Privacy policy

WebTrack is a website analytics service designed, built and operated by SyncFac (Pty) Ltd ("we", "us", "our"). This policy explains what personal information we collect, why we collect it, how we use and protect it, how long we keep it and what rights you have. It covers this website, the WebTrack application at app.webtrack.co.za, and the tracking script and server interface that websites use to send WebTrack their visits.

We process personal information in line with the Protection of Personal Information Act, 2013 (POPIA). WebTrack is designed to keep as little personal information as it can. If you are in the European Union or the United Kingdom and visited a website that uses WebTrack, you can exercise your rights through that website’s owner, as described under Your rights below.

WebTrack is operated by SyncFac (Pty) Ltd, a South African company. Our information officer can be reached at hello@syncfac.com. Our physical address and company registration number are available on request from the same address.

Three groups of people meet WebTrack, and who is responsible for their information depends on which group they are in.

People who use WebTrack

We are the responsible party for the information we hold about the people who sign in to WebTrack: their name, email address, the organisations they belong to and how they use the application.

People who visit a website that uses WebTrack

The business that owns the website is the responsible party for the visits it measures. We process that information on its instruction, as its operator, and only to provide the service.

People who visit this website or contact us

We are the responsible party for what you send us through the contact form or by email, and for the details recorded with it.

WebTrack is built to measure visits without identifying the people behind them. For each page view or named action on a website that uses it, WebTrack records:

• The page path, with query strings and fragments removed before anything is sent
• Whether it was a page view or a named action, and the name of the action
• The name of the referring website, never its full address
• Campaign labels from the link, where the website uses them
• The browser, operating system and kind of device, in general terms
• The time of the visit and how long it lasted
• The approximate country and city the visit came from, looked up from its IP address when it arrives
• A random visit identifier, kept in the browser only while the tab is in use and replaced after 30 minutes without activity, and combined with a secret key and the website before it is stored

WebTrack sets no cookies, does not store IP addresses or complete browser identification strings, and does not try to recognise a device or a person across visits, tabs or websites. When a browser sends Do Not Track or Global Privacy Control, the script records nothing for that visit.

The location comes from the IP address the visit arrives from. WebTrack uses that address only to look up a country and a city, then discards it; the address itself is never stored. The lookup runs on our own servers against a copy of the DB-IP Lite database, refreshed monthly, so the address is not sent to anyone else. A location is approximate and no finer than a city, and a visit from a private or unrecognised address is recorded as Unknown. IP geolocation by DB-IP (db-ip.com), used under the Creative Commons Attribution 4.0 licence.

To protect the service from abuse, WebTrack limits how many requests one address can send in a short time. That count is kept in memory for no more than 15 minutes and is never written to disk.

A website may also report completed purchases, refunds and AI crawler requests from its own server. Those reports carry an amount, a currency, a page and the same anonymous identifiers, and no location. Websites are instructed never to send names, email addresses or other personal details in them.

• Your name and email address
• Your password, stored only as a salted hash
• The organisations you belong to and your role in each
• Invitations sent to your address, and the codes and links we email you to confirm your account or reset your password
• A record of changes made in your organisation, such as a website added or a key rotated, and who made them
• A record of administrative actions we take on your organisation or account, such as setting it up or suspending it, with the reason we gave
• Anything you send us in an enquiry or support request

An account needs your name and email address, and a password you choose. Giving them is voluntary, but without them we cannot create an account for you or let you sign in.

WebTrack emails you only to run your account. When someone invites you, it sends you an invitation link. A new account must then confirm a 6-digit code sent to the invited address, which is valid for 10 minutes. If you forget your password, “Forgot password” emails you a reset link that is valid for 1 hour and works once; using it signs you out everywhere.

Signing in sets one cookie that keeps you signed in. It is strictly necessary, and WebTrack does not work without it.

When you send the contact form on this website, we keep what you type: your name, email address, organisation, website, the topic you chose and your message. With it we record the IP address the message came from and your browser’s identification string (its user agent), so we can detect and prevent abuse of the form. They are stored with your enquiry and used for nothing else.

Contacting us is voluntary. The form needs your name, email address and message so that we can reply to you; your organisation and website are optional. Your enquiry goes to the SyncFac Console, our own support system, which runs on the same infrastructure as WebTrack, and we email you an acknowledgement.

Providing the service

Recording visits, producing your reports and keeping your organisation’s settings.

Running the service

Creating and managing organisations and accounts, answering support requests and looking after usage across the service.

Security and integrity

Detecting and preventing abuse, enforcing rate limits and keeping a record of changes.

Communication

Sending the email that runs your account, replying to your enquiries and sending service notices. We do not send marketing.

Legal compliance

Meeting our obligations under applicable law and responding to lawful requests.

We do not sell personal information, we do not use anyone’s analytics for our own advertising, and we do not use it to train machine learning models.

POPIA section 11 allows personal information to be processed only on a lawful basis. These are ours:

Visits to a website that uses WebTrack

The website’s owner relies on its legitimate interest in understanding how its website is used (section 11(1)(f)). We process the visits for it, as its operator.

Your account

Needed to provide WebTrack to you under our terms (section 11(1)(b)).

Email we send to run your account

Invitations, confirmation codes, reset links and service notices are part of providing the service (section 11(1)(b)).

Contact enquiries

Your consent, given when you tick the box on the form, and our legitimate interest in answering questions about our services (sections 11(1)(a) and 11(1)(f)).

The IP address and user agent sent with an enquiry

Our legitimate interest in preventing abuse of the form (section 11(1)(f)).

Records of changes and administrative actions

Our legitimate interest, and your organisation’s, in keeping the service secure and knowing who changed what (section 11(1)(f)).

• Service providers who help us operate WebTrack: hosting, in South Africa, and our email provider, which delivers the email we send. Each may only process data to provide that service to us.
• In connection with a merger, acquisition or sale of assets, with notice to you.
• Where required by law, or to protect rights, safety or property.
• With your consent, or on your instruction.

One organisation never sees another’s data. Every report is limited to the organisation it belongs to, and only its members can see it.

• Encryption in transit (TLS) for every connection to WebTrack
• Visit identifiers combined with a secret key before they are stored, and no IP addresses stored at all
• Passwords, sessions, invitation links and server keys stored only as hashes
• Access by role, checked against your current membership on every request, not remembered from an earlier one
• Server keys that work for one website only, shown once and revoked as soon as a new key is created
• Rate limits on sign-in, collection and server reporting

No system is perfectly secure. If a breach affects your personal information we will notify you and the Information Regulator as POPIA requires.

Visits and other analytics

Kept until the website they belong to is deleted. There is no automatic retention period: an organisation owner can delete a website at any time, from its settings in WebTrack, and that permanently deletes, at once, its visits, events, revenue records, goals, funnels and server key.

Your account

Kept while you use WebTrack. When an organisation stops using WebTrack, or you ask us to, we delete the account details concerned within 30 days of the request.

Sign-in sessions

Expire after 12 hours, and expired sessions are removed every hour. Signing out ends a session at once.

Invitations, codes and reset links

Invitations expire after 7 days, password reset links after 1 hour and confirmation codes after 10 minutes.

Records of changes

The record of changes made in an organisation, and of the administrative actions we take on it and its accounts, is kept for as long as the organisation exists.

Contact enquiries

Kept in the SyncFac Console, with the IP address and user agent recorded alongside them, for as long as we need them to help you and to keep a record of what was agreed. We delete an enquiry within 30 days of a request.

Administrative safeguards

Records that stop an administrative action in the SyncFac Console from being applied twice are removed after 7 days.

Where the law requires us to keep a record for longer, we keep it only for that purpose and only for as long as required.

• Ask whether we hold personal information about you, and for a copy of it
• Ask us to correct anything inaccurate or out of date
• Ask us to delete your personal information
• Object to processing based on legitimate interest, or withdraw a consent you gave
• Complain to the Information Regulator

To make a request, email hello@syncfac.com and say what you would like us to do. We may ask you to confirm your identity first, for example by replying from the email address on your account or by giving details only you would know, so that we never give your information to someone else. We reply within 30 days.

If your question is about a website you visited, contact the business that owns it first. It decides what WebTrack measures, and we act for it as its operator. Because WebTrack does not know who a visitor is, it cannot find one person’s visits on request, but we will help the owner answer you. This applies wherever you are, including the European Union and the United Kingdom.

If you are not satisfied with how we handle your information or your request, you can complain to the Information Regulator of South Africa. Its website is inforegulator.org.za. Complaints are made on the Regulator’s complaint form and sent to POPIAComplaints@inforegulator.org.za, and general enquiries go to enquiries@inforegulator.org.za.

The tracking script sets no cookies. The WebTrack application sets one strictly necessary cookie to keep you signed in, and keeps a few things in your own browser’s storage: your preferences, such as light or dark and whether the sidebar is collapsed, a marker that you are signed in, and your demo edits if you try the demo.

This website sets no cookies and runs no analytics. Beyond what you type, the details it records about you are the IP address and user agent sent with a contact form message, as described above, and the standard request log its web server keeps, which includes the IP address and browser of each request and is used only for security and fault finding.

WebTrack is hosted in South Africa, in Johannesburg, and its data does not leave South Africa for hosting. Locations are looked up against a local copy of the DB-IP Lite database, so nothing is sent to DB-IP. Contact enquiries go to the SyncFac Console, which is hosted on the same infrastructure.

We send email through our own mailbox, and our email provider may process a message outside South Africa while delivering it. Where any personal information is processed outside South Africa, we rely on POPIA section 72: the recipient is bound by law or contract to protection substantially similar to POPIA’s, or the transfer is needed to provide the service you asked for.

WebTrack is a business tool and is not intended for children. We do not knowingly create accounts for anyone under 18.

We may update this policy. Material changes will be announced in WebTrack or by email, and the date at the top of this page will change.

The responsible party for the personal information described in this policy is SyncFac (Pty) Ltd, the South African company that operates WebTrack. Questions about this policy, about how we handle your information, or a request to exercise your rights can go to our information officer at the address below. Our physical address and company registration number are available on request from the same address.

hello@syncfac.com

Operated by SyncFac (Pty) Ltd.