Ssyncingbeam.app

Privacy Policy

Effective date: 14 September 2026

1. Who we are

This service ("SyncingBeam", "we", "us") is operated by SyncingBeam, with its registered address at Rome, Italy — Partita IVA (VAT) 16634531004. SyncingBeam is an analytics monitoring and reporting service for businesses and agencies: it connects to the marketing data sources our customers authorize, normalizes the numbers into one per-client view, flags anomalies, and produces reports.

For any question about this policy or about your personal data, contact us at [email protected].

2. What data we collect

We collect and process the following categories of data:

  • Customer account data. When our customers create an account, they give us a name and a work email address. Customers sign in with a password or with a one-time sign-in link emailed by our email provider, Resend. Passwords are never stored in readable form: we keep only a salted, one-way scrypt hash. Where Google sign-in is offered and a customer chooses it, Google provides the account's name, verified email address, and profile picture. We are the independent controller of this account data.
  • Google connector data. If a customer connects a Google Analytics 4 property or a Search Console site, we retrieve GA4 report data via the Google Analytics Data API and Search Console performance data via the Search Console API. These reports contain aggregated metrics and dimensions, such as page paths, campaign names, and search queries. A customer can also explicitly enable a connected BigQuery export for session-level analysis, as described in section 7. A dimension or customer-supplied value can contain personal data even when it appears alongside aggregated metrics.
  • Other connected marketing platforms. Where a customer connects a supported non-Google marketing platform (for example a CRM or advertising account), we process the supported engagement, sales and performance data from that platform, at the customer's direction and as its processor under our Data Processing Agreement.
  • Early-access and contact requests. If you request early access or contact us through a form on this website, we process the name, email address, optional company, and message you submit. Arimatics stores these requests in its self-hosted customer-management service so the team can respond. Submitting a request does not create an account or grant product access. Product updates by email are separate and optional: the form checkbox is unticked by default.

What we do not collect from Google: we do not operate Google sign-in ("Sign in with Google"), and we do not receive your Google account email address, your Google profile information, or any other Google account data. Our connection to Google is limited to the reporting data named above, authorized by the account owner through Google's own OAuth consent screen. GA4 and Search Console use read-only scopes. Where the Google Ads connector has been enabled for a workspace — it is not part of the standard service today — Google offers no reporting-only scope, so SyncingBeam uses its separate Ads scope only for reporting reads and never to change campaigns or account settings.

3. How we collect your data

You provide most of the data we process directly, when you:

  • create an account or sign in with a password, an emailed sign-in link, or (where offered) Google sign-in;
  • authorize a Google connection through Google's OAuth consent screen (which is what instructs Google to make the report data above available to us);
  • submit an early-access request or otherwise contact us.

The marketing website also offers optional journey tracking. If you accept, the self-hosted tracker records the pages you visit and their URLs and timestamps. If you submit a form while tracking is allowed, that page history may be linked to your contact record in Arimatics' self-hosted customer-management service. This optional page history does not use a third-party pixel or session replay. You can change or withdraw your choice in Journey tracking settings.

Google connector data is then retrieved automatically, on a schedule, for as long as the connection remains authorized. Revoking the authorization — in SyncingBeam or in your Google account's security settings — stops all further retrieval.

4. How we use your data, and on what legal basis

  • Account data is used to operate your account: signing you in, communicating about the service, and providing support. Legal basis: performance of our contract with you (GDPR Article 6(1)(b)).
  • Google connector data is used solely to provide the features our customer has enabled: dashboards, anomaly detection, and reports over the connected properties. We process it on our customer's documented instructions under our Data Processing Agreement (see section 6). We do not use it for advertising, we do not sell it, and we do not use it to train machine-learning models unrelated to the features you use.
  • Early-access and contact requests are used to respond to the request you sent. Submitting a request does not opt you in to product marketing email; the separate optional checkbox records that choice.

AI report and chat features send the relevant report evidence and your instructions to the configured AI provider. Platform-managed options include OpenAI, Anthropic, Google Gemini and xAI, listed on our subprocessor page. A workspace may instead supply its own provider credentials. Provider-specific retention and account terms apply; we do not promise zero retention for every model. Only connect data you are authorized to use with the selected features.

5. How long we keep data

We keep personal data only as long as needed for the purposes above. Our retention periods are: Analytics aggregates and generated reports are retained for the life of the customer relationship, and deleted within 30 days of account termination or of a verified deletion request. When a customer asks us to disconnect a Google property, or closes their account, we delete the associated connector data in line with those periods and with the Data Processing Agreement. Authorized administrators can disconnect supported connectors in the application. Workspace owners can request data return or deletion, and use the available workspace deletion control. Disconnecting stops future collection; it does not by itself erase retained reports or remove data from the original provider. For a verified privacy request, contact [email protected]. We confirm completion and explain any retained records or outstanding processor actions. Backup copies expire through the backup rotation. Early-access and contact emails are retained for the period stated above and then deleted, or deleted earlier on request.

Workspace owners can request a data export or deletion assistance in Organization Settings and track the request there. Each request receives a reference and a target response date one calendar month after receipt. We verify identity, scope, delivery and any lawful retention requirements before closing the request. Request records and completion notes are retained for 90 days after completion, then removed by a daily job. Minimal agreement receipts retain the accepted versions, timestamp and internal workspace/account references for the workspace lifetime and 90 days after workspace deletion. Names, email addresses and activity history are not copied into these retained receipts. Deleting a workspace does not erase the original data held by your connected providers. Requests about an individual account or a person represented in customer data can also be sent to [email protected].

6. Google API Services — Limited Use

Syncingbeam's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms: data we receive from the Google Analytics Data API and the Search Console API is used only to provide and improve the user-facing features of SyncingBeam that you see and enable. It is never transferred to third parties except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition after obtaining your explicit prior consent; it is never used for advertising; and humans do not read it except with your permission, where necessary for security or legal compliance, or when aggregated for internal operations.

7. Aggregated statistics and pseudonymization

Standard reporting uses aggregated statistics. Optional GA4 session analysis is available through an explicitly enabled BigQuery connection with the pseudonymous privacy setting. It stores session timing, entry and exit pages, acquisition dimensions, device category, country, engagement, event counts and sequences, and approved event parameters needed for the enabled analyses.

Before these session records are stored, the source user and session identifiers are replaced with a keyed code scoped to the workspace, client and connector. Approved parameter values are screened for recognizable personal identifiers. These measures reduce exposure; they do not make the records anonymous or guarantee that all personal information in source values can be detected. Customers must avoid putting names, email addresses or other personal details into page paths, campaign labels and reporting parameters.

We treat pseudonymous session records as personal data. Session records are subject to their configured retention policy and deletion controls. Erasure requests are handled through the process in sections 5 and 9; pseudonymization alone does not erase a record. Deleting data from SyncingBeam does not delete the customer's original source data.

8. Who is responsible for what (controllers and processors)

Customers may connect their own business data or manage data for other businesses. Responsibilities depend on who determines the purposes and means of the processing:

  • The business determining the processing is the controller. It may be our direct customer or an agency's client.
  • The agency (our customer) acts as a processor for its client (or, where it decides the purposes itself, as a controller), and warrants to us that it has the authority and consents needed to connect each account.
  • SyncingBeam is a processor (or sub-processor) of the connected marketing data: we act only on our customer's documented instructions, under our Data Processing Agreement. We are an independent controller only of our customers' own account data (section 2, first bullet) and of early-access and contact emails.
  • Google is outside our processing chain: it is not our sub-processor, but a recipient and source that the account owner authorizes directly through their own Google OAuth grant.

For personal data, the Data Processing Agreement controls over the Terms of Service wherever the two differ.

9. Your data protection rights

Under the GDPR, you have the right to:

  • Access — request copies of your personal data;
  • Rectification — have inaccurate or incomplete data corrected or completed;
  • Erasure — have your personal data deleted, under the conditions the GDPR sets;
  • Restriction — have processing of your data restricted, under certain conditions;
  • Objection — object to processing based on legitimate interests;
  • Data portability — receive the data you provided in a structured, commonly used, machine-readable format;
  • Withdraw consent — at any time, where processing is based on consent, without affecting processing before withdrawal.

To exercise any of these rights, email [email protected]. We respond within one month. If your data reached us through a business or agency customer (that is, we hold it as a processor), we may refer your request to that customer, as the GDPR provides — and we will tell you if we do. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state where you live, where you work, or where you believe an infringement occurred.

10. California privacy rights (CCPA/CPRA)

This section applies to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act, covers our processing. It changes nothing about the rest of this policy: it states the same practices in the terms that statute uses.

Our role. SyncingBeam is a business only in respect of its customers’ own account data and of early-access and contact emails (section 2). For the marketing data a customer connects, we are that customer’s service provider: we process it solely to perform the service under a written contract — our Data Processing Agreement — and we are prohibited by that contract from retaining, using, or disclosing it for any other purpose, or from combining it with data from other sources outside the permitted exceptions.

Categories of personal information. In the preceding twelve months we collected identifiers (a name and a work email address, from customers and from people who write to us), commercial information limited to the plan a customer holds, and — as a service provider, on our customers’ instructions — internet or other electronic network activity information in the aggregate reports and optional pseudonymous session records described in section 7. We collect no government identifiers, no financial account numbers, no biometric or precise geolocation data, and no category the CPRA classifies as sensitive personal information. Because we hold none, there is nothing for a right to limit its use to apply to.

We do not sell or share personal information. We have not sold personal information, and we have not shared it for cross-context behavioural advertising, in the preceding twelve months, and we do not do so today. That is why this site carries no “Do Not Sell or Share My Personal Information” link: there is no sale or share to opt out of. We also do not knowingly sell or share the personal information of anyone under 16 — see section 11.

Your California rights. If you are a California resident you may ask us to disclose the categories and the specific pieces of personal information we hold about you, where we got them, why we use them, and to whom we disclose them; to correct information that is inaccurate; and to delete it, subject to the exceptions the statute allows. An authorised agent may make a request on your behalf. We will not discriminate against you for exercising any of these rights: no denial of service, no different price, no lower quality.

To exercise a right, email [email protected]. We verify a request against information we already hold — normally the email address on the account — and answer within 45 days, extending once by a further 45 days where the request is complex, in which case we tell you before the first period ends. Where we hold the data only as a service provider for one of our customers, the business responsible for answering is that customer: we pass your request to them, and we tell you that we have.

11. Children’s privacy

SyncingBeam is a business tool sold to marketing agencies and their clients. It is not directed at children, we do not market it to them, and we do not knowingly collect personal data from anyone under 16 — our own account data comes from the work email address of a person signing up on behalf of a business. The connector data we process on our customers’ behalf is aggregated platform statistics, not individual visitor records; where a customer’s own website has an audience that includes children, the responsibility for the lawful basis and any parental consent sits with that customer as controller, under section 8 and our Data Processing Agreement.

If you believe a child has given us personal data, write to [email protected] and we will delete it. Where local law sets the digital-consent age above or below 16 — EU member states may set it anywhere from 13 to 16, and the CCPA draws its line at 16 for sale or sharing (section 10) — we apply whichever age gives the child more protection.

12. International transfers

Where personal data is transferred outside the European Economic Area to a country without an adequacy decision, the transfer is protected by the European Commission's Standard Contractual Clauses, which are incorporated through our Data Processing Agreement.

13. Subprocessors

We use a small number of service providers to run SyncingBeam (for example, hosting and email delivery). The current list, and how we give notice of changes, is published at syncingbeam.app/subprocessors.

14. Cookies

This marketing website uses essential cookies. Optional journey tracking is off unless you accept; when enabled, the consent choice and journey identifier are stored in browser local storage. The authenticated application sets strictly necessary session cookies for sign-in. The full details are in our Cookie Policy.

15. Privacy policies of other websites

This website may link to other websites (including Google's own documentation and consent screens). This policy applies only to SyncingBeam; if you follow a link elsewhere, read that site's privacy policy.

16. Changes to this policy

We keep this policy under review and post any update on this page, with a new effective date. If a change materially affects how we handle your personal data, we will notify account holders by email before it takes effect.

17. How to contact us

SyncingBeam
Rome, Italy — Partita IVA (VAT) 16634531004
Privacy contact: [email protected]
Data protection contact: [email protected]

The data protection contact is the person accountable inside SyncingBeam for how personal data is handled, and the address to write to for anything in this policy — access, correction, erasure, objection, a CCPA request, or a question about a connected account. We have not formally designated a Data Protection Officer under GDPR Article 37, because SyncingBeam’s core activity is aggregated reporting rather than large-scale systematic monitoring of data subjects, and none of the mandatory triggers in that Article applies to us. We say so plainly rather than borrowing the title: if that changes — for example if the individual-record tier described in section 7 is ever enabled — we will designate one, publish the details here, and notify the supervisory authority as Article 37(7) requires.