Privacy Policy

1. Who is responsible

The controller, owner of personal records and operator of SENRIKO is Individual Entrepreneur Izotov Aleksandr Olegovich (“SENRIKO”, “Operator”, “we”, “us” or “our”), TIN 23006199301704. The full registered address and other public provider details appear in the Legal Notice at https://senriko.com/legal/notice.

Privacy requests may be submitted through https://senriko.com/contact or to help@senriko.com. Further registration and contact details appear in the Legal Notice.

Where SENRIKO processes personal data contained in a Customer’s monitoring configuration, evidence or connected systems solely on the Customer’s instructions, the Customer is the controller and SENRIKO is the processor under the DPA. Where SENRIKO determines its own purposes - for example, Account administration, billing metadata, public-Site analytics, security, legal compliance and service-level aggregate metrics - SENRIKO acts as an independent controller.

2. Scope

This Policy applies to senriko.com, its English and Russian versions, the Account area, public tools, administration pages, support and legal correspondence, notifications and the SENRIKO website-monitoring Service.

This Policy also covers the free SENRIKO Conversion Inspector browser extension. Section 4.11 describes its local data handling and takes precedence over general cloud-service descriptions for that function. No Account is required to use the Extension.

It does not control the independent privacy practices of monitored Sites, CRMs, mail systems, Google properties, Paddle or other third parties. Their own notices apply to processing they determine independently.

Some information is required to provide the requested Service. Without a valid email, credentials/session data and essential security records, SENRIKO cannot create or secure an Account. Without Site configuration and authority information, it cannot perform monitoring; without necessary billing details supplied to Paddle, a paid Subscription cannot be completed. Optional marketing, research, testimonial and analytics choices are not required for the core Service.

The Service is intended primarily for businesses, agencies and website owners and is not intended for persons under 18.

3. Data subjects

Personal data may relate to:

• Account holders, Workspace owners and authorised team members;
• alert recipients added by a Customer;
• visitors to public SENRIKO pages and users of free tools;
• people who contact SENRIKO, request support, submit a complaint or seek a refund;
• owners, staff and service providers of monitored Sites;
• people whose information is incidentally visible in a screenshot, URL, autoresponder subject or monitored page;
• buyers and billing contacts whose payment is handled by Paddle;
• authorised SENRIKO personnel and contractors.

4. Information we process

4.1 Account and access data

Email address; password hash, never the plain password; language; time zone; Account and Workspace status; creation, verification, sign-in, reset and modification times; user role; security settings; and support state.

If you register through a link from a free SENRIKO tool, we may record the source tool, whether the link was a shared-result link, and the hostname of the checked website, for example shop.example.com. We do not record the page path or query parameters as part of this account-source record. No cookie is set for this purpose. Registrations through other routes do not receive this record. It is associated with your Account and included in the Account export.

4.2 Session, device and security data

Session-token hash; expiry and use time; browser/user-agent; IP address in limited technical logs; HMAC-derived or hashed IP values in evidence records; URLs, response status and selected request headers; rate-limit entries; login and administrator audit events. Cookies and authorisation headers are redacted from application logs where technically possible.

4.3 Workspace, Plan and usage data

Workspace name and identifier; Plan, limits, status and time zone; configuration; monitoring token; feature use; check count; execution cost; limit consumption; subscription state; and account-level notices.

4.4 Site and monitoring data

Domains, URLs, redirects, labels, domain-control method and code, detected revenue paths, pages under watch, check type and frequency, selectors, accepted baselines, alert rules, authority confirmation and CRM-filter state.

Results may include response codes and timing, SSL/DNS/RDAP information, page titles and canonicals, analytics tags, resources, JavaScript/browser errors, form behaviour, crawl URLs, detected changes, findings, incidents, evidence, Health Scores and reports. Raw HTML and request bodies are not ordinarily retained after processing.

4.5 Form-check and autoresponder data

Synthetic field values configured by the Customer; steps, status and response; hidden marker delivery; observed analytics/advertising signals; a PNG screenshot of the visible viewport when needed as evidence; and autoresponder sender, subject truncated to 200 characters, time and associated check. Autoresponder bodies are discarded immediately.

4.6 Alerts and communications

Encrypted alert-recipient email; recipient verification; severity and delivery settings; alert content; provider message identifier; delivery result and error; support, complaint, privacy and refund messages; name, email, company, website, language and message supplied through the Contact form.

4.7 Customer-connected Google Analytics data

After Customer authorisation, SENRIKO may receive the GA4 property identifier, name, time zone, access/quota state and aggregated daily conversion-event and session counts, sometimes grouped by device or channel. SENRIKO does not request individual visitor identifiers or event-level profiles for this feature.

4.8 Public-Site and free-tool data

Cookie choice; page and referrer; browser, device and approximate region; form-success event without the form fields; technical logs; a submitted URL; check time, test location, detected consent tool and sanitised network observations. For abuse prevention, Consent Matrix may retain an HMAC value derived from IP for up to seven days without storing the plain IP in its application database.

UTM Survival Test. When you request a check, we process the submitted landing-page URL and, if supplied, a form-page URL on the same website, the check time, redirect observations, whether synthetic campaign tags are retained, the names of form fields and browser-storage entries that contain a test tag, and detected analytics tags. User-supplied URL query parameters are discarded before the check. Retained result URLs are limited to the host and path; form-field values and browser-storage contents are not retained.

The check uses utm_source=senriko-scan, utm_medium=senriko-check and utm_campaign=senriko-attribution. It does not fill in or submit forms, accept cookie banners or add advertising click identifiers such as gclid, fbclid or msclkid. The browser blocks analytics and advertising requests from the tested page and respects its robots.txt. A visit may still appear in the tested website’s server logs. The browser identifies itself as SENRIKO-UtmSurvival/1.0 (+https://senriko.com/bot). These observations do not verify delivery to a CRM, server-side attribution or every downstream system.

An ordinary result expires after 23 hours and is removed from active systems by the next hourly cleanup, no later than 24 hours after creation. If the creator enables sharing, the result can remain available for up to 30 days from creation of the share link, or until earlier revocation or deletion. Anyone holding an active share link can view the result. Share pages carry noindex and a no-referrer policy; these measures do not prevent a recipient from copying the result. A website owner may request deletion at help@senriko.com, subject to reasonable verification of authority.

We do not store the requester’s plain IP address with the check. Anti-abuse counters use an HMAC value derived from the IP address and expire within one hour. This value is treated as pseudonymised security data, not anonymous information. Cloudflare Turnstile processes technical data for abuse prevention, and limited infrastructure or security logs remain subject to the separate retention rules in this Policy. The result and counter deadlines refer to active systems; disaster-recovery copies age out under the existing backup schedule.

We separately retain aggregate counts of free-tool steps, such as checks started or completed, share links created or opened, and registrations through those links. These counters contain no website addresses, page URLs, IP addresses or Account data, and are not linked to an identifiable person or individual Account. They are retained for 400 days for product and seasonal comparisons.

4.9 Payment and subscription metadata

Paddle processes complete payment-card details. SENRIKO may receive the buyer/account email, name or business details, country, Plan, amount, currency, tax status, payment and subscription state, Paddle customer/transaction/subscription identifiers, invoice/receipt reference, and refund, dispute or chargeback status. SENRIKO does not receive or store complete card numbers or card security codes.

4.10 Share links and free text

Public incident-link token hash, expiry, selected display settings, revocation and access counts/times; and text a user enters when closing an incident, ignoring a finding, rejecting a path, providing feedback or describing a missed issue.

4.11 SENRIKO Conversion Inspector browser extension

Scope and purpose

SENRIKO Conversion Inspector (the “Extension”) is a free browser extension for people aged 18 or over. No SENRIKO Account or paid subscription is required. Its single purpose is to inspect forms and observe form-submission behaviour and GA4 or Google Ads signals in a website tab you choose, and report what the browser could and could not observe. The Operator identified in Section 1 also supplies the Extension; privacy questions may be sent to help@senriko.com.

The Extension processes diagnostic information locally on your device. It does not upload test data to SENRIKO or a third party. The cloud-service provisions about screenshots, synthetic submissions, server-side check history, Account data, subprocessors and backups do not describe this local function. If you separately visit senriko.com, register, use a cloud tool or contact support, the provisions for that separate activity apply.

When access takes place

Access is activated only after you click the Extension’s toolbar icon on the selected tab, and is limited to that tab’s website until the tab leaves that website. A page scan runs when you press Scan Page. Test recording runs only between Start Test and Stop, for no more than 15 minutes. The Extension does not inspect tabs on which you have not clicked its icon or read your browsing history.

Information processed on your device

The Extension processes the tested page’s origin and path without URL query parameters or fragments. Path segments recognised as email addresses, telephone numbers, identifiers or tokens are replaced with “[redacted]” before retention. It inspects form structure: field counts and types, buttons and form target paths; it does not extract field labels, field names or values entered in those fields. It identifies the tag identifiers found on the page: GTM-, G-, UA-, AW- and GT- for Google Tag Manager, Google Analytics, Google Ads and the Google tag, and Meta Pixel IDs.

During a test, it records submit-button clicks, form submissions or browser-validation blocks, page changes after submission and navigation within that website. With the optional permissions described below, it observes GA4 and Google Ads requests sent by the tested tab and retains only event names, measurement or conversion identifiers and labels, the time and type of each request, and response-status classes. Without those permissions, it may still note from the tested page’s own resource timing that a GA4 or Google Ads request was made, keeping only the provider and a general category, never the request’s address or contents.

GA4 request bodies are temporarily read in memory on your device solely to extract event names and are discarded immediately after that operation. Other body contents are not extracted into the test record, retained or transmitted by the Extension. The website determines what it places in those requests; a misconfigured website can include personal information in a body or event name. Temporary body reading must therefore not be understood as a guarantee that such information can never be encountered in memory.

Information excluded from test records

The Extension does not read values from form fields, cookies, request headers, keystrokes, the clipboard or other tabs. It does not capture screenshots or retain page text, a copy of page HTML, authentication tokens, or client and advertising-click identifiers such as cid, gclid, gbraid, wbraid and fbclid. Its inspection of form structure does not create a copy of the page’s content. The limited in-memory GA4-body operation described above is not a mechanism for extracting or retaining those excluded categories.

Masking recognises common formats and cannot guarantee removal of every unusual identifier. Use test pages and synthetic information rather than sensitive URLs, unusual event names, credentials, payment information or real details of other people.

Storage and deletion

Test data is stored only in the browser’s session storage. It is removed when you close the browser or use Clear test data. It also expires 60 minutes after the last data change or the end of the test, as applicable: from then on the Extension no longer reads or shows it, and deletes it the next time the Extension runs. The Extension is not an archive or backup service. A separate local-storage setting records only that the first-run screen has been seen; it contains no website or test information and remains until the Extension is removed.

Reports you download and summaries you copy are separate copies under your control. Session expiry, Clear test data and removal of the Extension do not delete those files, clipboard copies or copies held by your recipients. SENRIKO has no remote access to your local test records and cannot retrieve or restore them.

Network activity and sharing

The Extension has no server, telemetry, user analytics or remote configuration and makes no network request of its own. It does not send local diagnostic data to SENRIKO, Google, advertising providers or any other recipient. Requests made by the tested website, including a form you choose to submit and that website’s analytics or advertising requests, are the website’s own processing; its operator and providers govern that processing.

Information leaves the Extension’s local environment only through an action you choose, such as copying a summary, downloading a Markdown or JSON report, or subsequently sharing that copy. Links you choose to open on senriko.com contain fixed campaign labels, such as utm_source=chrome_extension, and no tested-site, test-result or personal identifier added by the Extension. Visiting that website creates a separate ordinary web visit, whose technical logs, cookie choices and other processing are covered by the main Policy. Browser and store operations, including installation, updates and store reviews, are independently governed by their providers.

Permissions and controls

The Extension uses activeTab and scripting to inspect the tab you activate, sidePanel to display its interface, storage for local state, and webRequest to observe permitted diagnostic requests. Optional access to google-analytics.com, analytics.google.com, googleadservices.com, doubleclick.net and www.google.com is requested together only after your action to enable network diagnostics. That access is used only for the active test in the tab you selected, not for general tracking. You can remove optional access in the Extension’s privacy screen or Chrome settings at any time. Without it, the Extension cannot read those requests and keeps at most the resource-timing note described above; this does not prove that those signals are absent.

Limited Use

SENRIKO Conversion Inspector follows the Chrome Web Store User Data Policy and its Limited Use requirements when processing user data, including information accessed through Chrome APIs. Local diagnostic information is used only for the disclosed form and conversion-signal inspection. It is not sold, transferred by the Extension, used for personalised advertising, general user profiling, creditworthiness or lending, or any unrelated purpose. SENRIKO personnel cannot access local test records. If you separately request support and send a specific report, it is used only for that request and lawful associated duties, subject to the Limited Use requirements.

Rights legal bases and changes

Local processing is limited to the function you expressly request. To the extent it involves personal data and SENRIKO is responsible for that processing, the relevant legal basis is performance of the requested agreement for data necessary for your own use, or a documented, proportionate legitimate interest in authorised technical diagnosis where applicable. Consent is obtained where law requires it. Browser permissions and an interface acknowledgement do not supply a lawful basis for processing someone else’s information or consenting on their behalf.

You can stop recording, clear local test data, revoke optional permissions or remove the Extension. Rights, complaints, contacts and mandatory protections in Sections 15, 20–23 continue to apply. For local records which SENRIKO does not possess, access and deletion are performed through your device; if you separately send information to SENRIKO, the applicable support and rights procedures apply to that information. SENRIKO remains responsible for duties imposed on it by law.

The Extension is not intended for children. Do not enter children’s real information into test forms. Changes to the Extension’s data practices will be disclosed in the store listing and in a new Policy version before the changed release is distributed, with a prominent in-product disclosure and any fresh consent required. Section 22 governs required advance notice; a Policy update alone does not authorise undisclosed collection or transmission.

5. Information we ask users not to provide

Do not place real passwords, complete payment details, identity documents, secret keys, medical/biometric information, children’s data, special-category data or unnecessary third-party information in test fields, URLs, Site names, comments, screenshots or support messages.

SENRIKO does not intentionally collect autoresponder bodies, Customer CRM contents, individual visitor identifiers from Customer GA4, domain-owner contact fields from RDAP/WHOIS, session replay or heatmaps.

6. Sources

We obtain data directly from users; automatically from browsers and SENRIKO systems; from monitored public Sites and configured destinations; from Google after Customer authorisation; from Paddle about transactions and subscriptions; from email and infrastructure providers; from public DNS/RDAP systems; and from a Customer acting as controller.

7. Purposes and legal bases

We use account-source information to assess which free tools lead to registration and monitoring activation and to improve those tools. Where lawful, we rely on our legitimate interests in proportionate product analytics after assessing necessity and the impact on individuals. Where applicable law requires consent for collecting source information through a link or similar technology, we collect and use it only on the required consent basis; declining or withdrawing that consent does not prevent registration or core-service use. You may object to processing based on legitimate interests, or withdraw applicable consent, through help@senriko.com or the Contact form. This information is not used for personalised advertising.

Creating an Account is acceptance of the Terms and acknowledgement of this Policy, not consent to every processing operation. Separate consent is requested only where consent is genuinely the applicable basis and is not bundled with the Service.

Where consent applies, it must be freely given, specific, informed and recorded through an unambiguous action. It can be withdrawn as easily as it was given. Withdrawal does not affect earlier lawful processing or processing supported by another basis.

8. Website monitoring and synthetic submissions

Most checks read publicly available technical information. Deep Audit follows robots.txt; a recurring check of a page expressly configured by an authorised Customer may operate independently where lawful.

A form check can submit a real synthetic lead to a Customer-controlled Site and may trigger downstream processing. It requires domain/authority verification and identifiable test markers. The Customer must have authority, use fictional values, inform appropriate personnel, configure filters and choose a proportionate frequency. SENRIKO does not control how the target Site or its vendors subsequently process a correctly submitted test.

9. Recipients and service providers

Personal data is disclosed only as needed for the stated purpose, a documented Customer instruction, a legal obligation or a protected corporate transaction.

• Hetzner Online GmbH: application, database, files and backups; current core hosting in Nuremberg, Germany.
• Resend / Plus Five Five, Inc.: transactional email, verification/reset links, alerts, reports and selected messages; United States and provider infrastructure.
• ImprovMX Incorporated: inbound forwarding of mail sent to senriko.com addresses; France and United States as described by the provider.
• Google and relevant affiliates: public-Site GA4 after consent; Customer-authorised Analytics Admin/Data APIs; Operator Gmail mailbox used for correspondence; global infrastructure.
• Cloudflare, Inc.: Turnstile and related anti-abuse/security data only where enabled; global network.
• Paddle: authorised reseller/Merchant of Record and independent controller for checkout, payment, tax, fraud, receipt, refund and chargeback processing. The applicable entity is shown at checkout.
• DNS/RDAP/WHOIS registries and operators: technical domain and DNS queries; SENRIKO does not intentionally collect registrant contact fields.
• Monitored Sites and Customer systems: SENRIKO source IP, User-Agent, monitoring header, synthetic identity and test markers as directed by the Customer.
• Professional advisers, courts, regulators and authorities: minimum information needed for a valid demand, compliance, rights protection or dispute.
• Successor or transaction parties: limited due-diligence and transfer information subject to confidentiality and continued protection.

Current subprocessors and role distinctions appear on the Subprocessors page. We do not sell personal data or disclose it to advertisers for payment.

10. International transfers

Core hosting is currently in Germany. Email, Google, Cloudflare, Paddle and other providers may process data in the United States and other countries. A Customer can also cause a transfer by monitoring a foreign Site, connecting a foreign analytics property or choosing a foreign alert recipient.

Where transfer restrictions apply, SENRIKO uses an available lawful mechanism, which may include contract necessity, data-subject consent where valid, processor agreements, contractual safeguards such as approved standard clauses, risk assessment, encryption, data minimisation and access controls. A public policy does not replace a transfer agreement required by law.

Before actively targeting a country with localisation, representative, filing or other mandatory requirements, SENRIKO will assess and implement the required controls. Availability or payment acceptance alone does not waive local law.

11. Retention

SENRIKO keeps personal data only for the period needed for the stated purpose, the contract, security, legal evidence or a binding duty. The target retention schedule for the paid launch is:

On expiry, information is deleted, irreversibly de-identified or overwritten through the backup cycle. If a legal hold is necessary, use is restricted to that purpose and only the minimum relevant records are retained.

12. Terms acceptance and consent evidence

To prove the agreement, SENRIKO may retain the accepted Terms version and language, date/time, user identifier, HMAC-derived IP value, browser/device information and Paddle transaction identifier where available. This is retained for the contract and three years after termination, longer only for an unresolved dispute, refund, chargeback, investigation or proceeding.

Where optional consent is used, SENRIKO may retain the form/purpose, document version, affirmative action, date/time, pseudonymised identifier, browser information and withdrawal record. These records are personal data and are used only for accountability and claims.

13. Security

Measures include, as appropriate:

• HTTPS/HSTS, content-source restrictions and protective HTTP headers;
• scrypt password hashing and hashing of session, one-time and public-link tokens;
• encryption of alert addresses with a key separated from the database;
• role-based access, restricted staff enablement and administrator audit logs;
• rate limits, blocked-domain controls and server-side request-forgery protection;
• isolated browser sessions and separated browser-check processes;
• backup, health monitoring, patching and incident-response procedures;
• vendor assessment, confidentiality obligations and processor contracts;
• minimisation, log redaction and retention controls.

No system is perfectly secure. Users must protect credentials, email accounts, devices, alert destinations and share links and promptly report suspicious activity to help@senriko.com.

14. Security incidents

SENRIKO maintains a process to assess, contain, document and notify relevant incidents. Where SENRIKO acts as processor and the Kyrgyz processor rule applies, it notifies the affected Customer without undue delay and no later than 48 hours after SENRIKO discovers the incident, using the information then available and supplementing it as the investigation develops.

Where SENRIKO acts as controller, owner of records or service provider and an incident affects digital resilience or individual rights, SENRIKO notifies the competent regulator no later than 72 hours after discovery where the Digital Code requires it; a delayed notice includes the reason. Information may be provided in phases. Affected individuals are informed when mandatory law requires it.

15. Individual rights

Depending on applicable law and SENRIKO’s role, a person may request:

• confirmation whether personal data is processed;
• access and a copy;
• correction of inaccurate data;
• deletion or restriction;
• portability in an available structured format;
• objection to processing based on legitimate interests;
• withdrawal of consent;
• information about sources, recipients and transfer safeguards;
• review of an automatic decision where applicable;
• complaint to a regulator or court.

Use the Account export/deletion controls, https://senriko.com/contact, or help@senriko.com. We may verify identity and authority without collecting excessive information.

Where the Kyrgyz Digital Code applies, SENRIKO provides processing information and access or a copy within seven business days; provides information about correction or supplementation within seven business days; gives a reasoned decision on an objection within seven business days; restricts disputed processing while a qualifying correction, deletion or objection is considered; and gives any required restriction or lifting notice by the next business day. A statutory deletion trigger is acted on without delay unless lawful retention applies. Where the GDPR applies, its ordinary one-month period applies unless a shorter mandatory period controls. If SENRIKO processes the data solely for a Customer, it may direct the request to that Customer and reasonably assist under the DPA.

Deletion may be limited by another person’s rights, security, fraud prevention, payment/accounting duties, a legal hold or the establishment, exercise or defence of claims.

16. Account closure, export and deletion

SENRIKO provides JSON export and Account deletion through the Account or an equally effective support route. Cancellation of a paid renewal does not itself delete the Account.

When a withdrawal or closure request requires a choice about return/export or deletion, SENRIKO calculates any supplied value/refund, identifies the user’s digital records, explains available copy/portability and deletion options, preserves the records unchanged while the choice is pending where law requires, and then performs the lawful choice. If no choice is received after a withdrawal governed by the Digital Code of the Kyrgyz Republic, SENRIKO deletes the user records after the end of the calendar year following the year of withdrawal, except records that law requires it to retain, and identifies the retained categories to the user. Retained records are restricted from ordinary use.

17. Cookies and public-Site analytics

The Cookie Policy lists cookies, local storage, Google Consent Mode and Paddle checkout technologies. SENRIKO uses Basic Consent Mode on public pages: the Google tag is not loaded before a choice and remains unloaded after rejection. Acceptance enables analytics storage only; advertising-storage and personalisation categories remain denied.

GA4 is used on selected public and sign-in/registration pages, but not in the Customer Account, admin area or public incident-share pages. Contact-form fields are not sent to GA4.

18. Public links and incidental third-party data

A Customer controls what a public incident link displays. SENRIKO masks common identifiers where feasible, but a screenshot or page controlled by the Customer may contain personal information. Customers must minimise, restrict and revoke such links.

Third-party data may incidentally appear in screenshots, URLs or autoresponder subjects. Customers should use test pages, avoid authenticated personal views and URLs containing secrets/identifiers, and request deletion when needed.

19. Automated analysis

SENRIKO automatically detects changes and anomalies and creates findings, scores and incidents. These outputs do not make decisions that produce legal or similarly significant effects for an individual. A user reviews and can close, accept, reject or ignore the output.

20. Children

SENRIKO does not knowingly offer Accounts to persons under 18 or intentionally collect children’s data. Customers must not use children’s real details in test forms or monitor authenticated areas containing children’s data without a separately assessed lawful arrangement. This age restriction also applies to SENRIKO Conversion Inspector, which requires no Account; users must not enter children’s real information into test forms.

21. Responsibility allocation

A Customer is responsible for the legality of its Sites, instructions, test values, recipients, public links and connected systems. SENRIKO is responsible for its own controller processing and for processor duties imposed by the DPA and applicable law.

Nothing in this Policy limits a non-waivable data-subject right or liability that cannot lawfully be excluded.

22. Changes

SENRIKO may update this Policy for product, provider, security or legal changes. The current version shows the date and remains saveable. Material changes affecting users’ rights or the contractual processing will be notified in advance, ordinarily at least one month before effectiveness where the Digital Code or the Terms require that period. An urgent lawful security change may take effect sooner with prompt explanation.

23. Languages and contact

This Policy is available in English and Russian. For interpretation under the law of the Kyrgyz Republic, the Russian version prevails to the extent permitted by mandatory law.

• Operator: Individual Entrepreneur Izotov Aleksandr Olegovich, TIN 23006199301704; full registered address and provider details: https://senriko.com/legal/notice.
• Privacy and support: help@senriko.com or https://senriko.com/contact.
• Supervisory authority: Personal Data Protection Agency under the Cabinet of Ministers of the Kyrgyz Republic, https://dpa.gov.kg/.