, we rely on this framework as a valid transfer mechanism.
• Swiss-US Data Privacy Framework: For transfers from Switzerland, we rely on the Swiss-US DPF where applicable.
• Standard Contractual Clauses (SCCs): We use European Commission-approved Standard Contractual Clauses as a fallback transfer mechanism.
• Data Minimisation: Providers established outside the EEA receive only the categories of data needed for the specific function they perform, as set out for each provider on our Subprocessors page.
• Adequacy Decisions: Where applicable, we rely on adequacy decisions by the European Commission.
• Supplementary Measures: We implement additional technical measures including encryption in transit and at rest, access controls, and data minimization to supplement transfer safeguards.

Your Rights and Choices

Depending on where you are, you may have the rights below. One point decides where to send a request. For your Zenovay account we are the controller, so bring it to us. For data collected about you as a visitor to a website that uses Zenovay, the operator of that website is the controller: it decides what is collected and why, and it is the party that can act on your request. We assist that operator in responding, and if you come to us first we will point you to them, but we cannot decide the outcome on their behalf.

Access and Portability

You have the right to access your personal information and request a copy in a portable, machine-readable format.

Correction

You have the right to correct inaccurate or incomplete personal information. You can update most information through your account settings.

Deletion

You have the right to request deletion of your personal information, subject to certain exceptions (e.g., legal obligations, legitimate business purposes).

Objection and Restriction

You have the right to object to certain processing of your information or request that we restrict processing in certain circumstances.

Withdraw Consent

Where we process your information based on consent, you have the right to withdraw consent at any time.

Opt-Out of Marketing

You can opt out of marketing communications by clicking the "unsubscribe" link in our emails or updating your communication preferences in your account settings.

California Privacy Rights (CPRA)

If you are a California resident, you have rights under the California Privacy Rights Act (CPRA, formerly CCPA):

• Right to Know: You have the right to request information about the personal information we collect, use, and disclose about you.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: You have the right to opt out of the "sale" or "sharing" of your personal information. Zenovay does not sell personal information and does not share it for cross-context behavioural advertising, so there is no sale or sharing to opt out of. If you would like an opt-out recorded anyway, send a Global Privacy Control signal from your browser, which we honour automatically, or email [email protected].
• Right to Limit Use of Sensitive Information: You have the right to limit our use of sensitive personal information to purposes necessary to provide the Services.
• Right to Non-Discrimination: You have the right not to receive discriminatory treatment for exercising your privacy rights.

Global Privacy Control (GPC): we honour it, and no website operator can switch it off. When our script sees that your browser is sending GPC, it stops before it collects anything: no page view is sent, no identifier is generated, and no session replay, heatmap or enrichment runs. We treat the signal as a valid opt-out request under the CCPA/CPRA, and nothing further is needed from you.

To exercise these rights, contact [email protected]. Two practical points. First, where a request concerns data we hold about you as a visitor to one of our customers' websites, Zenovay acts as that customer's service provider and does not use that data for its own purposes; we will route the request to the business responsible for it. Second, before acting on a request we need to be satisfied that it comes from you, so we may ask for information sufficient to match you to the data we hold, and we do not collect additional data for verification beyond what is necessary. An authorised agent may submit a request on your behalf with written permission we can verify, and we may still contact you to confirm it. [email protected].

European, UK, and Swiss Privacy Rights (GDPR, UK GDPR, and nDSG)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR), the UK GDPR (as retained by the Data Protection Act 2018), and the Swiss Federal Act on Data Protection (nDSG), as well as other applicable data protection laws.

• Right of access to your personal information
• Right to rectification of inaccurate information
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent
• Right not to be subject to solely automated decision-making
• Right to lodge a complaint with a supervisory authority, including the Swiss Federal Data Protection and Information Commissioner (EDOEB) for Swiss residents or the competent EU Data Protection Authority for EU residents
• For UK residents, the relevant supervisory authority is the Information Commissioner's Office (ICO) at ico.org.uk

To exercise these rights or if you have questions about our data processing, please contact us at [email protected].

Children's Privacy

The Services are not directed to children. As a matter of our own service rules, you must be at least 16 years old to register a Zenovay account if you are in the European Economic Area, the United Kingdom or Switzerland, and at least 13 years old in the United States. We set the 16-year threshold ourselves: Swiss data protection law does not fix a general minimum age for using an online service, and in the EEA Article 8 GDPR lets each Member State set the age for a child's own consent to information-society services anywhere between 13 and 16. The United States figure follows COPPA. We do not knowingly collect personal information from anyone below these ages. If you believe we have, contact us at [email protected] and we will delete it.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last update" date at the top of this page
• Notify you via email or through a prominent notice in our Services
• Obtain your consent if required by applicable law

We encourage you to review this Privacy Policy periodically.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: