Data and privacy

Website events

The tracker sends page paths, referrers, campaign parameters, available advertising click identifiers, a first-party session identifier and the user-agent string. Interaction events can include event names and labels derived from page content. Browser and attribution cookies use site-specific _pulse names and last up to 30 days; advertising click cookies may last up to 90 days. Anonymous event retries may use tab session storage for up to six hours. An opt-out preference lasts up to one year.

Default autocapture does not read the values typed into form fields. If a site explicitly enables data-draft-fields, the tracker sends the latest values of those named fields before submission. These snapshots are stored in Zowar and visible in authenticated visit details. Site owners must disclose this collection and apply their consent requirements. Password, payment, and sensitive identity fields are excluded. It may record button or link labels, form interactions and contact-link targets. Keep sensitive data out of URLs, labels and custom event names.

Optional location data

With TRUST_COUNTRY_HEADER enabled behind a trusted edge, the collector stores a country code from CF-IPCountry on new events. With TRUST_LOCATION_HEADERS also enabled and visitor-location headers supplied by the trusted edge, new events can include state/region, city and time zone. This is approximate network location, not GPS; VPNs and mobile networks can affect it. Zowar does not store IP addresses, coordinates or postal codes for this feature. Historical location fields are not backfilled. Your hosting provider may keep separate network logs. See country collection setup.

Submitted leads

Forms connected through submitLead deliberately send the values your integration supplies: names, email addresses, phone numbers, messages and custom answers. These are stored with form definitions at submission time, attribution where available, lead stage and internal notes. Automatic contact leads can store the phone or email target that was tapped.

Do not send passwords, payment card details or secrets. Review your own data collection, consent, access and retention requirements for the sites you operate. First-party collection does not bypass browser blockers or consent settings.

Optional identity links

Verified customer IDs are stored as site-specific keyed hashes. Optional labels, browser links, review reasons and audit history are stored for authenticated CRM access. Team-reviewed links can be removed without deleting enquiries. See visitor identity and consent.

Accounts and access

Zowar stores account email addresses and password hashes for password accounts. Google sign-in can store a Google account identifier to match later logins. API keys are stored as hashes, and data access is scoped to the authenticated account.

Optional Google integrations

Google reporting is disabled by default and is separate from Google sign-in. When enabled and connected, Analytics and Search Console supply reporting data; refresh tokens are encrypted at rest. Google Ads integration can also upload lead conversions when configured. It is therefore inaccurate to describe all integrations as read-only.

Disabling reporting stops reporting access and conversion uploads without deleting existing credentials or account data. Operators control the deployment and any connected services. See Google reporting for the retained integration options.