Privacy Policy

1. Information We Collect

Personal Information

We may collect personal information that you voluntarily provide to us when you:

• Request a demo or contact us through our forms
• Subscribe to our newsletter
• Apply to become a partner
• Create an account or use our services

This information may include:

• Name and contact information (email, phone number)
• Company name and job title
• Business requirements and project details
• Payment and billing information

Automatically Collected Information

When you visit our website, we may automatically collect:

• IP address, and approximate geographic location (country, region, city, postal code) derived from your IP via a third-party lookup service
• Browser name and version, operating system, device type (desktop, tablet, mobile), screen size, language, and timezone
• Pages visited, time spent on our site, session pageview count, and referring website address

Marketing Attribution Identifiers

When you arrive on our website from a marketing campaign, we capture and store identifiers that let us understand which campaign sent you. These are stored in your browser's local storage for up to 90 days and are attached to any enquiry or demo request you submit, so we can attribute leads to their original source. We capture:

• Advertising click identifiers, including gclid (Google Ads), msclkid (Microsoft/Bing Ads), fbclid (Meta/Facebook), li_fat_id (LinkedIn Ads), ttclid (TikTok Ads), twclid (X/Twitter Ads), dclid (Google Display & Video 360), and similar parameters appended by ad platforms
• UTM campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content, utm_id)
• Derived attribution data: the marketing channel inferred from the above identifiers and from your referring website (e.g. Google Ads, organic search, LinkedIn, direct), the landing page you arrived on, and the timestamp of your first and most recent visits

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process your requests and respond to inquiries
• Send you technical notices and support messages
• Communicate about products, services, and events
• Monitor and analyze trends and usage
• Detect, prevent, and address technical issues
• Attribute enquiries and demo requests to the marketing channel, campaign, and ad that originally referred you, so we can measure campaign effectiveness, optimize our advertising spend, and report conversions back to advertising platforms (e.g. Google Ads, Microsoft Ads, LinkedIn Ads, Meta) including via offline conversion uploads
• Personalize the website experience and tailor follow-up communication based on the content you viewed and the campaign you arrived from
• Comply with legal obligations

3. Information Sharing

We may share your information with:

• Service Providers: Third parties that perform services on our behalf, including: Google (Google Analytics and Google Tag Manager for website analytics, Google Ads for advertising and conversion measurement), Microsoft (Clarity for session analytics, Microsoft Ads for advertising), LinkedIn (Insight Tag for advertising and conversion measurement), ipapi.co (IP-based geolocation lookup), Web3Forms (form-submission delivery), Supabase (database and backend hosting). These providers process data on our behalf in accordance with their own privacy practices.
• Advertising Platforms: We may share aggregated and hashed conversion data (including click identifiers such as gclid) with advertising platforms via offline-conversion uploads so they can attribute conversions to the ads that drove them.
• Business Partners: Authorized partners for joint marketing or service delivery
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets

We do not sell your personal information to third parties.

4. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet is 100% secure.

5. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements.

Specific retention periods include:

• Marketing attribution identifiers (click IDs, UTM parameters, derived channel) stored in your browser's local storage: up to 90 days from your most recent visit, after which they are automatically discarded.
• IP-based geolocation data retrieved during a visit: cached for the duration of your browser session and discarded when you close the tab.
• Lead and enquiry records (including the attribution and enrichment data attached to them): retained for as long as the lead remains active in our customer-relationship and marketing-attribution workflows, and for a reasonable period afterwards for analytics and legal-compliance purposes.

You can clear browser-stored attribution data at any time by clearing your browser's site data for our website.

6. Your Rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal information
• Object to or restrict processing of your data
• Request data portability
• Withdraw consent at any time

7. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.

8. SyntraFlow Recorder Chrome Extension

This section covers the SyntraFlow Recorder Chrome extension, which records your actions on a website to generate test automation scripts.

8.1 Data We Collect

Only while a recording is active (after you click "Start Recording"). Nothing is captured outside an active session.

• User Activity: clicks, keystrokes, and other page interactions.
• Website Content: DOM elements, field labels, and screenshots of each step.
• Browser settings and passwords. The Extension uses Chrome's privacy permission for one purpose: while a recording is active, it temporarily turns off Chrome's "Offer to save passwords" prompt, so the test credentials used to sign in to the recorded application are not saved in your browser. The Extension does not read, collect, store or transmit your saved passwords, autofill data or any other Chrome privacy setting. Your own setting is restored automatically when the recording ends, and again whenever the browser starts.

Sign-in information. The Extension collects your SyntraFlow username and password to sign you in; the password is sent over HTTPS to our server and is not stored by the Extension. It stores the sign-in token, refresh token and basic profile (name, email, organisation) so you stay signed in. When you start a recording from the dashboard, it also receives the username and password of the application test account you selected, and uses them only to fill in that application's sign-in page.

Also recorded during an active recording: the URLs of pages visited, and the values you type or select in fields. If you type a password or other sensitive value while recording, it may be included. The Extension also reads and deletes session cookies for the recorded site and its sign-in provider at the start and end of a recording; cookie contents are not stored or sent.

8.2 How We Use This Data

Solely to generate, let you review/edit, and replay your automation script — never for advertising, profiling, or any unrelated purpose.

8.3 Data Storage & Retention

Recordings are cached locally in your browser (chrome.storage) and sent to SyntraFlow's own backend, operated by Firstcron LLC on AWS cloud infrastructure, so scripts are saved to your account and accessible to your team. Data is kept as long as your account needs it, or until deleted. Local history can be deleted anytime in the extension and is cleared on uninstall; deletion of account-stored recordings can be requested via Section 8.6 below.

The Extension keeps your 20 most recent recordings locally. A saved recording (its steps, URLs, entered values and a PDF with step screenshots) is sent over HTTPS and stored in your organisation's account until you or your administrator delete it.

8.4 Data Sharing & Third Parties

We never sell, rent, trade, or share your recordings or website content with third-party companies, advertisers, or data brokers. Data is shared only with: AWS (hosting, on our behalf); Anthropic (Claude AI), which receives the failed step's details and the page content when a replayed test step fails, so it can repair that step; other authorised users in your organisation's account; and authorities where required by law.

8.5 Limited Use

The use of information received from the Extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Our staff do not read your recording data except with your consent (for example, a support request), for security, or to comply with law.

8.6 Your Control & Contact

You control recording start/stop, can delete local history anytime, and uninstalling removes all locally cached data. For data access, deletion requests, or questions, contact:

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the effective date.

10. Contact Us

If you have questions about this Privacy Policy, please contact us at: