Privacy policy

1. Who we are and our role

Zaynforce is a marketing attribution platform. It helps businesses and agencies connect ad spend to signups and revenue by combining website events, ad platform data, and verified payments.

We play two different roles under data protection law. For the personal data of our website visitors, prospects, and account holders, we are the controller: we decide how and why it is used. For the data our customers collect from their own website visitors and send to Zaynforce, we are a processor (or “service provider”): we use it only to provide our service to that customer, under their instructions.

2. Scope of this policy

This policy covers:

• zaynforce.com and its subpages, including demo, contact, and newsletter forms.
• The Zaynforce web app at app.zaynforce.com and our APIs.
• Our tracking SDK and tracked links, as far as our own handling of that data goes.
• Emails and other communications we send you.

It does not cover how our customers use the data they collect. Their own privacy notices apply to that. It also does not cover third-party services you reach through our site, such as Google, Meta, or Stripe, which have their own policies.

3. Information we collect

Information you give us

• Account details: your name, email address, organisation, and role when you create an account or are invited to one.
• Billing details: billing contact and payment information when you subscribe. Stripe processes card details; we never see or store full card numbers.
• Contact and demo requests: your email, phone number, company or app name, and message.
• Newsletter and waitlist sign-ups: your name and email address.
• Support conversations: anything you share when you ask us for help.

Information collected automatically

• Device and browser information such as browser type, operating system, screen size, and language.
• IP address, which we use for security, abuse prevention, and approximate location.
• Pages viewed, links clicked, referring site, and campaign parameters (such as UTM tags and ad click IDs).
• In the app: the features you use and actions you take, recorded in audit logs for security.

Information from connected services

When a customer connects Google Ads or Meta Ads, we receive campaign, ad set, and spend data from those accounts. When a customer connects Stripe, we receive payment webhook events so we can verify revenue. These connections are authorised by the customer through the platform’s own consent screen.

Customer data from our SDK

Customers install our SDK on their websites to capture events such as page views, clicks, signups, and purchases. Depending on how the customer sets it up, this can include a pseudonymous visitor ID, campaign source, ad click IDs, IP address, user agent, and, if the customer chooses to send it, an email address or their own user ID. We process this data as the customer’s processor.

Sensitive data

Zaynforce is not designed for sensitive data such as health, financial account, or government ID information. Customers must not send it to us through the SDK or API.

4. How we use information

• To provide the platform: attribution reports, dashboards, recommendations, and conversion write-back.
• To create and manage accounts, process payments, and provide support.
• To keep the service secure, including detecting fraud, abuse, and bot traffic.
• To understand how the website and product are used so we can improve them.
• To send service emails, such as account, security, and billing notices.
• To send marketing emails you have signed up for. Every one includes an unsubscribe link.
• To meet legal, tax, and accounting obligations and to enforce our terms.

We do not use the data our customers send us for our own marketing, and we do not combine one customer’s visitor data with another’s.

5. Legal bases for processing (EEA, UK, Switzerland)

Where European, UK, or Swiss data protection law applies, we rely on:

• Contract: to provide the service you or your organisation signed up for.
• Legitimate interests: to secure, measure, and improve our service and to market it to businesses, where those interests are not overridden by yours.
• Consent: for marketing emails you sign up for. You can withdraw consent at any time by unsubscribing.
• Legal obligation: where we must keep or disclose data by law.

6. When we share information

• Service providers who help us run Zaynforce, listed in the next section.
• Ad platforms, on the customer’s instruction. When a customer turns on conversion write-back, we send conversion events to that customer’s own Google Ads or Meta Ads account. Emails are SHA-256 hashed before they are sent.
• Within your organisation. People you invite to your workspace, and agencies you grant access to, can see that workspace’s data.
• Business transfers. If Zaynforce is involved in a merger, acquisition, or sale of assets, data may transfer as part of that deal, under this policy.
• Legal reasons. When required by law, or to protect the rights, safety, or property of Zaynforce, our customers, or others.

We do not sell personal data.

7. Service providers

We use a small number of service providers (sub-processors). Each one processes data only as needed to provide its service to us.

8. International data transfers

Our service providers may process data in countries other than the one you live in, including the United States and the European Union.

9. Cookies and similar technologies

On zaynforce.com

• Essential cookies that keep you signed in and keep the site secure.
• A local setting that remembers whether you chose light or dark mode.
• Google Analytics cookies that measure how the site is used.
• Our own attribution tracking, which records which campaign brought you to the site.

When you first visit, a notice tells you that we use cookies. By continuing to use the site, you agree to our use of cookies as described here.

In the SDK our customers use

The SDK stores a random visitor ID and the campaign link you arrived through in your browser’s local storage and a first-party cookie on the customer’s own domain. These identifiers do not contain your name or email. They let the customer see which campaign led to a later signup or purchase. Customers are responsible for getting any consent their visitors are required to give.

Your controls

You can block or delete cookies and local storage in your browser settings. Blocking essential cookies may stop parts of the app from working. You can opt out of Google Analytics with Google’s browser add-on. We do not currently respond to “Do Not Track” signals, because there is no agreed standard for them.

10. Data retention and deletion

• Account data: kept while your account is active, and deleted or anonymised after it is closed, unless we must keep it by law.
• Customer event and attribution data: kept for as long as the customer’s subscription requires, or deleted on request.
• Billing records: kept as long as tax and accounting law requires.
• Contact, demo, and newsletter data: kept until you unsubscribe or ask us to delete it.
• Security and audit logs: kept for a limited period to investigate incidents.

To ask us to delete your data, email hello@zaynforce.com. We may keep some data where the law requires it, or to resolve disputes and enforce our agreements.

11. Security

We protect data with technical and organisational measures, including:

• Encryption in transit (TLS) for all traffic to our site, app, and APIs.
• Strict separation of each customer’s data, with access scoped by organisation and role.
• Signed webhooks and secured, revocable keys for ad platform and payment connections.
• Audit logs of administrative actions.

No system is completely secure, but we work to protect your data.

12. AI features and automated decisions

Zaynforce generates campaign recommendations, such as changing a budget, using rules applied to campaign performance. We may use large language models (LLMs) from third-party AI providers to rank those recommendations and explain them in plain language. Only aggregated campaign metrics, such as spend, conversions, and campaign names, are sent to these models. No visitor-level or personal data is sent, and the AI cannot change the action or amount a rule recommends.

Recommendations are suggestions. Nothing changes in your ad accounts until a person approves it. We do not make automated decisions about individuals that have legal or similarly significant effects.

13. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct data that is inaccurate or incomplete.
• Delete your data.
• Receive a copy of your data in a portable format.
• Object to, or ask us to restrict, certain processing.
• Withdraw consent you have given, at any time.
• Complain to your local data protection authority.

To use any of these rights, email hello@zaynforce.com. We may need to confirm your identity first. If your request is about data a Zaynforce customer collected on their website, we will pass it to that customer, since they control that data.

You can unsubscribe from marketing emails using the link in any email. We will still send essential service messages while you have an account.

14. US state privacy rights

If you live in California or another US state with a consumer privacy law (such as Colorado, Connecticut, Virginia, Utah, or Texas), you have the rights to know, access, correct, and delete your personal information, and to opt out of its sale, sharing for cross-context behavioural advertising, or use for profiling.

In the past 12 months we have collected the categories of personal information described in section 3: identifiers, commercial information, internet activity, approximate location, and professional information. We collect it for the purposes in section 4 and disclose it only as described in section 6. We do not sell personal information or share it for cross-context behavioural advertising, and we do not knowingly do so for anyone under 16.

To make a request, email hello@zaynforce.com. You can use an authorised agent, and we will not treat you differently for using your rights. If we deny your request, you can appeal by replying to our decision.

15. Data processing addendum

Business customers that need a data processing addendum (DPA) for GDPR, UK GDPR, or US state law can request one at hello@zaynforce.com. The DPA sets out how we process customer data as a processor.

16. Children's privacy

Zaynforce is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you think a child has given us personal data, contact us and we will delete it.

17. Third-party links

Our site and app link to other services, such as Google, Meta, and Stripe. We are not responsible for their privacy practices. Read their policies before you share data with them.

18. Changes to this policy

We may update this policy as our product or the law changes. When we do, we will change the effective date at the top.

19. Contact us

For privacy questions, requests, or complaints, email hello@zaynforce.com. Please include “Privacy” in the subject line so it reaches the right person quickly.