Security & Privacy

This page is the plain-language summary of how Zenovay handles your data. It is meant to be honest before it is reassuring: we list what we do, what we don't, and the things we don't yet have any right to claim.

If anything below contradicts our Privacy Policy, DPA, or Subprocessors list, the legally binding document wins. We treat divergence between this page and those documents as a bug - please report it.

Where your data lives

Zenovay's primary database (Supabase PostgreSQL) is hosted in the European Union, in the eu-central-1 (Frankfurt) region. That is where visitor analytics and account data live. Cloudflare Workers execute at the edge location closest to the visitor, and Cloudflare KV, R2 object storage and Durable Objects run on Cloudflare's global network, so data handled by those services is not confined to the EU. Data-residency configuration may change as our infrastructure changes; we will update this disclosure when material changes occur.

Most of the subprocessors listed on the Subprocessors page are established in the United States, including Cloudflare, Stripe, Resend and OpenAI, as are the optional OAuth sign-in providers. Our application error monitoring is sent to Sentry's EU region. Transfers to the United States rely on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's 2021 Standard Contractual Clauses together with technical measures such as encryption in transit and data minimisation. The transfer mechanism we rely on for each provider is listed on the Subprocessors page. See the full subprocessor list.

What we collect (and what we don't)

When you add a website to Zenovay, Cookieless Mode is the option already selected for you, so a new site starts cookieless unless you choose the cookie-based mode at that moment. Websites created before this became the default keep whatever mode they were on, and you can check or change the setting per website at any time. In Cookieless Mode the tracker writes no cookies and no localStorage entries on the visitor's device. Zenovay instead derives the visitor and session identifiers on the server from a SHA-256 hash of the visitor's IP subnet (the first three blocks of an IPv4 address, the first three groups of an IPv6 address), the browser's user-agent string, the site ID and a salt that changes every day. Because the salt changes daily, the identifier does not carry across UTC days, and the address itself is not stored alongside it.

If a site operator chooses the cookie-based mode, the tracker sets first-party cookies (zenovay_visitor_id, 30 days by default, and zenovay_session_id, 30 minutes after the last activity) and writes a small number of localStorage entries; the Cookie Policy lists every one of them. Switching a site from cookieless to cookies later only builds cross-day identity from that point forward - it does not reconstruct the past. Zenovay's tracker never collects names, email addresses, payment details or precise GPS coordinates on its own. A site operator can pass identifiers such as name, email or company to us through the optional identify feature; when they do, they are the controller for that data and are responsible for its lawful basis. We do not sell personal information, and we do not share it for cross-context behavioural advertising. We honour the Global Privacy Control (GPC) signal: when a browser sends it, our tracker stops before it collects or sends anything.

For the legal-grade detail of every category, purpose, and legal basis, see the Privacy Policy.

How long we keep it

Raw analytics events are purged after the retention period defined by the customer's plan:

• Free: 1 year (365 days)
• Pro: 2 years (730 days)
• Scale: 4 years (1,460 days)
• Enterprise: configurable, set in the order form

Session replay recordings and heatmap data are premium features with their own, much shorter retention: 60 days on Pro, 120 days on Scale and 180 days on Enterprise. They are deleted on that schedule regardless of the analytics retention period above.

Account audit logs (user actions, billing events, settings changes) are retained for 24 months and purged automatically each day from 03:00 UTC. They hold no plaintext IP address, only a one-way SHA-256 hash. Separately, our internal operations console keeps its own log of what a Zenovay administrator did, and that log records the administrator's own IP address for security accountability.

How we protect it

• Every Zenovay endpoint is served over HTTPS, with TLS terminated at the Cloudflare edge. Traffic between our Workers and the database is encrypted in transit.
• Data at rest is encrypted by the providers that store it: Supabase for the primary database and its backups, and Cloudflare for R2 object storage. Encryption at rest and the key management behind it are operated by those providers rather than by Zenovay, under their own published certifications.
• In the analytics tables an IP address is stored only as a one-way SHA-256 hash, never in plaintext: the plaintext field on the visitor record is written empty, the plaintext column was dropped from the account audit log on 2026-04-26, and the team audit log hashes and clears it on insert. That is not the whole story, so here is the rest of it. To do its job the service has to see the address itself first: it is used to look up an approximate location, to apply rate limits, and to detect and block abuse. In those paths the address is held for a short, bounded period - for example a geolocation cache that expires after 24 hours, and abuse-prevention and IP-block records. It is also sent to our geolocation providers, which is how the country and city in your dashboard are resolved.
• Row Level Security is enabled on every table in the production database. Our API authenticates to the database with a service role and enforces tenant scoping in the application layer on every query path, with Row Level Security as the second line of defence against direct client access. Customers have no direct database access.
• Administrative and account actions are written to append-only audit logs. No UPDATE or DELETE policy exists on those tables, so an authenticated client cannot rewrite history; entries leave only through the scheduled 24-month retention job. Audit writes are deliberately non-blocking, so a logging failure never blocks the action itself - which makes the log an accountability record rather than a guaranteed-complete transaction log.
• Banned or revoked sessions are propagated to the edge through Cloudflare KV, which is eventually consistent and typically reaches every location within about a minute; in-flight refresh tokens are invalidated server-side.

Your rights

You can exercise the rights of access (GDPR Art. 15), rectification (Art. 16), erasure (Art. 17), portability (Art. 20) and objection (Art. 21) at any time. The free "Download your data" export and the "Delete account" flow are both in your Profile. The export is a machine-readable JSON file covering your profile, teams, websites, security and login history, support tickets, AI conversations, integrations and the other personal data we hold about you as an account holder.

California residents have CCPA/CPRA rights to know, delete, correct, and opt out of sale or sharing. We honour the Global Privacy Control browser signal automatically - if your browser sends Sec-GPC: 1, we treat it as a valid opt-out without further action.

For written requests or jurisdiction-specific rights, see the Privacy Policy.

What we don't claim

Zenovay itself is not currently SOC 2 certified. Our infrastructure providers maintain industry-standard certifications: Cloudflare (SOC 2 Type II, ISO 27001, ISO 27018), Supabase (SOC 2 Type II). We will update this page if and when we obtain our own audit.

We do not claim ISO 27001, HIPAA, or PCI DSS certifications. We process payments through Stripe, which is PCI DSS Level 1 certified - Zenovay never touches raw card data. Automated security scans run every Monday against every Zenovay service, covering dependency vulnerabilities (npm audit), static analysis (Semgrep) and secret scanning (gitleaks). Dynamic application scanning (OWASP ZAP) and Lighthouse additionally run against the web-facing services; they are not configured for the API service. Security advisories from our database provider are pulled and reviewed on the same weekly schedule. We have not commissioned an independent penetration test, and we do not describe these scans as one.

Report a security issue

If you find a security issue, please contact us at security@zenovay.com.

We aim to acknowledge reports within 48 hours. We do not yet operate a paid bug bounty programme. If you would like credit for a report, we will name you, or a pseudonym of your choosing, in the release notes for the fix.