Privacy, in plain English.

Who we are

Thymesnow is the digital marketing arm of Fintrust FZE LLC, a free zone company registered in Ajman, United Arab Emirates, under licence number 2625217228888. Fintrust FZE LLC runs this website and holds the information described on this page. It is the one that answers your privacy questions.

• Company: Fintrust FZE LLC, trading as Thymesnow
• Licence number: 2625217228888
• Registered address: 26th Floor, Amber Gem Tower, Ajman, United Arab Emirates
• Contact: hello@thymesnow.com

The audit sends us nothing

The crawl, the ninety checks, the scoring, the fixes, the schema, the briefs and the link plans all run in your browser and store their results in your browser. With no account, nothing about the site you audited reaches us at all. Closing the tab and clearing the site data removes it entirely, and there is no copy on our side to ask about.

That is not a privacy feature bolted on. It is how the product is built, and it is why the whole thing keeps working with every external account disconnected.

Measuring visits

We use Google Analytics to count visits to this site: which pages are read, where visitors came from, and which buttons were pressed (book a call, email us, try the free check), whether someone booked a call or ran a check, and whether an account was created or signed in to. It is set up for measurement only.

• No advertising. Google signals and ad personalisation are switched off, and no advertising cookie is set.
• Not the site you checked. The address of a site you audit is removed from the page address before the measurement loads, and the events we record carry no site, name or email.
• Not your workspace. Nothing inside a signed-in account is measured. Our server tells Analytics only that an account was created or signed in to, and how (Google, email or password).
• Which enquiries became clients. When you book a call, we keep the random ID Analytics gave your browser alongside your enquiry. If the call leads to work together, we tell Analytics that ID turned into a good fit or a client, so we can see which channels bring clients. Only the ID and that one word are sent, never your name, email or what you wrote.
• When our homepage fails to load. If the homepage or our work page is not on screen 20 seconds after it opens, your browser sends us a short technical note so we can fix it: which parts had loaded, any script errors, and your browser's version. It carries nothing that identifies you, and we keep only the last 200 notes.
• Your choice. Measurement is on for every visitor, wherever they are. Anyone can switch it off for their own browser here, and that also stops our server sending anything about you:

Prices in your currency. One small cookie, tn_region, records only whether you are browsing from India, the Middle East or elsewhere, so prices show in rupees, dirhams or US dollars. It holds nothing else, is not shared, and lasts a day.

Fonts. To draw the pages, your browser loads our fonts from Google Fonts. Like any website you load a file from, Google sees your IP address and browser. We send it nothing else, and it sets no cookies of ours. Every script the pages run is served from this site.

If you book a call

• What you type into the form: your name, email, business, website, what you need help with and anything you add. Used to reply to you and to prepare for the call. Nothing else.
• Where it goes: into our own database, and to our team’s inbox. We keep a one-way hash of the network address it came from, only to stop the form being flooded, and never the address itself.
• Not a mailing list. Booking a call does not sign you up to anything. Ask on the call or by reply and the enquiry is deleted.

If you make an account

• Your email address and name, from the sign-in you chose. Used to identify you and to send the reports and alerts you asked for. Nothing else.
• Your workspace: the sites you added, the runs, the findings, the fixes and the approvals. A server copy of what your browser already holds, so scheduled work can happen while the tab is closed.
• A hash of your session cookie, never the cookie. Only its SHA-256 is stored, so a copy of our database cannot be replayed as a login to your account.
• An audit log of what each agent did and what you approved. This exists so you can check us, and it is the last thing we would remove.

Accounts you connect

Connecting Search Console, Analytics, a CMS or an advertising platform stores a token that lets us do the specific things the consent screen listed. Three things about those tokens:

• They are sealed with a per-record key. Each token is encrypted with its own data key, which is itself wrapped by a deployment key held outside the database. A database copy on its own opens nothing.
• No route ever returns one, in any form, including masked. A mask still confirms a value, so there is no screen and no API response anywhere in this product that shows any part of a stored secret.
• You revoke them without us. Every platform lets you withdraw access from your own account settings, and doing so takes effect immediately whether or not you tell us.

We never ask you to paste an API key or a password for an advertising platform. You log in on the platform’s own site and approve a consent screen listing exactly what we may do. The paid ads page lists the scopes per platform and why each is needed.

Advertising data specifically

Where you connect an advertising account we read campaigns, spend, results and, with your permission, the leads your forms capture, so they can be passed to you and to your own systems. We write campaigns, creatives and budgets that you have approved.

Leads captured by an advertising platform belong to you. They are passed through and stored in your workspace so you can work them, and they are deleted with your workspace. They are never sold, never shared with another customer, and never used to train anything.

Where we send conversion events back to a platform to make measurement work, the personal identifiers in those events are hashed before they leave, as the platforms themselves require.

Model keys and drafting

Drafting uses your model provider key, relayed for that one request and never written down. We hold no model key of our own, on purpose: it means the platform keeps working with every external account disconnected, and it means your drafts do not pass through an account we control.

What we never do

• Sell or rent anything about you or your customers, to anyone, for any purpose.
• Use your data, your site, your adverts or your leads to train a model.
• Show one customer’s data to another. Every scoped read puts your organisation in the query itself, and a request for somebody else’s row answers 404 rather than 403, because 403 would confirm the row exists.
• Run advertising trackers on this site, or send Google anything that names you or the site you checked.

Your rights, and the law that applies

Fintrust FZE LLC is registered in the United Arab Emirates, so we handle personal data in line with the UAE’s federal data protection law (Federal Decree-Law No. 45 of 2021). Where you are in India, the Digital Personal Data Protection Act, 2023 gives you rights too, and where you are in the European Union or the United Kingdom, so do the data protection rules there. We apply the same promises to everyone, wherever you are.

• See it. Ask what we hold about you and we will tell you, and send a copy.
• Correct it. If something we hold is wrong, tell us and we will fix it.
• Delete it. Ask, or use the deletion tools below, and it is removed.
• Withdraw consent or object. You can stop the visit measurement on this page at any time, and ask us to stop using your details for anything beyond replying to you.
• Complain. Write to us first and a person will answer. You can also complain to the data protection authority where you live.

Where it is processed. This site runs on Cloudflare’s network and sends email through Resend, and visit measurement is Google Analytics, all described above. Those services run in many countries, so what you give us can be processed outside the UAE and outside your own country. We send each of them only what it needs to do its job.

Why we use it. To reply to you, to prepare for and run the work you asked for, to keep this site working and safe, and to count visits without identifying anyone. We do not use it for anything else, and we never sell it.